Infrastructure

In the java code, the authorization algorithm is implemented in a few packages: metacat & d1_solr_extensions, at least. These two show differences in building the set of authorized subjects from the client's session object, and differing handling of null values that may exist in the provided session object. The handling of subjectInfo also differs between MN and CN contexts, (whereby the MNs use the subjectInfo contained in the certificate and the CNs don't).

Having a common, well-tested implementation of the algorithm, or parts of it (session parsing, for example) will result in a more reliable and consistent authorization process across the different subcomponents of the CNs and MNs.