1. Lessons Learned from AuthZ Project an Authorization Center
Carnegie Mellon University
Parviz Dousti

2. Driving Forces Alumni Email For Life
Central Administration of Policies

3. Services Network Access Cluster Login Access Portal Access
Netreg
Dialup
VPN
Cluster Login Access
Portal Access
Library Access
Software Download
Access

4. Policies
e.g:
Softdist: accounts where owner's affiliation is in {Faculty, Special Faculty, Staff} + accounts where owner's affiliation is Student and owner's SIS category is "Enrolled“.
Policy: accounts where owner's affiliation is in {Faculty, Special Faculty, Staff, Student} + accounts where owner's affiliation is Alum and owner's Student Class is "2004"

5. Conceptual Design

6. Priorities Easiest for Applications and Services Extensibility
Using Standards

7. Why LDAP Standard and unambiguous protocol Already used by most apps.
Existing Authentication/Authorization Env.
Most policy attributes are already there

8. LDAP at CMU
Openldap
Trigger Server
SQL(Oracle) backend

9. Trigs

10. SQL-back LDAP Uses ODBC to contact an RDBM
Can add, modify, delete LDAP entries
LDAP users don't know the difference
… So we can use RDBM to help with data consistency.

11. First Design Using LDAP Group Membership as Authorization
Service = Group
Maintaining static aclGroups
Using Oracle triggers
Using XACML for policy

12. First Design

13. First Design Problems Notion of time not allowed in Policy
Policy/Attributes mapping
Oracle 9i and Java 1.4
Transactional Problem

14. Latest Design

15. Latest Design AuthZ queations: isAuthorized authorizedTo allAuthorized
whenAuthorizedThen