Old Dominion University1 eXtensible Access Control Markup Language [OASIS Standard] Kailash Bhoopalam Java and XML

Old Dominion University2 Contents Introduction to Access Control Introduction to XACML The XACML schema. Access Control Examples and Experiments with XACML. The XACML framework. Installing and using the XACML package. Beyond Vanilla XACML User Extensions to XACML Implementation XACML in Secure Distributed Digital Libraries

Old Dominion University3 Introduction to Access Control John wants access to protected file “PatientRecord1.doc” AuthenticationAuthorization (Access Control) File Server “PatientRecord1.doc” “PatientRecord2.doc” … I am John, My pasword is I want “PatientRecord1.doc” 1.Is John a Valid User 2.Is the password accurate 1.Is John allowed access to to “PatientRecord1.doc” ), “PatientRecord1.doc”, R>

Old Dominion University4 Access Control, contd. {Request} {Policy or Access Control List (ACL)} Permit {Response} VS {Request} * {Access Control List (ACL)} * {Response} VS S – Subject, O – Object, A – Action, D - Decision

Old Dominion University5 Introduction to XACML John wants access to protected file “PatientRecord1.doc” Request Context XACML Policy Response Context John PatientRecord1.doc R John PatientRecord1.doc R Permit

Old Dominion University6 Introduction to XACML contd. Authorization F il e PDPPDP PEPPEP ServerServer 0. XACML Policy Repository 2. Request XACML Compliant 3. Response 1. Authenticated Request PEP – Policy Enforcement Point PDP – Policy Decision Point 4. Decision Enforcement How does XACML Work?

Old Dominion University7 XACML Schemas Policy SchemaRequest SchemaResponse Schema PolicySet (Combining Alg) Policy* (Combining Alg) Rule* (Effect) Subject* Resource* Action Condition* Obgligation* Request Subject Resource Action Response Decision Obligation*

Old Dominion University8 Some Experiments Ex1 Ex2 Ex3

Old Dominion University9 XACML Framework (Data flow model)

Old Dominion University10 XACML Framework (Policy Language Model)

Old Dominion University11 Installing and using the XACML Implementation Available Implementations –Sun Microsystems (here) (download)heredownload You may also optionally copy from ~kbhoopal/public_html/xacml/sunxacml.jar –Jiffy Software (here)here More on Sun’s XACML implementation Available as zip file. unzip and build with “ant” (download ant)download ant include the sunxacml.jar in the class path.

Old Dominion University12 Using the XACML Implementation (A Programmers Guide) Using Sun’s XACML Implementation –Overview of APIs –Building a basic PDP –Building the basic PEP –Validating Policies and Requests Some Experiments

Old Dominion University13 Beyond Vanilla Access Control –Policy & Rule Combining algorithms Permit Overrides: If a single rule permits a request, irrespective of the other rules, the result of the PDP is Permit Deny Overrides: If a single rule denies a request, irrespectiveof the other rules, the result of the PDP is deny. First Applicable: The first applicable rule that satisfies the request is the result of the PDP Only-one-applicable: If there are two rules with different effects for the same request, the result is indeterminate

Old Dominion University14 Beyond Vanilla, contd. Conditions –Declarative use of boolean expressions –Using Environment variables like time, etc. E.g., John can access patientrecord1.doc only between 9am and 4pm. Obligations –An operation performed in a policy or policy set that should be performed in conjunction with the enforcement of an authorization decision.

Old Dominion University15 Beyond Vanilla, contd. XACML Functions –Equality Predicates –Arithmetic & Arithmetic comparison –String Conversion –Numeric Data Type Conversion –Logical –Date and Time –Set –And Many more.

Old Dominion University16 User Extensions to XACML Implementation Extend –Attributes –Functions –Combining algorithms –Finder modules.

Old Dominion University17 XACML in SDDL Implementation PAP, PIP using a Policy Editor (here)here Implementation of SunXACML’s PDP with a custom PEP and integration with Shibboleth and Archon. (here)here

Old Dominion University18 References XACML Specification Sun’s XACML Implementation