xacml - xml amsterdam2011

1© Copyright 2011 EMC Corporation. All rights reserved.

eXtensible Access ControlMarkup LanguageRémon Sinnema – Consultant Software Engineer at EMC – Voting member of the XACML Technical Committee –

sinnema313


Agenda

• Access Control– Various models– How XACML fits in

• XACML– Architecture– Request/Response Protocol– Policy Language– Optional Profiles– What’s new in 3.0– Implementations


Access Control


Access Control• Access control is the basis of Information Security:

– Confidentiality: prevent disclosure to unauthorized agents

– Integrity: prevent modification by unauthorized agents– Availability: keep unauthorized agents off the system

• An access request occurs when– a given subject tries to access – a given resource to perform – a given action in – a given environment


Access Control List (ACL)• (subject, resource, action, ?)

– Subject is user or group– No environment– Hard to maintain when many users share

privileges

• Widely available, e.g. in operating systems


Role-Based Access Control (RBAC)• (role, resource, action, ?)

– Generalizes users into roles– Users can have many roles– Roles can be hierarchical

• A manager is an employee

– No environment– Not granular enough/role explosion

• Commonly available, e.g. in databases


Attribute-Based Access Control (ABAC)• (subject, resource, action, environment)

– Generalizes everything into attributes– Adds environment attributes– Subject can be user, group, role, application, …– Subject can be described by more than one attribute

• Matches the definition of identity:– “A person’s identity is built upon an incomplete set

of attributes that we deem sufficient to differentiate one person from everyone else”Identity Management – A Primer, p. 9

• State of the art


Policy-Based Access Control (PBAC)• (subject, resource, action, environment)

– Harmonizes attributes across the (extended) organization

• Coming soon…


Risk-Adaptive Access Control (RAdAC)• (subject, resource, action, environment)

– Dynamic risk levels as environment attributes– Threat level etc. from outside sources as well

• Not anytime soon


Evolution of Access Control Models

Trends:

• Finer granularity

• More policy-based over ad-hoc


XACML supports all of ACL, RBAC, ABAC, PBAC, and RAdAC

One technology for all yourevolving access control needs!


eXtensible Access Control Markup Language


Architecture


Request<Request xmlns="urn:oasis:names:tc:xacml:2.0:context:schema:os" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:oasis:names:tc:xacml:2.0:context:schema:os access_control-xacml-2.0-context-schema-os.xsd"> <Subject> <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" DataType="http://www.w3.org/2001/XMLSchema#string"> <AttributeValue>Julius Hibbert</AttributeValue> </Attribute> </Subject> <Resource> <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" DataType="http://www.w3.org/2001/XMLSchema#anyURI"> <AttributeValue>http://medico.com/record/patient/BartSimpson</AttributeValue> </Attribute> </Resource> <Action> <Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" DataType="http://www.w3.org/2001/XMLSchema#string"> <AttributeValue>read</AttributeValue> </Attribute> </Action> <Environment /></Request>


Response<Response xmlns="urn:oasis:names:tc:xacml:2.0:context:schema:os" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:oasis:names:tc:xacml:2.0:context:schema:os access_control-xacml-2.0-context-schema-os.xsd"> <Result> <Decision>Permit</Decision> <Status> <StatusCode Value="urn:oasis:names:tc:xacml:1.0:status:ok" /> </Status> </Result></Response>


Policy Language (1)• Hierarchical structure: PolicySet → Policy → Rule


Policy Language (2)

• Target filters applicable requests– In PolicySet, Policy, and Rule– Using attribute matching

• Condition refines further– Powerful expression language

<Condition> <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in"> <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"> riddle me this </AttributeValue> <SubjectAttributeDesignator SubjectCategory= "urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="urn:oasis:names:tc:xacml:2.0:conformance-test:some-attribute” MustBePresent="true" DataType="http://www.w3.org/2001/XMLSchema#string" /> </Apply></Condition>


<Rule RuleId=“…" Effect="Permit“> <Description>…</Description> <Target> <Subjects> <Subject> <SubjectMatch MatchId="urn:oasis:names:tc:xacml:2.0:function:string-equal"> <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string"> Robin Hood </AttributeValue> <SubjectAttributeDesignator DataType="http://www.w3.org/2001/XMLSchema#string"> urn:oasis:names:tc:xacml:1.0:subject:subject-id </SubjectAttributeDesignator> </SubjectMatch> </Subject> </Subjects> <Resources>…</Resources> <Actions>…</Actions> <Environments>…</Environments> </Target> <Condition>…</Condition> </Rule>

Attribute Value

Attribute Matching

Function

Data TypeAttribute ID

Effect


Conflict Resolution• Multiple rules can be applicable

• Conflicts are resolved by Combining Algorithms

– Policy has Rule Combining Algorithm– PolicySet has Policy Combining Algorithm

• Standard Combining Algorithms:– permit-overrides– deny-overrides– first-applicable– only-one-applicable– ordered-permit-overrides– ordered-deny-overrides


Obligations• Action that PEP must perform

– Email manager, log access, …

• Optional part of the specification


X stands for eXtensible• Custom attribute IDs

• Custom functions

• Custom data types

• Custom combining algorithms


Optional Profiles• RBAC

• Multiple Resource

• Hierarchical Resource

• Privacy

• SAML

• XML Digital Signature


What’s new in 3.0• Subject/Resource/Action/Environment generalized into attribute

categories

• Advice (like obligation but optional)

• Obligations & advice can be dynamic

• More functions and combining algorithms (better handling of Indeterminate in CAs, new CAs)

• XPath improvements (XPath data type)

• Updated profiles– Multi: decision schemes– SAML :pass policies with request

• New profiles– Administration & Delegation (policies about who can change policies)– Export– Intellectual Property (in progress)


ImplementationsCommercial

Embedded

Open Source

SunXacml


Q&A

sinnema313


THANK YOU

xacml - xml amsterdam2011

Technology

emc corporation

access control copyright

algorithms copyright

overrides copyright

access control access

architecture copyright

progress copyright

implementations copyright