Re: [xacml] Groups - XACML v3.0 Dynamic Attribute Authority Version 1.0

Subject: Re: [xacml] Groups - XACML v3.0 Dynamic Attribute Authority Version 1.0 uploaded

This looks very good (as usual).

1. The "No Denys" rule seems likely to cause simple errors and confusion. Is there any reason it can't simply be declared illegal and check every DAA Request before processing?

2. The complexity of this scheme suggests to me that good tooling will be essential. In addition to the usual "what if" and automated regression testing, it seems to me that it would be useful to model the abstract scheme that is being implemented. For example, if you are mapping Subjects and/or Resources from various organizations to a Enterprise-wide Subject or Resource it would be desirable to be able to specify the data model of at least the Enterprise entities as well as the organization-specific ones and the mapping between them.

I am not familiar with the ViewDs product features, but I offer this suggestion to any or all XACML providers.

Hal

On Fri, Apr 30, 2021 at 12:50 AM Steven Legg <steven.legg@viewds.com> wrote:

Submitter's message
I added some examples to show how the DAA is expected to work.
There are no changes to the technical content.
-- Dr. Steven Legg

Document Name: XACML v3.0 Dynamic Attribute Authority Version 1.0

Description
This specification defines a new XACML system component, the Dynamic
Attribute Authority, which augments the request context of an XACML
authorization request with additional attributes and attribute values that
are generated on demand according to a set of rules. The rules are
expressed as XACML policies, use obligations to specify the additional
attributes and values, and are processed in the normal manner of a Policy
Decision Point. This means that a Dynamic Attribute Authority can be
readily constructed from existing XACML system components.

A primary use case for the Dynamic Attribute Authority is role enablement,
where the dynamic attribute in question is the subject role.
Download Latest Revision
Public Download Link

Submitter: Dr. Steven Legg
Group: OASIS eXtensible Access Control Markup Language (XACML) TC
Folder: Specifications and Working Drafts
Date submitted: 2021-04-29 21:50:16
Revision: 1

xacml message