Re: [xacml] subject categories

[rich levinson <rich.levinson@oracle.com>]

Hi Mohammad,

I am not sure I understand the full extent of your question w/o more context
as to what you are trying to achieve.

However, it does seem to me that the defns in the core spec, which were also
in the 2.0 spec seem fairly obvious, so possibly you missed it in section B.2,
lines 5183-5200:

"Attributes previously placed in the Subject section of a request are placed in an attribute category 5183 which is identical of the subject category in XACML 2.0, as defined below. It is RECOMMENDED that 5184 they are used to list attributes of subjects when authoring XACML 3.0 policies or requests. 5185

This identifier indicates the system entity that initiated the access request.
 That is, the initial entity in a request chain.
 If subject category is not specified in XACML 2.0, this is the default translation value.
    urn:oasis:names:tc:xacml:1.0:subject-category:access-subject

This identifier indicates the system entity that will receive the results of the request
 (used when it is distinct from the access-subject). 5190
    urn:oasis:names:tc:xacml:1.0:subject-category:recipient-subject

This identifier indicates a system entity through which the access request was passed.
    urn:oasis:names:tc:xacml:1.0:subject-category:intermediary-subject

This identifier indicates a system entity associated with a local or remote codebase
that generated the request.
 Corresponding subject attributes might include the URL from which it was loaded
  and/or the identity of the  code-signer.
    urn:oasis:names:tc:xacml:1.0:subject-category:codebase

This identifier indicates a system entity associated with the computer that initiated the access request. 5198
 An example would be an IPsec identity. 5199
    urn:oasis:names:tc:xacml:1.0:subject-category:requesting-machine"

Note that the language in the defns uses the term "system entity" to describe these
different "categories" of subject. This should be taken to mean a distinct "entity",
whether it be a human actor or a physical machine.

Personally, I interpret "category" to mean a type of object, which probably could
be characterized semantically by its own set of allowable attributes. Basically,
I consider the "category", a collection of attributes w some enterprise or organization
semantic meaning, as in this collection of attributes are about "something" where
"something" is the business or system or organization "entity" that warrants
being described by this particular collection of attributes. (Please pardon the
verbose abstraction language I am using as it is intended to be generic and
not assuming any particular concrete representation wrt "entities".)

So, I think the original xacml authors were not trying to specify
exactly what the different subject subcategories were actually
about, but just giving an indication of a suggested way in which
they could be used to characterize entities in the overall network
that might be of interest for particular security use cases.

Hope this helps,

    Thanks,
    Rich

On 7/22/2013 11:09 PM, Mohammad Jafari wrote:

Hello,

 

As we are trying to update the XSPA XACML profiles, one of the tasks is to support XACML version 3. I noticed that for “subject” attributes, there are now 4 different categories defined in the core. The mandatory category:

urn:oasis:names:tc:xacml:1.0:subject-category:access-subject

and the optional categories:

urn:oasis:names:tc:xacml:1.0:subject-category:recipient-subject

urn:oasis:names:tc:xacml:1.0:subject-category:intermediary-subject

urn:oasis:names:tc:xacml:1.0:subject-category:requesting-machine

 

But the core does not provide any definition or discussion about the differences between these categories. I was wondering if anyone can comment about the differences or refer me to a definition so that we can make a better decision on which category to use for which attributes.

 

Thanks.

 

Regards,

Mohammad

 

--
Thanks, Rich

Rich Levinson | Internet Standards Security Architect
Mobile: +1 978 5055017
Oracle Identity Management
45 Network Drive | Burlington, Massachusetts 01803
Oracle is committed to developing practices and products that help protect the environment