[xacml] xacml context, part 1

[Simon Godik <simon@godik.com>]

Here is an overview of xacml context.

I was concentrating on basic ideas and examples.

Schema and more complicated examples will follow shortly.

 

Simon

 

Xacml context, part 1.

Xacml context is the specification of the generic data level interface
to the xacml processor (Michiharu).

Xacml input context is broken down into a number of components:
'subject', 'resource', 'action', and 'other'.

(There is output context as well, it will be in part 2).

Request processing and context construction is defined by the xslt
transformation included in the policy. (see Michiharu document for
details.)

For the purposes of this description it is enough to say that all
data related to the requesting subject is placed under the 'subject'
section of the context, content of the protected resource (if any) is
placed under the 'resource' section, and requested action is under
the 'action'. If request is carrying assertions about subject other
than the requesting subject they are placed under the 'other' section
of the context. All assertions about resources are placed under 'other'
section as well.

Note that environment is not included in the context.

<x:Context xmlns:x="http://www.oasis-open.org/committees/xacml";>
   <x:ContextSubject>
      <--- everything about requesting subject
   </x:ContextSubject>
   <x:ContextResource>
      <--- content of the protected resource, (if any)
   </x:ContextResource>
   <x:ContextAction>
      <--- requested action(s)
   </x:ContextAction>
   <x:ContextOther>
      <--- everything about other identities and resources
   </x:ContextOther>
</x:Context>

Xacml Attribute.
One of the central abstractions of the context is xacml attribute.
Xacml attribute is a remake of saml attribute assertion and it is
qualified with the attribute issuer, attribute issue instant,
attribute holder, and attribute data.

Structural details of the xacml attribute are given in the schema.
Here I want to show how xacml attribute is constructed.

Xacml attribute issuer is an entity that issued attribute. It can be
saml attribute authority, saml authentication authority, pep, etc.

Xacml attribute issue instant is time instance when attribute was issued.
If attribute authority is pep then issue instant is the time when request
was made.

Xacml attribute holder is the entity that owns this attribute. Attribute
can be owned by the identity, or by the uri.

If attribute owner is the requesting subject, attribute is placed under
the 'subject' section of the context, otherwise it is placed under the
'other' section of the context. When attribute is placed under the
'subject' portion of the context, it's holder can be ommitted.

Although 'requestor' is inserted as the first child of the 'subject' portion
of the context, requesting subject is also made into xacml attribute.

As an example, let's look at saml authorizaion query where subject is
identified by x509 name:
<s:Subject>
   <s:NameIdentifier format="X509Name">cn=bart simpson</s:NameIdentifier>
</s:Subject>

This will be made into xacml attribute with 'Issuer' field set to the
name of the PEP, 'IssueInstant' to the time request was made. Attribute 
name is 'X509Name'. 

Note that 'Issuer' is PEP because subject in the azn query
is not authenticated, and becomes authenticated only if authentication
assertion is included in the query evidence. When authentication assertion
is remade into the xacml attribute then 'Issuer' for that attribute is 
authentication authority.

<x:Attribute AttributeName="X509Name" Issuer="pep" IssueInstant="...">
   <x:Holder>
      <x:NameIdentifier format="X509Name>cn=bart simpson</x:NameIdentifier>
   </x:Holder>
   <x:AttributeValue>cn=bart simpson</x:AttributeValue>
</x:Attribute>

If authentication assertion is found in the query evidence, xacml attributes
for authentication method, authentication instant, and authenticated subject
name will be inserted into the context. For all these attributes 'Issuer'
is authentication authority and 'IssueInstant' is time when authentication
was done.

Another interesting case is resource uri for which access is requested.
We treat resource uri as an attribute of a requesting subject with attribute
issuer being PEP and attribute issue instant the time request was made.

(As a matter of fact, all request parameters are treated this way as well).

Here is an example of xacml attribute for the resource uri:

<x:Attribute AttributeName="ResourceURI" Issuer="PEP" IssueInstant="...">
   <x:Holder>
      <x:NameIdentifier format="X509Name>cn=bart simpson</x:NameIdentifier>
   </x:Holder>
   <x:AttributeValue>http://www.foo.com/toystore/robots.html</x:AttributeValue>
</x:Attribute>

Here is an example of file modification time. Note that attribute holder is 
file uri, and this attribute will be placed under the 'other' section of the
context.

<x:Attribute xmlns:x="http://www.oasis-open.org/committees/xacml";
   AttributeName="LastModified" AttributeFamily="www.files.com/ufs"
   Issuer="www.goodguys.com" IssueInstant="2002-05-31T15:20:12">
   <x:Holder>
      <x:AbstractURI>file://webapps/toystore/robots.html"/>
   </x:Holder>
   <x:AttributeValue>
      <ufs:LastModified>2002-05-31T02:15:11</ufs:LastModified>
   </x:AttributeValue>
</x:Attribute>

Example of a simple context.
Subject identified by the X509Name is making a request to read password
file. Subject is authenticated with name-password. Subject is a member of 
'administrator' group.

Note that <x:Holder> is ommited from attributes in the 'subject' section.

<x:Context xmlns:x="http://www.oasis-open.org/committees/xacml";>
<x:ContextSubject>
   <x:Requestor>
      <x:NameIdentifier format="X509Name">cn=bart simpson</x:NameIdentifier>
   </x:Requestor>
   <x:Attribute AttributeName="X509Name" Issuer="PEP" IssueInstant="...">
      <x:AttributeValue>cn=bart simpson</x:AttributeValue>
   </x:Attribute>
   <x:Attribute AttributeName="AuthX509Name" Issuer="AA" IssueInstant="..">
      <x:AttributeValue>cn=bart simpson</x:AttributeValue>
   </x:Attribute>
   <x:Attribute AttributName="AuthenticationMethod" Issuer="AA" ...>
      <x:AttributeValue xsi:type="anyURI">
         http://www....#NamePassword</x:AttributeValue>
   </x:Attribute>
   <x:Attribute AttributeName="AuthenticationInstant" Issuer="AA" ...>
      <x:AttributeValue xsi:type="xsi:dateTime>
         2002-31-05T21:15:05</x:AttributeValue>
   </x:Attribute>
   <x:Attribute AttributeName="ResourceURI" Issuer="PEP" IssueInstant="..">
      <x:AttributeValue xsi:type="xsi:anyURI">
         file://rootdir/admin/password.txt
      </x:AttributeValue>
   </x:Attribute>
   <x:Attribute AttributeName="group" Issuer="AttrAuth" IssueInstant="...">
      <x:AttributeValue xsi:type="xsi:string">administrator</x:AttributeValue>
   </x:Attribute>
</x:ContextSubject>
<x:ContextResource/> -- empty
<x:ContextAction>
   <x:Action>read</x:Action>
</x:ContextAction>
<x:ContextOther/> -- empty
</x:Context>

Simple rule: administrator is allowed to read password file.

<x:rule effect="permit" xmlns:x="...">
   <x:target>
      <x:subjects>
         <x:Attribute AttributeName="role">
            <x:AttributeValue xsi:type="xsi:string">
               administrator
            </x:AttributeValue>
         </x:Attribute>
      </x:subjects>
      <x:resources>
         <x:Attribute AttributeName="ResourceURI">
         </x:AttributeValue xsi:type="xsi:anyURI">
            file://rootdir/admin/password.txt
         </x:AttributeValue>
      </x:resources>
      <x:actions>
         <x:action>read</x:action>
      </x:actions>
   </x:target>
</x:rule>