Authorization... It’s not just about who you are


Published on

Slides of talk given by David Brossard at JavaZone 2013

Published in: Technology
  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide
  • Once upon a time, access control was about who you were. What mattered was your identity or perhaps your role or group.But today, access control should be more about what you represent, what you want to do, what you want to access, for which purpose, when, where, how, and why…Credits:Invisible: Andrew Cameron, from The Noun ProjectBox: Martin Karachorov, Wrench: John O'Sheaclock: Brandon Hopkins
  • Policy Enforcement PointIn the XACML architecture, the PEP is the component in charge of intercepting business messages and protecting targeted resources by requesting an access control decision from a policy decision point and enforcing that decision. PEPs can embrace many different form factors depending on the type of resource being protected.Policy Decision PointThe PDP sits at the very core of the XACML architecture. It implements the XACML standard and evaluation logic. Its purpose is to evaluate access control requests coming in from the PEP against the XACML policies read from the PRP. The PDP then returns a decision – either of Permit, Deny, Not Applicable, or Indeterminate.Policy Retrieval PointThe PRP is one of the components that support the PDP in its evaluation process. Its only purpose is to act as a persistence layer for XACML policies. It can therefore take many forms such as a database, a file, or a web service call to a remote repository.Policy Information PointXACML is a policy-based language which uses attributes to express rules & conditions. Attributes are bits of information about a subject, resource, action, or context describing an access control situation. Examples of attributes are a user id, a role, a resource URI, a document classification, the time of the day, etc… In its evaluation process, the PDP may need to retrieve additional attributes. It turns to PIPs where attributes are stored. Examples of PIPs include corporate user directories (LDAP…), databases, UDDIs… The PDP may for instance ask the PIP to look up the role of a given user.Policy Administration PointThe PAP’s purpose is to provide a management interface administrators can use to author policies and control their lifecycle.
  • Need to clarify the location constrain. Permit is assuming that Alice location == 12367 location
  • Authorization... It’s not just about who you are

    1. 1. Authorization… It’s not just about who you are David Brossard, @davidjbrossard Product Manager Axiomatics AB Member of the OASIS XACML Technical Committee
    2. 2. Axiomatics 2 What’s authorization? “The authorization function determines whether a particular entity is authorized to perform a given activity, typically inherited from authentication when logging on to an application or service.”
    3. 3. 3 What happens when authorization isn’t done right? New York City Health & Hospitals Corporation Releases Electronic Health Records 1 700 000 Citi Exposes Details of 150,000 Individuals Who Went into Bankruptcy 150 000 6 000 000 Facebook’s Download Your Information releases too much information about your contacts
    4. 4. Axiomatics 4 Authorization is that necessary evil developers must do But I want to do app development Daddy… You will secure your app first my son…
    5. 5. Axiomatics 5 But we, developers, hate spending time on security 80% 20% Time spent developing an application Business logic Security * And no this isn’t PacMan
    6. 6. Axiomatics 6 So how do developers do it today? {nothing} {application frameworks} {home-grown}
    7. 7. 7 We tend to reinvent the wheel
    8. 8. Axiomatics 8 Examples of authorization frameworks (Java & Others) JAAS CanCan Apache Shiro Spring Security Rails AuthZ Microsoft Claims Slim for PHP
    9. 9. In the olden days, authorization was about Who?
    10. 10. Axiomatics 10 So how do you handle additional information? Context Location Relationship Classification Parent Delegation Guardian IP address Device Pattern Behavior Risk Clearance Employment Citizenship Time Intellectual PropertyExport Control
    11. 11. Authorization should really be about… When?What? How?Where?Who? Why? 11 Credits: all icons from the Noun Project | Invisible: Andrew Cameron, | Box: Martin Karachorov | Wrench: John O'Shea | Clock: Brandon Hopkins Attribute-based Access Control Welcome to…
    12. 12. Axiomatics 12 What’s an attribute? An identifier e.g. citizenship A datatype e.g. string A category / object it describes e.g. the user, the resource
    13. 13. An introduction to XACML Axiomatics
    14. 14. Axiomatics Behold XACML!  eXtensible Access Control Markup Language  An OASIS standard  The de facto standard for fine-grained access control  Current version: 3.0  XACML defines  A policy language  A request / response scheme  An architecture
    15. 15. 15 Three key points of XACML Policy-based Attribute-based Technology- neutral Apply XACML to Java, .NET, and more Use policies to describe and implement complex AuthZ An attribute consists of an identifier, datatype, a nd value
    16. 16. XACML Architecture Flow 16 Decide Policy Decision Point Manage Policy Administration Point Support Policy Information Point Policy Retrieval Point Enforce Policy Enforcement Point Access Document #123 Access Document #123 Can Alice access Document #123? Yes, Permit Load XACML policies Retrieve user role, clearance and document classification
    17. 17. 17 Any-depth Authorization
    18. 18. Anywhere Authorization 18
    19. 19.  3 structural elements  PolicySet  Policy  Rule  Root: either of PolicySet or Policy  PolicySets contain any number of PolicySets & Policies  Policies contain Rules  Rules contain an Effect: Permit / Deny  Combining Algorithms are used to resolve conflicts between rules Language Elements of XACML
    20. 20. Root Policy Set PolicySet Policy Rule Effect=Permit Rule Effect = Deny PolicySet Policy Rule Effect = Permit Sample XACML Policy
    21. 21. Language Structure: Russian dolls PolicySet, Policy & Rule can contain Targets Obligations Advice Rules can contain Conditions Policy Set Policy Rule Effect=Permit Target Target Target Obligation Obligation Obligation Condition
    22. 22. Axiomatics 22 The one question that matters in XACML Can Manager Alice approve Purchase Order 12367? Yes, she can!
    23. 23. • Subject User id = Alice Role = Manager • Action Action id = approve • Resource Resource type = Purchase Order PO #= 12367 • Environment Device Type = Laptop 23 Structure of a XACML Request / Response XACML Request XACML Response Can Manager Alice approve Purchase Order 12367? Yes, she can • Result Decision: Permit Status: ok The core XACML specification does not define any specific transport / communication protocol: -Developers can choose their own. -The SAML profile defines a binding to send requests/responses over SAML assertions
    24. 24. Sample Use Case Axiomatics
    25. 25. Axiomatics Sample Scenario – a CRM use case  A customer representative of a large financial organization needs to access customer data  The compliance manager, the application owner, and the chief security officer agree on certain “rules” No one can access data outside office hours Customer reps can view accounts in their region Our customers can blacklist some of our employees Customer reps cannot work on family accounts
    26. 26. XACML lets you define and group policies  Sample policies  No one can access data outside office hours  Customer reps can view accounts in their region  Customer reps cannot work on family accounts  Our customers can blacklist some of our employees  Note  XACML lets you define negative and positive rules  XACML can use any number of attributes  XACML can combine policies together and define conflict resolutions  Policies are usually generic but can also be user-specific
    27. 27. The example reworked  Overall policy: access customer record  DENY if time < 9am OR time > 5pm  DENY if employee.location!=customer.location  DENY if belongs to  ALLOW access
    28. 28. Implement the policies using ALFA  ALFA plugin for Eclipse  Add-on to the Eclipse IDE  Write XACML using a pseudo-code called ALFA – the Axiomatics Language for Authorization  Free download from Hands-on demo
    29. 29. XACML for the Java Developer Axiomatics
    30. 30. 30 Use the same enforcement SDK across all your apps XACML Enforcement Point SDK
    31. 31. Axiomatics Example: use Java Servlet Filters  Protect Java web apps public class ServletPEP implements javax.servlet.Filter{ @Override public void destroy() { // TODO Auto-generated method stub } @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { } @Override public void init(FilterConfig arg0) throws ServletException { } }
    32. 32. Example: use JAX-WS interceptors  Protect Java web services  Can be applied inbound and outbound  Inspect the payload of the messages  Also applicable to JAX-RS services /* * (non-Javadoc) * * @see * MessageContext) */ public boolean handleMessage(SOAPMessageContext context) { }
    33. 33. Example: use AOP – annotations  Example: a Student Management Service  Create, grade, and delete students  Apply the @XacmlEnforcementPoint annotation  Annotate the POJOs with @XacmlAttribute public interface StudentService { @XacmlEnforcementPoint Student createStudent(); } class Student { @XacmlAttribute String name; @XacmlAttribute Integer age; }
    34. 34. Other areas  Spring Security  JAAS integration  JSP taglibs  JMS  Can you name any?  Goal: provide a unified, standardized way of applying fine-grained authorization across multiple applications
    35. 35. XACML simplifies authorization management  The authorization logic is externalized into XACML policies  You no longer need to write Java code  If the authorization logic changes, update the policies  Strive for configuration-based authorization  E.g. via interceptors (servlet filters, JAX-WS handlers)  Configure the handlers using the target framework’s config files (e.g. web.xml)
    36. 36. XACML saves you time 80% 20% Before Business logic Security 95% 5% After Business logic Security
    37. 37. Beyond Java  Apply the same architectural approach and XACML policies to  .NET  Perl  Python  Ruby  Business apps  And more!
    38. 38. A few parting words
    39. 39. 39 Just a spoonful of XACML makes… Consolidated authorization Enhanced security Business enabler Compliance Expose data and APIs to new customers Write once, Enforce everywhere Consistent authorization enforcement Implement legal frameworks
    40. 40. Axiomatics Do you want to chip in?  OASIS XACML TC  Online resources
    41. 41. Questions?