Authorization
From HiWiki
PING Discovery: Pilot implementasjon og utforskning av PING -> Security -> Authorization
Contents |
Overview
Ping authorizes in two different ways:
- Based on the policy of the action responder processing the action
- Based on the policies of the records (if any) that the action is being performed on
Ping uses SunTM's XACML Implementation for authorization but it is up to each action responder (Default*ActionResponder.java) what should be authorized. Hence a great deal of responsibility lies on the implementation of each action responder with regards to security.
More information on how to Manage Authorization.
XACML
To make a long story short the XACML implementation consists of a Policy Enforcement Point (PEP) and a Policy Decision Point (PDP). The PEP forms the request based on the requester's attributes, the resource in question, the action, and other information pertaining to the request. It then sends the request to the PDP which will look at the request, find policies that apply to the request, and based on an evaluation decide whether access should be granted or not. The answer is sent back to the PEP which then can deny or allow access to the requester.
The messages between the PEP and the PDP are RequestCtx instances generated from the RequestCtxGenerator. Below is a diagram showing the creation of such a request. The following arguments are given:
- AuthenticateResultType actorSession
- String pingId
- String resourceId
- String actionId
- JAXBContext context
- JAXBElement resourceContent
The output from RequestCtxGenerator consists of:
Set subjectSet
All the information is gathered from actorSession:
- Subject attribute (actorId)
- Role attributes (roles from actorAttributes)
- Group attributes (groupMemberships from actorAttributesType)
- Proxy attributes (proxies from actorAttributes)
Set resourceSet
All the information is gathered from pingId, resourceId and int scope= EvaluationCtx.SCOPE_IMMEDIATE:
- ResourceId attribute (resourceId)
- PingId attribute (pingId)
- Resource scope attribute (“IMMIDIATE”)
Set actionSet
All the information is gathered from actionId:
- ActionId attribute (actionId)
Set environmentSet
A new empty hash set
String resourceContent
Some sort of transformation of the JAXBContext and the JAXBElement. (?)
Authorization based on server policies defined for the ActionResponder
Each action responder creates its own PDP in DefaultActionResponder:
- PingPDP _responderPdp=null
DefaultActionResponder reads a xml policyfile (e.g. addPolicy.xml) and creates a new DynamicPDP with the policies as an argument:
- _responderPdp = new DynamicPdp(policies)
Each time an authorization request is sent to the _responderPdp, the PDP decides whether access should be granted or not based on the policies which have been read from the xml file. More information: Manage Authorization.
Authorization based on policies in the record
The relevant PDP is _recordPdp in DefaultActionResponder. Since this is based on policies in the records, there are no xml files specifying these policies. Instead the constructor demands the RecordStore:
- _recordPdp = new RecordPDP(_store);
As shown in the sequence diagram a RecordPolicyModule is created and “given” to the PDP. The RecordPolicyModule uses the RecordStore to look up the policySet for a given pingId (which it gets from the requestCtx). The policySet is located in the access policy document in the user's record. This policySet is then used by the PDP to decide whether access should be granted or not. More information: Manage Authorization.
Example: AddDocumentAction
