1. SPOCP – general authorisation server Presentation at TF-aace meeting in Stockholm 26 nov 2002 Roland Hedberg

2. Outline – part1 ● SPOCP project ● SPOCP, how does it fit it ● How does it work ● SPOCP SAML/XACML ● Project status

3. The SPOCP project ● One year, ends May 31 th 2003 ● Relatively small budget, ~1 MSEK ● Run by Umeå University ● Partners in crime: * Stockholm University* Lund University * Uppsala University* Karolinska * SUNET* UNINETT * NYA & LpW

4. How does it fit in ? ● Middleware function the provides authorisation ● Separate from authentication ● Uses information resources

5. Spocp rules/queries ● Expressed as S-expressions – Fixed syntax, undefined semantics ● S-expression can be ordered – One can test whether S-expression A is '<=' S-expression B

6. S-expression ● Am S-expression is either – A byte-strings ("octet-strings") or – A finite list of simpler S-expressions ● A octet-string is a finite sequence of 8-bit octets ● Example: – (certificate (issuer bob)(subject alice))

7. Formal definition of the '<=' relation ● If A = (X_1 X_2... X_m) and B = (Y_1 Y_2... Y_n) then A <= B if and only if n <= m and X_i <= Y_i for i = 1,...,n ● Example: – (certificate (issuer bob morgan)(subject alice)) <= (certificate (issuer bob)(subject alice))

8. Spocp Authorisation Decision ● Given a authorisation Query (A). If there exists a rule (R) in the rule database such that A '<=' R then permission is granted. ● By default everything is disallowed ● Rules can only allow actions

9. SAML Spocp An objective comparision :-)

10. XACML/SAML Data-flow

11. Spocp Data-Flow

12. XACML Rule ● A person may read any record for which he or she is the designated patient * //medico.com/record.* read

13. Spocp Rule ● (spocp (resource medico.com)(action read)(subject medico.com urn:spocp:equal:${patient}:${name}))

14. SAML AuthorizationDecisionQuery – Julius Hibbert read Julius Hibbert http://www.oasis-open.org/committees/security/docs/draft-sstc-core- 24/artifact Julius Hibbert physician

15. SPOCP Query ● (spocp (resource record medico.com (patient Bartholomeus Simson) patientDoB )(action read)(subject medico.com (name Julius Hibbert)))

16. Project Status ● Source code available – Two server implementations ● Apache module (SAML/SOAP/HTTP) ● Standalone (uses the SPOCP protocol) – Server as library – PAM module – Modified Exim – Documentation