1. Indy JUG Authorizations with OASIS XACML E-GINEERING, LLC Dan Gradl

2. Agenda • Drivers • Overview • XACML Logical Architecture • PEP in-depth • XACML 2.0 Policy Model • XACML Context • Context vs PIP • Implementations • Enterprise challenges • What’s new in XACML 3.0 Authorizations with OASIS XACML

3. Drivers from project experience • Many access control implementations (100+) in the organization • Access rules embedded within application – difficult to change • Difficult to audit and report across many disparate systems • Necessary to control access to coarse grain (e.g. services, views) and very fine grain (e.g. data elements) resources • Complex rule scenarios (Attribute Based Access Control) • Permission assignment to be user based and/or role based • Diverse platforms • Delegated administration Authorizations with OASIS XACML

4. Overview • OASIS specification – eXtensible Access Control Markup Language • Defines a declarative Attribute Based Access Control model • Encourages separation of access control rules from applications for ease of maintenance, auditing, reporting • XACML 1.0- 2003 • XACML 2.0- 2005 • XACML 3.0- 2010 Authorizations with OASIS XACML

5. XACML Logical Architecture Authorizations with OASIS XACML

6. PEP • A Policy Enforcement Point will check an entitlement and react to (enforce) the decision • Therefore, how a policy is enforced varies based on the resource/resource realization being protected • Examples • If I don’t have access to view a page hide the navigation item • If I don’t have access to view a field hide the field • If I don’t have access to update a field, stop processing and display message • Even if the result is functionally the same, the details of gathering the request context and dealing with the result may vary • Different PEPs will be used to protect different resources Authorizations with OASIS XACML

7. Example PEPs • Request interceptor • Servlet filter • JSF render/validation interception • AOP method interceptor • Tag library • COBOL module (in front of CICS transactions) Authorizations with OASIS XACML

8. XACML Policy Data Model Authorizations with OASIS XACML

9. XACML Context Authorizations with OASIS XACML

10. XACML Request • One or more Subjects with zero or more Attributes • One or more Resources with zero or more Attributes • One Action with zero or more Attributes • One Environment with zero or more Attributes Authorizations with OASIS XACML

11. XACML Response • One or more results – multiple if request is for multiple resources • Decision • Status • Obligations Authorizations with OASIS XACML

12. Request Context vs PIP • As a PDP evaluates a policy it needs to process against a set of input data • The data has to come from either the Request Context or a PIP • There are tradeoffs to each • Request Context • May already have the information at hand • Some information may be runtime in nature (not persisted to some data store) • PEP and/or application may end up knowing too much detail about policies (what attributes are required) • Adding new attributes here typically requires application development • PIP • Potentially access any data in the org (even data that the application does not typically access) • May slow performance as data is requested (the application may have accessed it already) • Requires some integration work to connect to specific data stores • New data can potentially be used in policies without affecting all applications using those policies Authorizations with OASIS XACML

13. Implementations • Open-source • SunXACML – inactive open source PDP implementation • JBossPicketBox – PDP implementation based on SunXACML • SICSAML XACML – XACML 3.0 PDP reference implementation based on SunXACML • enterprise-java-xacml – Google Code hosted PDP project (one developer) • UMU-XACML-Editor – simple policy file editor • Commercial • Securent –> Cisco Enterprise Policy Manager • IBM Tivoli Security Policy Manager (TSPM) • BEA/Oracle • Axiomatics – based on SICSAML Authorizations with OASIS XACML

14. Challenges • What is access control and what is business rule • Enforcement • Impact to development model • Guaranteed enforcement • Obligation handling • Resource management • Hierarchical resource trees • Resource synchronization • Performance • Efficiency of PDP, including policy search/indexing • Policy efficiency – many ways to write the same rule, some less efficient • Caching • Administration • Variety of views – policy writing, constraint editing, assignment of permissions • Policy information points • Authentication and Integrity Authorizations with OASIS XACML

15. XACML 3.0 – What’s New • Disjunctive/conjunctive target elements (AnyOf, AllOf) • More flexible/custom categories (beyond Subject, Resource, Action, Environment) • Advice – similar to an obligation but is optional • Obligations can use dynamic attributes • Delegated administration profile • Multiple decision profile • Enhanced policy combination algorithms • New data types and functions (Xpath) Authorizations with OASIS XACML

16. Questions OASIS XACML