Declarative security management plugins

1. A client-server system, comprising:

a network;

a client coupled to the network and configured to:

transmit a service plugin package to a validation system via the network;

validate the service plugin package utilizing the validation system;

receive a validation indicator that indicates whether the service plugin pack is valid from the validation system;

when the validation indicator indicates that the service plugin package is valid, transmit the service plugin package via the network;

after transmitting the service plugin package, transmit client service data associated with a set of extension declarations of the service plugin package using a client service plugin of the service plugin package over the network;

a runtime server coupled to the network and configured to:

receive the service plugin package from the network;

access a first set of management services;

identify, for each management service of the first set of management services, a subset of the set of extension declarations of the service plugin package that are supported by the management service;

add, for each management service of the first set of management services, a respective subset of the set of extension declarations to the respective management service that supports the respective subset of the set of extension declarations, each extension declaration of the set of extension declarations including i) grouping information that describes how the extension declaration is to be grouped within an existing set of extension declarations of the first set of the management services, and ii) ordering information that describes how the extension declaration is to be ordered within a particular grouping of extension declarations of the first set of the management services;

receive the client service data from the client via the network; and

provide a first management service of the first set of management services for the client based on the client service data and a first subset of the set of extension declarations corresponding to the first management service,

wherein the first subset of the set of extension declarations specifies how the first management service is provided to the client.

2. The client-server system of claim 1 , wherein the validation system comprises:

a test client configured to:

receive the service plugin package from the client via the network;

execute a set of client test scripts of the service plugin package to cause the client service plugin to transmit test client service data associated with the set of extension declarations over the network; and

when the execution of the set of client test scripts is complete, transmit the validation indicator that indicates whether the service plugin package is valid to the client, wherein the validation indicator is based on each execution result of each client test script of the set of client test scripts; and

a test runtime server configured to:

receive the service plugin package associated with the client service plugin from the client via the network;

access a second set of the management services, wherein the second set of the management services corresponds to the first set of the management services;

add the set of extension declarations to the second set of the management services;

receive the test client service data from the test client via the network; and

provide a second management service of the second set of management services for the test client based on the test client service data and a second subset of the set of extension declarations corresponding to the second management service.

3. The client-server system of claim 1 , wherein the service plugin package comprises one or more of:

a service plugin identification;

a service plugin name;

a service plugin description;

a client service plugin;

a set of client test scripts;

a service plugin declaration;

a set of extension declarations;

a set of help files;

management service installation (MSI) information;

a set of content files;

a set of support files; and

security information including security certificates.

4. The client-server system of claim 1 , wherein each extension declaration of the set of extension declarations comprise:

a type of the extension declaration comprising one of:

an event type of the extension declaration including event information;

a command type of the extension declaration including command information;

a policy type of the extension declaration including policy information;

a state type of the extension declaration including state information; and

a dependency type of the extension declaration including dependency information;

descriptor information that describes how the extension declaration is to be operationally processed by the runtime server; and

localization resource information that describes how each extension declaration is to be processed by the runtime server to support localized resources in multiple locales.

5. The client-server system of claim 1 , wherein the first set of management services comprises a set of security services.

6. The client-server system of claim 1 , the client further configured to:

prior to the transmission of the client service data over the network:

generate the set of extension declarations from a set of assertions within source code of the client service plugin, wherein the set of assertions specifies how the first set of the management services are extended; and

build the service plugin package based on the client server plugin and the set of extension declarations.

7. A method, comprising:

transmitting, by a client of a client-server system, a service plugin package to a validation system via the network;

validating, by the client, the service plugin package utilizing the validation system;

receiving, by the client, a validation indicator that indicates whether the service plugin package is valid from the validation system;

when the validation indicator indicates that the service plugin package is valid, transmitting, by the client, the service plugin package to a runtime server via the network,

after transmitting the service plugin package, transmitting, by the client, client service data associated with a set of extension declarations of the service plugin package using a client service plugin of the service plugin package over the network;

receiving, by a runtime server of the client-server system the service plugin package from the network;

accessing, by the runtime server, a first set of management services;

identifying, by the runtime server and for each management service of the first set of management services, a subset of the set of extension declarations of the service plugin package that are supported by the management service;

adding, by the runtime server and for each management service of the first set of management services, a respective subset of the set of extension declarations to the respective management service that supports the respective subset of the set of extension declarations, each extension declaration of the set of extension declarations including i) grouping information that describes how the extension declaration is to be grouped within an existing set of extension declarations of the first set of the management services, and ii) ordering information that describes how the extension declaration is to be ordered within a particular grouping of extension declarations of the first set of the management services;

receiving, by the runtime server, the client service data from the client via the network; and

providing, by the runtime server, a first management service of the first set of management services for the client based on the client service data and a first subset of the set of extension declarations corresponding to the first management service,

wherein the first subset of the set of extension declarations specifies how the first management service is provided to the client.

8. The method of claim 7 , wherein the method further comprises:

receiving, by a test client of the validation system, the service plugin package from the client via the network;

executing, by the test client, a set of client test scripts of the service plugin package to cause the client service plugin to transmit test client service data associated with the set of extension declarations over the network; and

when the execution of the set of client test scripts is complete, transmitting, by the test client, the validation indicator that indicates whether the service plugin package is valid to the client, wherein the validation indicator is based on each execution result of each client test script of the set of client test scripts; and

receiving, by a test runtime server of the validation system, the service plugin package associated with the client service plugin from the client via the network;

accessing, by the test runtime server, a second set of the management services, wherein the second set of the management services corresponds to the first set of the management services;

adding, by the test runtime server, the set of extension declarations to the second set of the management services;

receiving, by the test runtime server, the test client service data from the test client via the network; and

providing, by the test runtime server, a second management service of the second set of management services for the test client based on the test client service data and a second subset of the set of extension declarations corresponding to the second management service.

9. The method of claim 7 , wherein the service plugin package comprises one or more of:

a service plugin identification;

a service plugin name;

a service plugin description;

a client service plugin;

a set of client test scripts;

a service plugin declaration;

a set of extension declarations;

a set of help files;

management service installation (MSI) information;

a set of content files;

a set of support files; and

security information including security certificates.

10. The method of claim 7 , wherein each extension declaration of the set of extension declarations comprises:

a type of the extension declaration comprising one of:

an event type of the extension declaration including event information;

a command type of the extension declaration including command information;

a policy type of the extension declaration including policy information;

a state type of the extension declaration including state information; and

a dependency type of the extension declaration including dependency information;

descriptor information that describes how the extension declaration is to be operationally processed by the runtime server; and

localization resource information that describes how each extension declaration is to be processed by the runtime server to support localized resources in multiple locales.

11. The method of claim 7 , wherein the first set of management services comprises a set of security services.

12. The method of claim 7 , wherein the method further comprises:

prior to transmitting the client service data over the network:

generating, by the client, the set of extension declarations from a set of assertions within source code of the client service plugin, wherein the set of assertions specifies how the first set of the management services are extended; and

building, by the client, the service plugin package based on the client server plugin and the set of extension declarations.

13. The client-server system of claim 1 , wherein a particular extension declaration of a particular subset of the set of extension declarations is associated with i) an error event grouping information and ii) an order of execution with respect to other extension declarations within the error event grouping.