PR for leveraged authorization constraints (issue #898)

features/fedramp_extensions.feature

@@ -105,8 +105,14 @@ Examples:
   | inventory-item-allows-authenticated-scan |
   | inventory-item-public |
   | inventory-item-virtual |
+  | leveraged-authorization-component-has-valid-reference |
   | leveraged-authorization-has-authorization-type |
+  | leveraged-authorization-has-authorized-users |
   | leveraged-authorization-has-impact-level |
+  | leveraged-authorization-has-implementation-point |
+  | leveraged-authorization-has-information-type |
+  | leveraged-authorization-has-nature-of-agreement |
+  | leveraged-authorization-has-one-system-component |
   | leveraged-authorization-has-system-identifier |
   | leveraged-authorization-nature-of-agreement |
   | marking |
@@ -315,10 +321,22 @@ Examples:
   | inventory-item-public-PASS.yaml |
   | inventory-item-virtual-FAIL.yaml |
   | inventory-item-virtual-PASS.yaml |
+  | leveraged-authorization-component-has-valid-reference-FAIL.yaml |
+  | leveraged-authorization-component-has-valid-reference-PASS.yaml |
   | leveraged-authorization-has-authorization-type-FAIL.yaml |
   | leveraged-authorization-has-authorization-type-PASS.yaml |
+  | leveraged-authorization-has-authorized-users-FAIL.yaml |
+  | leveraged-authorization-has-authorized-users-PASS.yaml |
   | leveraged-authorization-has-impact-level-FAIL.yaml |
   | leveraged-authorization-has-impact-level-PASS.yaml |
+  | leveraged-authorization-has-implementation-point-FAIL.yaml |
+  | leveraged-authorization-has-implementation-point-PASS.yaml |
+  | leveraged-authorization-has-information-type-FAIL.yaml |
+  | leveraged-authorization-has-information-type-PASS.yaml |
+  | leveraged-authorization-has-nature-of-agreement-FAIL.yaml |
+  | leveraged-authorization-has-nature-of-agreement-PASS.yaml |
+  | leveraged-authorization-has-one-system-component-FAIL.yaml |
+  | leveraged-authorization-has-one-system-component-PASS.yaml |
   | leveraged-authorization-has-system-identifier-FAIL.yaml |
   | leveraged-authorization-has-system-identifier-PASS.yaml |
   | leveraged-authorization-nature-of-agreement-FAIL.yaml |

src/validations/constraints/content/leveraged-authorization-component-has-valid-reference-INVALID.xml

@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0"
+                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                      xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd"
+                      uuid="12345678-1234-4321-8765-123456789012">
+
+  <system-implementation>
+    <leveraged-authorization uuid="94d678fb-6d33-4eef-a17a-897bb4809487" >
+      <title>Name of Underlying System</title>
+      <!-- FedRAMP Package ID -->
+      <prop name="leveraged-system-identifier" 
+          ns="https://fedramp.gov/ns/oscal" 
+          value="F9999999999" />
+      <prop ns="https://fedramp.gov/ns/oscal" name="authorization-type" 
+            value="fedramp-agency"/>
+      <prop ns="https://fedramp.gov/ns/oscal" name="impact-level" value="moderate"/>
+      <link href="//path/to/leveraged_system_legacy_crm.xslt" />
+      <link href="//path/to/leveraged_system_responsibility_and_inheritance.xml" />
+      <party-uuid>11111111-0000-4000-9000-000000000003</party-uuid>
+      <date-authorized>2019-01-01</date-authorized>
+      <remarks>
+        <p>Sample leveraged authorization (e.g., underlying IaaS).</p>
+      </remarks>
+    </leveraged-authorization>
+
+    <!-- Leveraged authorization has more than one associated service components -->
+    <component uuid="7622fb94-ac33-498a-a955-fb3501f02d83" type="system">
+      <title>Name of Leveraged System</title>
+      <description>
+          <p>Briefly describe leveraged system.</p>
+      </description>
+      <prop name="leveraged-authorization-uuid" 
+            value="94d678fb-6d33-4eef-a17a-000000000000" />
+      <prop name="implementation-point" value="external"/>
+      <status state="operational"/>
+    </component>
+
+  </system-implementation>
+
+</system-security-plan>

src/validations/constraints/content/ssp-all-VALID.xml

@@ -309,13 +309,21 @@
       </description>
       <prop name="leveraged-authorization-uuid" value="233e0f09-fe5e-47e2-bca3-5f32df75e57a"/>
       <prop name="nature-of-agreement" ns="https://fedramp.gov/ns/oscal" value="sla"/>
+      <prop name="information-type"  ns="https://fedramp.gov/ns/oscal" value="C.3.5.8" />
+      <prop name="implementation-point" value="external"/>
       <prop ns="https://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
         <remarks>
           <p>Some description of the authentication method.</p>
         </remarks>
       </prop>
      <status state="operational"/>
-     </component>
+      <responsible-role role-id="system-admin">
+        <party-uuid>6b286b5d-8f07-4fa7-8847-1dd0d88f73fb</party-uuid>
+        <remarks>
+          <p>Using responsible-role to represent the CSPs "authorized users" who have access the leveraged authorization service.</p>
+        </remarks>
+      </responsible-role>
+    </component>
 
     <component uuid="66666666-0000-4000-9000-000000000006" type="interconnection">
       <title>External API Connection</title>

src/validations/constraints/content/ssp-leveraged-authorization-component-has-nature-of-agreement-INVALID-1.xml

@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0"
+                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                      xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd"
+                      uuid="12345678-1234-4321-8765-123456789012">
+
+  <system-implementation>
+    <leveraged-authorization uuid="94d678fb-6d33-4eef-a17a-897bb4809487" >
+      <title>Name of Underlying System</title>
+      <!-- FedRAMP Package ID -->
+      <prop name="leveraged-system-identifier" 
+          ns="https://fedramp.gov/ns/oscal" 
+          value="F9999999999" />
+      <prop ns="https://fedramp.gov/ns/oscal" name="authorization-type" 
+            value="fedramp-agency"/>
+      <prop ns="https://fedramp.gov/ns/oscal" name="impact-level" value="moderate"/>
+      <link href="//path/to/leveraged_system_legacy_crm.xslt" />
+      <link href="//path/to/leveraged_system_responsibility_and_inheritance.xml" />
+      <party-uuid>11111111-0000-4000-9000-000000000003</party-uuid>
+      <date-authorized>2019-01-01</date-authorized>
+      <remarks>
+        <p>Sample leveraged authorization (e.g., underlying IaaS).</p>
+      </remarks>
+    </leveraged-authorization>
+
+    <!-- Leveraged authorization has associcated service component BUT with more than one "nature-of-agreement" prop-->
+    <component uuid="7622fb94-ac33-498a-a955-fb3501f02d83" type="system">
+      <title>Name of Leveraged System</title>
+      <description>
+          <p>Briefly describe leveraged system.</p>
+      </description>
+      <prop name="leveraged-authorization-uuid" 
+            value="94d678fb-6d33-4eef-a17a-897bb4809487" />
+      <!-- componet missing "nature-of-agreement" prop-->
+      <prop name="nature-of-agreement"  ns="http://fedramp.gov/ns/oscal" value="EULA" />
+      <prop name="nature-of-agreement"  ns="http://fedramp.gov/ns/oscal" value="Contract" />
+      <prop name="implementation-point" value="external"/>
+      <status state="operational"/>
+  </component>
+
+  </system-implementation>
+
+</system-security-plan>

src/validations/constraints/content/ssp-leveraged-authorization-component-has-nature-of-agreement-INVALID.xml

@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0"
+                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                      xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd"
+                      uuid="12345678-1234-4321-8765-123456789012">
+
+  <system-implementation>
+    <leveraged-authorization uuid="94d678fb-6d33-4eef-a17a-897bb4809487" >
+      <title>Name of Underlying System</title>
+      <!-- FedRAMP Package ID -->
+      <prop name="leveraged-system-identifier" 
+          ns="https://fedramp.gov/ns/oscal" 
+          value="F9999999999" />
+      <prop ns="https://fedramp.gov/ns/oscal" name="authorization-type" 
+            value="fedramp-agency"/>
+      <prop ns="https://fedramp.gov/ns/oscal" name="impact-level" value="moderate"/>
+      <link href="//path/to/leveraged_system_legacy_crm.xslt" />
+      <link href="//path/to/leveraged_system_responsibility_and_inheritance.xml" />
+      <party-uuid>11111111-0000-4000-9000-000000000003</party-uuid>
+      <date-authorized>2019-01-01</date-authorized>
+      <remarks>
+        <p>Sample leveraged authorization (e.g., underlying IaaS).</p>
+      </remarks>
+    </leveraged-authorization>
+
+    <!-- Leveraged authorization has associcated service component BUT without "nature-of-agreement" prop-->
+    <component uuid="7622fb94-ac33-498a-a955-fb3501f02d83" type="system">
+      <title>Name of Leveraged System</title>
+      <description>
+          <p>Briefly describe leveraged system.</p>
+      </description>
+      <prop name="leveraged-authorization-uuid" 
+            value="94d678fb-6d33-4eef-a17a-897bb4809487" />
+      <!-- componet missing "nature-of-agreement" prop-->
+      <!-- <prop name="nature-of-agreement"  ns="http://fedramp.gov/ns/oscal" value="SLA" /> -->
+      <prop name="implementation-point" value="external"/>
+      <status state="operational"/>
+  </component>
+
+  </system-implementation>
+
+</system-security-plan>

src/validations/constraints/content/ssp-leveraged-authorization-component-has-valid-reference-INVALID.xml

@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0"
+                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                      xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd"
+                      uuid="12345678-1234-4321-8765-123456789012">
+
+  <system-implementation>
+    <leveraged-authorization uuid="94d678fb-6d33-4eef-a17a-897bb4809487" >
+      <title>Name of Underlying System</title>
+      <!-- FedRAMP Package ID -->
+      <prop name="leveraged-system-identifier" 
+          ns="https://fedramp.gov/ns/oscal" 
+          value="F9999999999" />
+      <prop ns="https://fedramp.gov/ns/oscal" name="authorization-type" 
+            value="fedramp-agency"/>
+      <prop ns="https://fedramp.gov/ns/oscal" name="impact-level" value="moderate"/>
+      <link href="//path/to/leveraged_system_legacy_crm.xslt" />
+      <link href="//path/to/leveraged_system_responsibility_and_inheritance.xml" />
+      <party-uuid>11111111-0000-4000-9000-000000000003</party-uuid>
+      <date-authorized>2019-01-01</date-authorized>
+      <remarks>
+        <p>Sample leveraged authorization (e.g., underlying IaaS).</p>
+      </remarks>
+    </leveraged-authorization>
+
+    <!-- Leveraged authorization component has invalid "leveraged-authorization-uuid" -->
+    <component uuid="7622fb94-ac33-498a-a955-fb3501f02d83" type="system">
+      <title>Name of Leveraged System</title>
+      <description>
+          <p>Briefly describe leveraged system.</p>
+      </description>
+      <prop name="leveraged-authorization-uuid" 
+            value="94d678fb-6d33-4eef-a17a-897bb4800000" />
+      <prop name="implementation-point" value="external"/>
+      <status state="operational"/>
+    </component>
+
+  </system-implementation>
+
+</system-security-plan>

src/validations/constraints/content/ssp-leveraged-authorization-has-authorized-users-INVALID.xml

@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0"
+                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                      xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd"
+                      uuid="12345678-1234-4321-8765-123456789012">
+
+  <system-implementation>
+    <leveraged-authorization uuid="94d678fb-6d33-4eef-a17a-897bb4809487" >
+      <title>Name of Underlying System</title>
+      <!-- FedRAMP Package ID -->
+      <prop name="leveraged-system-identifier" 
+          ns="https://fedramp.gov/ns/oscal" 
+          value="F9999999999" />
+      <prop ns="https://fedramp.gov/ns/oscal" name="authorization-type" 
+            value="fedramp-agency"/>
+      <prop ns="https://fedramp.gov/ns/oscal" name="impact-level" value="moderate"/>
+      <link href="//path/to/leveraged_system_legacy_crm.xslt" />
+      <link href="//path/to/leveraged_system_responsibility_and_inheritance.xml" />
+      <party-uuid>11111111-0000-4000-9000-000000000003</party-uuid>
+      <date-authorized>2019-01-01</date-authorized>
+      <remarks>
+        <p>Sample leveraged authorization (e.g., underlying IaaS).</p>
+      </remarks>
+    </leveraged-authorization>
+
+    <!-- Leveraged authorization has associcated service component BUT missing "authorized users"-->
+    <component uuid="7622fb94-ac33-498a-a955-fb3501f02d83" type="system">
+      <title>Name of Leveraged System</title>
+      <description>
+          <p>Briefly describe leveraged system.</p>
+      </description>
+      <prop name="leveraged-authorization-uuid" value="94d678fb-6d33-4eef-a17a-897bb4809487" />
+      <prop name="nature-of-agreement"  ns="http://fedramp.gov/ns/oscal" value="eula" />
+      <prop name="implementation-point" value="external"/>
+      <status state="operational"/>
+      <!-- missing responsible-role / role-id to indidate "authorized users" -->
+  </component>
+
+  </system-implementation>
+
+</system-security-plan>

src/validations/constraints/content/ssp-leveraged-authorization-has-implementation-point-INVALID.xml

@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0"
+                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                      xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd"
+                      uuid="12345678-1234-4321-8765-123456789012">
+
+  <system-implementation>
+    <leveraged-authorization uuid="94d678fb-6d33-4eef-a17a-897bb4809487" >
+      <title>Name of Underlying System</title>
+      <!-- FedRAMP Package ID -->
+      <prop name="leveraged-system-identifier" 
+          ns="https://fedramp.gov/ns/oscal" 
+          value="F9999999999" />
+      <prop ns="https://fedramp.gov/ns/oscal" name="authorization-type" 
+            value="fedramp-agency"/>
+      <prop ns="https://fedramp.gov/ns/oscal" name="impact-level" value="moderate"/>
+      <link href="//path/to/leveraged_system_legacy_crm.xslt" />
+      <link href="//path/to/leveraged_system_responsibility_and_inheritance.xml" />
+      <party-uuid>11111111-0000-4000-9000-000000000003</party-uuid>
+      <date-authorized>2019-01-01</date-authorized>
+      <remarks>
+        <p>Sample leveraged authorization (e.g., underlying IaaS).</p>
+      </remarks>
+    </leveraged-authorization>
+
+    <!-- Leveraged authorization has associcated service component BUT without "implementation-point" prop-->
+    <component uuid="7622fb94-ac33-498a-a955-fb3501f02d83" type="system">
+      <title>Name of Leveraged System</title>
+      <description>
+          <p>Briefly describe leveraged system.</p>
+      </description>
+      <prop name="leveraged-authorization-uuid" 
+            value="94d678fb-6d33-4eef-a17a-897bb4809487" />
+      <prop name="nature-of-agreement"  ns="http://fedramp.gov/ns/oscal" value="SLA" />
+      <!-- componet missing "implementation-point" prop-->
+      <!-- <prop name="implementation-point" value="external" /> -->
+      <status state="operational"/>
+  </component>
+
+  </system-implementation>
+
+</system-security-plan>

src/validations/constraints/content/ssp-leveraged-authorization-has-information-type-INVALID.xml

@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0"
+                      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                      xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd"
+                      uuid="12345678-1234-4321-8765-123456789012">
+
+  <system-implementation>
+    <leveraged-authorization uuid="94d678fb-6d33-4eef-a17a-897bb4809487" >
+      <title>Name of Underlying System</title>
+      <!-- FedRAMP Package ID -->
+      <prop name="leveraged-system-identifier" 
+          ns="https://fedramp.gov/ns/oscal" 
+          value="F9999999999" />
+      <prop ns="https://fedramp.gov/ns/oscal" name="authorization-type" 
+            value="fedramp-agency"/>
+      <prop ns="https://fedramp.gov/ns/oscal" name="impact-level" value="moderate"/>
+      <link href="//path/to/leveraged_system_legacy_crm.xslt" />
+      <link href="//path/to/leveraged_system_responsibility_and_inheritance.xml" />
+      <party-uuid>11111111-0000-4000-9000-000000000003</party-uuid>
+      <date-authorized>2019-01-01</date-authorized>
+      <remarks>
+        <p>Sample leveraged authorization (e.g., underlying IaaS).</p>
+      </remarks>
+    </leveraged-authorization>
+
+    <!-- Leveraged authorization has associcated service component BUT without "information-type" prop-->
+    <component uuid="7622fb94-ac33-498a-a955-fb3501f02d83" type="system">
+      <title>Name of Leveraged System</title>
+      <description>
+          <p>Briefly describe leveraged system.</p>
+      </description>
+      <prop name="leveraged-authorization-uuid" 
+            value="94d678fb-6d33-4eef-a17a-897bb4809487" />
+      <prop name="nature-of-agreement"  ns="http://fedramp.gov/ns/oscal" value="SLA" />
+      <!-- componet missing "information-type" prop-->
+      <!-- <prop name="information-type"  ns="http://fedramp.gov/ns/oscal" value="C.3.5.4" /> -->
+      <prop name="implementation-point" value="external"/>
+      <status state="operational"/>
+  </component>
+
+  </system-implementation>
+
+</system-security-plan>