Fine-grained authorization with XACML http://blog.facilelogin.com/

1. Prabath Siriwardena – Software Architect, WSO2

2. drdan
nlaJoo
ichae l
M Ro

9. eXtensible Access Control Markup Language

10. First Meeting – 21 May 2001

11. Requirements from Healthcare, DRM, Registry,
Financial, Online Web

12. XACML 1.0 - OASIS Standard – 6 February 2003

13. XACML 1.1 – Committee Specification – 7th August 2003

14. XACML 2.0 – OASIS Standard – 1 February 2005

15. XACML 3.0 – OASIS Standard – 10th Aug 2010

16. Defines Policy
Administration
Point
Administrator

23. Access Policy
Evaluation
Point
Policy
Decision
Point

25. <inSequence>
<entitlementService
remoteServicePassword=“********"
remoteServiceUrl="https://identity-server:9443/services"
remoteServiceUserName="prabath"/> UT
</inSequence>
UT

26. <inSequence>
<entitlementService
callbackClass=“org.wso2.carbon.identity.entitlement.mediator.
KerberosEntitlementCallbackHandler”
remoteServicePassword=“********"
remoteServiceUrl="https://identity-server:9443/services" Kerberos
remoteServiceUserName="prabath”
/> Kerberos
</inSequence>

27. <inSequence>
<property
name="xacml_use_rest"
value=”true"
scope=”axis2"
type="STRING"/>
<entitlementService
remoteServicePassword=“********" BasicAuth/
remoteServiceUrl="https://identity-server:9443/services" RESTful
remoteServiceUserName="prabath”
/>
</inSequence> BasicAuth/
RESTful

28. <inSequence>
<entitlementService
callbackClass=“org.wso2.carbon.identity.entitlement.mediator.
X509EntitlementCallbackHandler”
remoteServicePassword=“********"
remoteServiceUrl="https://identity-server:9443/services" Sign
remoteServiceUserName="prabath”
/> Sign
</inSequence>

29. <inSequence>
<entitlementService
callbackClass=“my.own.CustomEmtitlementCallbackhandler”
remoteServicePassword=“********"
remoteServiceUrl="https://identity-server:9443/services"
remoteServiceUserName="prabath” Custom
/>
</inSequence> Custom
package my.own;
import org.wso2.carbon.identity.entitlement.mediator.EntitlementCallbackHandler;
public class CustomEntitlementCallbackHandler extends EntitlementCallbackHandler {
}

30. My PEP
XACML
http://blog.facilelogin.com/2010/11/net-client-web-app-authorization-with.html

32. Policy Policy
Decision Information
Point Point

33. Policy Policy
Evaluation Decision
Point Point
PIP
Extension
(s)

34. package
org.wso2.carbon.identity.entitlement.pip;
import
com.sun.xacml.ctx.RequestCtx;
/**
*
PIPExtensions
will
be
fired
for
each
and
every
XACML
request
-­‐
which
will
give
a
handle
to
the
*
incoming
request.
*
*/
public
interface
PIPExtension
{
/**
*
Gives
a
handle
to
the
XACML
request
built.
Can
be
used
to
carry
out
custom
checks
or
updates
*
before
sending
to
the
PDP.
*
*
@param
request
*
Incoming
XACML
request.
*/
public
void
update(RequestCtx
request);
}

35. Policy
Policy Information
Decision Point
Point
PIP
Designator
(s)

36. package
org.wso2.carbon.identity.entitlement.pip;
import
java.util.Set;
/**
*
To
register
a
PIP
attribute
handler
with
the
PDP
against
their
supported
attributes
-­‐
you
need
to
*
implement
this
interface
and
add
an
entry
to
pip-­‐config.xml
file
-­‐
which
should
be
inside
*
[CARBON_HOME]repositoryconf
*/
public
interface
PIPAttributeFinder
{
/**
*
Will
be
fired
by
CarbonAttributeFinder
whenever
it
finds
an
attribute
supported
by
this
*
module.
*
*
@param
subjectId
Name
of
the
subject
the
returned
attributes
should
apply
to.
*
@param
resourceId
The
name
of
the
resource
the
subject
is
trying
to
access.
*
@param
attributeId
The
unique
id
of
the
required
attribute.
*
@return
Returns
a
<code>Set</code>
of
<code>String</code>s
that
represent
the
attribute
values.
*
@throws
Exception
*/
public
Set<String>
getAttributeValues(String
subjectId,
String
resourceId,
String
attributeId)
throws
Exception;
/**
*
Returns
a
<code>Set</code>
of
<code>String</code>s
that
represent
the
attributeIds
handled
by
*
this
module,
or
null
if
this
module
doesn't
handle
any
specific
attributeIds.
A
return
value
*
of
null
means
that
this
module
will
not
handle
any
attributes.
*/
public
Set<String>
getSupportedAttributes();
}

37. <PolicySet/>
<Policy/>
<Rule/>
<Subject/>
<Resource/>
<Target/>
<Action/>
<Environment/>
<Condition/>

38. <PolicySet/>
<Policy/>
Allows PolicySet(s) or Policy(s) to be combined
<Rule/>
<Subject/>
<Resource/>
<Target/>
<Action/>
<Environment/>
<Condition/>

39. PolicyCombiningAlgorithm
<PolicySet/>
<Policy/>
<Rule/>
<Subject/>
<Resource/>
<Target/>
<Action/>
<Environment/>
<Condition/>

40. PolicyCombiningAlgorithm
<PolicySet/>
<Policy/>
<Rule/>
<Subject/>
<Resource/>
<Target/>
<Action/>
<Environment/>
<Condition/>

41. Policy
Administration
Point
<PolicySet/> <PolicySet/>
Policy Store
<PolicySet/> <PolicySet/>

42. <PolicySet/>
<Policy/>
<Rule/>
Acts as an index to find out matching PolicySets
<Subject/>
<Resource/>
<Target/>
<Action/>
<Environment/>
<Condition/>

43. <PolicySet/>
<Policy/>
<Rule/>
<Subject/>
<Resource/>
<Target/>
<Action/>
<Environment/>
<Condition/>

44. <PolicySet/>
<Policy/>
<Rule/>
<Subject/>
<Resource/>
<Target/>
<Action/>
<Environment/>
<Condition/>

45. <PolicySet/>
<Policy/>
<Rule/>
<Subject/>
<Resource/>
<Target/>
<Action/>
<Environment/>
<Condition/>

46. <PolicySet/>
<Policy/>
<Rule/>
<Subject/>
<Resource/>
<Target/>
<Action/>
<Environment/>
<Condition/>

47. <PolicySet/>
<Policy/>
<Rule/>
<Subject/> Allows Rule(s) be combined
<Resource/>
<Target/>
<Action/>
<Environment/>
<Condition/>

48. <PolicySet/> RuleCombiningAlgorithm
<Policy/>
<Rule/>
<Subject/>
<Resource/>
<Target/>
<Action/>
<Environment/>
<Condition/>

49. <PolicySet/>
<Policy/>
<Rule/>
<Subject/>
<Resource/>
<Target/>
<Action/>
<Environment/>
<Condition/>

50. <PolicySet/>
<Policy/>
<Rule/>
<Subject/>
<Resource/>
<Target/>
<Action/>
<Environment/>
<Condition/>

51. <PolicySet/>
<Policy/>
<Rule/>
<Subject/>
<Resource/>
<Target/>
<Action/>
<Environment/>
<Condition/>

52. <PolicySet/>
<Policy/>
<Rule/>
<Subject/>
<Resource/>
<Target/>
<Action/>
<Environment/>
<Condition/>

53. <Policy PolicyId="urn:oasis:names:tc:xacml:2.0:conformance-test:IIA003:policy"
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides">
<Description> Policy for Conformance Test IIA003.</Description>
<Target/>
<Rule
RuleId="urn:oasis:names:tc:xacml:2.0:conformance-test:IIA003:rule"
Effect="Permit">
<Description>
A subject with a "bogus" attribute with a value of
"Physician" can read or write Bart Simpson's medical
record.
</Description>
<Target>
<Subjects>
<Subject>
<SubjectMatch
MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
<AttributeValue
DataType="http://www.w3.org/2001/XMLSchema#string">
Physician
</AttributeValue>
<SubjectAttributeDesignator
AttributeId=“urn:oasis:names:tc:xacml:1.0:subject:subject-id"
DataType="http://www.w3.org/2001/XMLSchema#string"/>
</SubjectMatch>
</Subject>
</Subjects>
</Target>
</Rule>
</Policy>

55. Data Types / Functions / Identifiers
Document
Identifier:
oasis-­‐access_control-­‐xacml-­‐2.0-­‐core-­‐spec-­‐os
Section
:
10

56. <Request/>
<Subject/>
<Resource/> <Attribute/>
<Environment/>
<Action/>

57. <Response/>
<Result/>
<Decision/>

58. Conveying XACML Attributes in a SOAP Message
xacml-samlp:XACMLAuthzDecisionQuery
saml:Attribute

59. XACML Assertions
XACMLAuthzAssertion
XACMLPrivacyAssertion

60. Defines how to use SAML 2.0 to protect, store, transport,
request, and respond with XACML schema instances and other
information needed by an XACML implementation.

62. <saml:Assertion Version="2.0" ID="9812368” IssueInstant="2006-05-31T13:20:00.000">
<saml:Issuer>https://XACMLPDP.example.com</saml:Issuer>
<saml:Statement xsi:type="xacml-saml:XACMLAuthzDecisionStatementType">
<xacml-context:Response>
<xacml-context:Result>
<xacml-context:Decision>
NotApplicable
</xacml-context:Decision>
</xacml-context:Result>
</xacml-context:Response>
<xacml-context:Request>
....
</xacml-context:Request>
</saml:Statement>
</saml:Assertion>

63. Optimizations in XPATH
User-defined attribute categories
New TARGET matching criteria : <AnyOf> <AllOf>
Multiple Decision Profile
New Obligation Expressions
Advice
Delegation
Enhancements to Policy Combining Algorithms