1. XACML 2.0 and Earlier Hal Lockhart, Oracle

2. What is XACML? n XML language for access control n Coarse or fine-grained n Extremely powerful evaluation logic n Ability to use any available information n Superset of Permissions, ACLs, RBAC, etc n Scales from PDA to Internet n Federated policy administration n OASIS and ITU-T Standard

3. Trends Driving Fine-Grained Access Control n De-perimeterization l No longer just “them and us” l Firewall is no longer sufficient n Service Oriented Architecture l Multiple access contexts for each service n Cloud l Complex interactions of internal and external components l Federated administration

4. Powerful Policy Expression n “Anyone can use web servers with the ‘spare’ property between 12:00 AM and 4:00 AM” n “Salespeople can create orders, but if the total cost is greater that $1M, a supervisor must approve” n “Anyone view their own 401K information, but nobody else’s” n “The print formatting service can access printers and temporary storage on behalf of any user with the print attribute” n “The primary physician can have any of her patients’ medical records sent to a specialist in the same practice.”

5. Key XACML Features n Federated Policy Administration l Multiple policies applicable to same situation l Combining rules to resolve conflicts n Decision may include Obligations l In addition to Permit or Deny l Obligation can specify present or future action l Examples: Log request, require human approval, delete data after 30 days n Protect any resource l Web Server, Java or C++ Object, Room in building, Network Access, Web Service, Geographic Data, Health Records, etc.

6. XACML Architecture PDP Decision Application Administration Policy Repository PEP Enforcement Client Authorities Attribute Repositories PDP

7. XACML Concepts PolicySet Policies Obligations Rules Target Obligations Condition Effect Target

8. XACML 2.0 Profiles n Digital Signature l Integrity protection of Policies n Hierarchical Resources l Using XACML to protect files, directory entries, web pages n Privacy l Determine “purpose” of access n RBAC l Support ANSI RBAC Profile with XACML n SAML Integration l XACML-based decision request l Fetch applicable policies l Attribute alignment

9. XACML Benefits n Standard Policy Language l Investment protection l Skills reuse l Create analysis tools market n Leverage XML tools n Policy not in application code l Reduce cost of changes l Consistent application l Enable audit