Access Control Patterns & Practices with WSO2 Middleware Prabath Siriwardena

About Me Director of Security Architecture at WSO2 Leads WSO2 Identity Server – an open source identity and entitlement management product. Apache Axis2/Rampart committer / PMC A member of OASIS Identity Metasystem Interoperability (IMI) TC, OASIS eXtensible Access Control Markup Language (XACML) TC and OASIS Security Services (SAML) TC. Twitter Blog : LinkedIn :

Discretionary Access Control (DAC) vs. Mandatory Access Control (MAC)

With the Discretionary Access Control, the user can be the owner of the data and at his discretion can transfer the rights to another user.

With Mandatory Access Control, only designated users are allowed to grant rights and, users cannot transfer them.

All WSO2 Carbon based products are based on Mandatory Access Control.

Group is a collection of Users - while a Role is a collection of permissions.

Authorization Table vs. Access Control Lists vs. Capabilities

Authorization Table is a three column table with subject, action and resource.

With Access Control Lists, each resource is associated with a list, indicating, for each subject, the actions that the subject can exercise on the resource.

With Capabilities, each subject has an associated list, called capability list, indicating, for each resource, the accesses that the user is allowed to exercise on the resource.

Access Control List is resource driven while capabilities are subject driven.

With policy based access control we can have authorization policies with a fine granularity.

Capabilities and Access Control Lists can be dynamically derived from policies.

XACML is the de facto standard for policy based access control.

XACML provides a reference architecture, a request response protocol and a policy language.

Policy Enforcement Point (PEP) Policy Information Point (PIP) Policy Administration Point (PAP) Policy Decision Point (PDP) Policy Store XACML Reference Architecture

WSO2 Application Server (SOAP Service) WSO2 Identity Server (STS) Client Application SAML token request SAML token with Authentication and Authorization Assertions (Capabilities) SAML token with Authentication and Authorization Assertion + Service Request WSO2 Identity Server (XACML PDP) XACML Response XACML Request XACML with Capabilities (WS-Trust) Hierarchical Resource Profile

WSO2 Application Server (Web Application) WSO2 Identity Server (SAML2 IdP) Browser Redirect with SAML Request WSO2 Identity Server (XACML PDP) Unauthenticated Request SAML token with Authentication and Authorization Assertion (Capabilities) XACML Response XACML Request XACML with Capabilities (WS-Trust) Hierarchical Resource Profile

WSO2 ESB (Policy Enforcement Point) Client Application Service Request + Credentials WSO2 Application Server (SOAP Service) RBAC Role Based Access Control

WSO2 ESB (Policy Enforcement Point) Client Application Service Request + Credentials WSO2 Identity Server (XACML PDP) WSO2 Application Server (SOAP Service) XACML Response XACML Request WSO2 ESB as the XACML PEP (SOAP and REST)

WSO2 Application Server Client Application Service Request + Credentials WSO2 Identity Server (XACML PDP) XACML Response XACML Request XACML Servlet Filter XACML PEP as a Servlet Filter

WSO2 Identity Server (XACML PDP) XACML Response XACML Request WSO2 Identity Server (OAuth Authorization Server) API Gateway Access Token Client Application Validate() OAuth + XACML

WSO2 Application Server (Web Application) External SAML2 IdP (Salesforce) Browser Redirect with SAML Request Unauthenticated Request SAML token with Authentication and Attribute Assertions with IdP groups WSO2 Identity Server Web App roles IdP Groups Authorization with External IdPs (Role Mapping)

Login WSO2 Identity Server (XAML PDP) XACML Request XACML Response Liferay Portal XACML Multiple Decisions and Application Specific Roles

lean. enterprise. middleware