Add leveraged authorization entry constraints and tests

features/fedramp_extensions.feature

@@ -171,6 +171,14 @@ Examples:
   | inventory-item-public-PASS.yaml |
   | inventory-item-virtual-FAIL.yaml |
   | inventory-item-virtual-PASS.yaml |
+  | leveraged-authorization-has-authorization-type-FAIL.yaml |
+  | leveraged-authorization-has-authorization-type-PASS.yaml |
+  | leveraged-authorization-has-impact-level-FAIL.yaml |
+  | leveraged-authorization-has-impact-level-PASS.yaml |
+  | leveraged-authorization-has-system-identifier-FAIL.yaml |
+  | leveraged-authorization-has-system-identifier-PASS.yaml |
+  | leveraged-authorization-has-user-authentication-FAIL.yaml |
+  | leveraged-authorization-has-user-authentication-PASS.yaml |
   | marking-FAIL.yaml |
   | marking-PASS.yaml |
   | missing-response-components-FAIL.yaml |
@@ -320,6 +328,10 @@ Examples:
   | inventory-item-allows-authenticated-scan |
   | inventory-item-public |
   | inventory-item-virtual |
+  | leveraged-authorization-has-authorization-type |
+  | leveraged-authorization-has-impact-level |
+  | leveraged-authorization-has-system-identifier |
+  | leveraged-authorization-has-user-authentication |
   | marking |
   | missing-response-components |
   | party-has-name |

src/validations/constraints/content/ssp-all-VALID.xml

@@ -254,6 +254,19 @@
   </system-characteristics>
 
   <system-implementation>
+    <leveraged-authorization uuid="5a9c98ab-8e5e-433d-a7bd-515c07cd1497">
+      <title>GovCloud</title>
+      <prop ns="http://fedramp.gov/ns/oscal" name="leveraged-system-identifier" value="F1603047866"/>
+      <prop ns="http://fedramp.gov/ns/oscal" name="authorization-type" value="fedramp-agency"/>
+      <prop ns="http://fedramp.gov/ns/oscal" name="impact-level" value="fips-199-moderate"/>
+      <prop ns="http://fedramp.gov/ns/oscal" name="user-authentication" value="yes">
+        <remarks>
+          <p>Some description of the user authentication method.</p>
+        </remarks>
+      </prop>
+      <party-uuid>f0bc13a4-3303-47dd-80d3-380e159c8362</party-uuid>
+      <date-authorized>2015-01-01</date-authorized>
+    </leveraged-authorization>
     <user uuid="44444444-0000-4000-9000-000000000004">
       <title>System Administrator</title>
       <prop name="type" value="internal"/>

src/validations/constraints/content/ssp-leveraged-authorization-has-authorization-type-INVALID.xml

@@ -0,0 +1,8 @@
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" uuid="12345678-1234-4321-8765-123456789012">
+  <system-implementation>
+    <leveraged-authorization uuid="5a9c98ab-8e5e-433d-a7bd-515c07cd1497">
+      <!-- <prop ns="http://fedramp.gov/ns/oscal" name="authorization-type" value="fedramp-agency"/> Missing authorization-type -->
+      <date-authorized>2015-01-01</date-authorized>
+    </leveraged-authorization>
+  </system-implementation>
+</system-security-plan>

src/validations/constraints/content/ssp-leveraged-authorization-has-impact-level-INVALID.xml

@@ -0,0 +1,9 @@
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" uuid="12345678-1234-4321-8765-123456789012">
+  <system-implementation>
+    <leveraged-authorization uuid="5a9c98ab-8e5e-433d-a7bd-515c07cd1497">
+      <!-- <prop ns="http://fedramp.gov/ns/oscal" name="impact-level" value="moderate"/> Missing impact-level -->
+      <party-uuid>f0bc13a4-3303-47dd-80d3-380e159c8362</party-uuid>
+      <date-authorized>2015-01-01</date-authorized>
+    </leveraged-authorization>
+  </system-implementation>
+</system-security-plan>

src/validations/constraints/content/ssp-leveraged-authorization-has-system-identifier-INVALID.xml

@@ -0,0 +1,7 @@
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" uuid="12345678-1234-4321-8765-123456789012">
+  <system-implementation>
+    <leveraged-authorization uuid="5a9c98ab-8e5e-433d-a7bd-515c07cd1497">
+      <!-- <prop ns="http://fedramp.gov/ns/oscal" name="leveraged-system-identifier" value="F1603047866"/> Missing leveraged-system-identifier -->
+    </leveraged-authorization>
+  </system-implementation>
+</system-security-plan>

src/validations/constraints/content/ssp-leveraged-authorization-has-user-authentication-INVALID.xml

@@ -0,0 +1,13 @@
+<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" uuid="12345678-1234-4321-8765-123456789012">
+  <system-implementation>
+    <leveraged-authorization uuid="5a9c98ab-8e5e-433d-a7bd-515c07cd1497">
+      <prop ns="http://fedramp.gov/ns/oscal" name="user-authentication" value="yes">
+        <!-- <remarks>
+          <p>If 'yes', describe the user authentication method.</p>
+          <p>If 'no', explain why no user authentication is used.</p>
+          <p>If 'not-applicable', attest that no users access the leveraged system.</p>
+        </remarks> No remarks provided to support the value-->
+      </prop>
+    </leveraged-authorization>
+  </system-implementation>
+</system-security-plan>

src/validations/constraints/fedramp-external-constraints.xml

@@ -517,6 +517,26 @@
 				<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/5-attachments/#system-inventory-approach"/>
 				<message>A FedRAMP SSP system implementation section MUST have at least two inventory items.</message>
 			</expect>
+            <expect id="leveraged-authorization-has-authorization-type" target="leveraged-authorization" test="count(prop[@name='authorization-type'][@ns='http://fedramp.gov/ns/oscal']) = 1" level="ERROR">
+                <formal-name>Leveraged Authorization Has Authorization Type</formal-name>
+                <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/4-ssp-template-to-oscal-mapping/#leveraged-fedramp-authorized-services"/>
+                <message>A FedRAMP SSP MUST define exactly one authorization type for each leveraged authorization entry.</message>
+            </expect>
+            <expect id="leveraged-authorization-has-impact-level" target="leveraged-authorization" test="count(prop[@name='impact-level'][@ns='http://fedramp.gov/ns/oscal']) = 1" level="ERROR">
+                <formal-name>Leveraged Authorization Has Impact Level</formal-name>
+                <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/4-ssp-template-to-oscal-mapping/#leveraged-fedramp-authorized-services"/>
+                <message>A FedRAMP SSP MUST define exactly one impact level for each leveraged authorization entry.</message>
+            </expect>
+            <expect id="leveraged-authorization-has-system-identifier" target="leveraged-authorization" test="count(prop[@name='leveraged-system-identifier'][@ns='http://fedramp.gov/ns/oscal']) = 1" level="ERROR">
+                <formal-name>Leveraged Authorization Has System Identifier</formal-name>
+                <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/4-ssp-template-to-oscal-mapping/#leveraged-fedramp-authorized-services"/>
+                <message>A FedRAMP SSP MUST define exactly one system identifier for each leveraged authorization entry.</message>
+            </expect>
+            <expect id="leveraged-authorization-has-user-authentication" target="leveraged-authorization" test="count(prop[@name='user-authentication'][@ns='http://fedramp.gov/ns/oscal']/remarks) = 1" level="ERROR">
+                <formal-name>Leveraged Authorization Has User Authentication</formal-name>
+                <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/4-ssp-template-to-oscal-mapping/#leveraged-fedramp-authorized-services"/>
+                <message>A FedRAMP SSP MUST provide exactly one explanation of the user authentication for each leveraged authorization entry.</message>
+            </expect>
 		</constraints>
 	</context>    
     <context>

src/validations/constraints/unit-tests/leveraged-authorization-has-authorization-type-FAIL.yaml

@@ -0,0 +1,9 @@
+test-case:
+  name: Negative Test for leveraged-authorization-has-authorization-type
+  description: >-
+    This test case validates the behavior of constraint
+    leveraged-authorization-has-authorization-type
+  content: ../content/ssp-leveraged-authorization-has-authorization-type-INVALID.xml
+  expectations:
+    - constraint-id: leveraged-authorization-has-authorization-type
+      result: fail

src/validations/constraints/unit-tests/leveraged-authorization-has-authorization-type-PASS.yaml

@@ -0,0 +1,9 @@
+test-case:
+  name: Positive Test for leveraged-authorization-has-authorization-type
+  description: >-
+    This test case validates the behavior of constraint
+    leveraged-authorization-has-authorization-type
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: leveraged-authorization-has-authorization-type
+      result: pass

src/validations/constraints/unit-tests/leveraged-authorization-has-impact-level-FAIL.yaml

@@ -0,0 +1,9 @@
+test-case:
+  name: Negative Test for leveraged-authorization-has-impact-level
+  description: >-
+    This test case validates the behavior of constraint
+    leveraged-authorization-has-impact-level
+  content: ../content/ssp-leveraged-authorization-has-impact-level-INVALID.xml
+  expectations:
+    - constraint-id: leveraged-authorization-has-impact-level
+      result: fail

src/validations/constraints/unit-tests/leveraged-authorization-has-impact-level-PASS.yaml

@@ -0,0 +1,9 @@
+test-case:
+  name: Positive Test for leveraged-authorization-has-impact-level
+  description: >-
+    This test case validates the behavior of constraint
+    leveraged-authorization-has-impact-level
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: leveraged-authorization-has-impact-level
+      result: pass

src/validations/constraints/unit-tests/leveraged-authorization-has-system-identifier-FAIL.yaml

@@ -0,0 +1,9 @@
+test-case:
+  name: Negative Test for leveraged-authorization-has-system-identifier
+  description: >-
+    This test case validates the behavior of constraint
+    leveraged-authorization-has-system-identifier
+  content: ../content/ssp-leveraged-authorization-has-system-identifier-INVALID.xml
+  expectations:
+    - constraint-id: leveraged-authorization-has-system-identifier
+      result: fail

src/validations/constraints/unit-tests/leveraged-authorization-has-system-identifier-PASS.yaml

@@ -0,0 +1,9 @@
+test-case:
+  name: Positive Test for leveraged-authorization-has-system-identifier
+  description: >-
+    This test case validates the behavior of constraint
+    leveraged-authorization-has-system-identifier
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: leveraged-authorization-has-system-identifier
+      result: pass

src/validations/constraints/unit-tests/leveraged-authorization-has-user-authentication-FAIL.yaml

@@ -0,0 +1,9 @@
+test-case:
+  name: Negative Test for leveraged-authorization-has-user-authentication
+  description: >-
+    This test case validates the behavior of constraint
+    leveraged-authorization-has-user-authentication
+  content: ../content/ssp-leveraged-authorization-has-user-authentication-INVALID.xml
+  expectations:
+    - constraint-id: leveraged-authorization-has-user-authentication
+      result: fail

src/validations/constraints/unit-tests/leveraged-authorization-has-user-authentication-PASS.yaml

@@ -0,0 +1,9 @@
+test-case:
+  name: Positive Test for leveraged-authorization-has-user-authentication
+  description: >-
+    This test case validates the behavior of constraint
+    leveraged-authorization-has-user-authentication
+  content: ../content/ssp-all-VALID.xml
+  expectations:
+    - constraint-id: leveraged-authorization-has-user-authentication
+      result: pass