SPOCP – general authorisation server Presentation at TF-aace meeting in Stockholm 26 nov 2002 Roland Hedberg

Outline – part1 ● SPOCP project ● SPOCP, how does it fit it ● How does it work ● SPOCP SAML/XACML ● Project status

The SPOCP project ● One year, ends May 31 th 2003 ● Relatively small budget, ~1 MSEK ● Run by Umeå University ● Partners in crime: * Stockholm University* Lund University * Uppsala University* Karolinska * SUNET* UNINETT * NYA & LpW

How does it fit in ? ● Middleware function the provides authorisation ● Separate from authentication ● Uses information resources

Spocp rules/queries ● Expressed as S-expressions – Fixed syntax, undefined semantics ● S-expression can be ordered – One can test whether S-expression A is '<=' S-expression B

S-expression ● Am S-expression is either – A byte-strings ("octet-strings") or – A finite list of simpler S-expressions ● A octet-string is a finite sequence of 8-bit octets ● Example: – (certificate (issuer bob)(subject alice))

Formal definition of the '<=' relation ● If A = (X_1 X_2... X_m) and B = (Y_1 Y_2... Y_n) then A <= B if and only if n <= m and X_i <= Y_i for i = 1,...,n ● Example: – (certificate (issuer bob morgan)(subject alice)) <= (certificate (issuer bob)(subject alice))

Spocp Authorisation Decision ● Given a authorisation Query (A). If there exists a rule (R) in the rule database such that A '<=' R then permission is granted. ● By default everything is disallowed ● Rules can only allow actions

SAML Spocp An objective comparision :-)

XACML/SAML Data-flow

Spocp Data-Flow

XACML Rule ● A person may read any record for which he or she is the designated patient * //medico.com/record.* read

Spocp Rule ● (spocp (resource medico.com)(action read)(subject medico.com urn:spocp:equal:${patient}:${name}))

SAML AuthorizationDecisionQuery – Julius Hibbert read Julius Hibbert 24/artifact Julius Hibbert physician

SPOCP Query ● (spocp (resource record medico.com (patient Bartholomeus Simson) patientDoB )(action read)(subject medico.com (name Julius Hibbert)))

Project Status ● Source code available – Two server implementations ● Apache module (SAML/SOAP/HTTP) ● Standalone (uses the SPOCP protocol) – Server as library – PAM module – Modified Exim – Documentation