Pages

Introduction to XACML: Access Control Policies in XML

Introduction

This document discusses the eXtensible Access Control Markup Language (XACML), an XML language for specifying security policies. Security policies are ways to describe who has access to what resources under what conditions. For a large enterprise, there are multiple places at which such security policies must be enforced. It would therefore seem logical to define security policies in a technology neutral way, so that they can be reused. That is exactly the purpose that XACML serves.

Intended Audience

Anyone with an interest in security: developers, administrators, HR people, etc. Basic knowledge of XML is assumed.

XACML Overview

The following figure shows the components (orange rectangles) that make up an XACML-based security system and the data (blue ovals) that those components need as input:


xacml-overview.png


  1. A Request comes in at a Policy Enforcement Point (PEP).
  2. The PEP forwards the Request to the Context Handler.
  3. The Context Handler asks the Policy Information Point (PIP) for Context Attributes.
  4. The PIP collects Context Attributes from the Subject (e.g. the role), the Resource (e.g. it's location), and the Environment (e.g. the location from where the Request is made) and returns them to the Context Handler.
  5. The Context Handler gets the Resource's content.
  6. The Context Handler presents the Request to the Policy Decision Point (PDP), along with the Context Attributes and (optionally) the Resource's content.
  7. The PDP makes a decision based on the security policies that the Policy Administration Point (PAP) has previously made available.
  8. The PDP returns its decision to the Context Handler, which returns it to the PEP.
  9. The PEP either grants or denies access to the Request, based on the PDP's decision

There are two main points to take away from this. The first is that the system is made up of components that can be standardized. For instance, the PDP takes well-defined data as input and provides a well-defined interface to the PAP and Context Handler. So organizations don't need to re-invent the wheel by implementing their own PDP, instead they can reuse an existing implementation and hook it up to their implementation of non-standard components, like the PEP.

The second important point is that security policies are specified separately from where they are enforced, which means that we can reuse them in multiple enforcement places. And there is yet another way in which XACML promotes reuse. To see that, we need to take a closer look at how security policies are specified in XACML.

Specifying Access Control: Rules, Policies, and Policy Sets

Rules

A Rule combines a Target, an Effect and a Condition. The Target specifies what the Rule is applicable for: any or all of the requested Action, the Subject requesting the Action, the Resource that the requested Action pertains to, and the Environment within which the Action is to be performed. The Effect of the Rule is to deny or permit the Action. The optional Condition further refines the applicability of the Target.

Here's a simple example of a Rule:

 
 
    Some optional text that explains the purpose of the rule
 
 
   
     
                    "urn:oasis:names:tc:xacml:2.0:function:string-equal">
                        "http://www.w3.org/2001/XMLSchema#string">
            developer
         
         
            role
         
       
     
   
 

This piece of XACML specifies that anybody with the developer role can do anything to any resource. In the example above, we assume the role Attribute to be a single string value, but XACML also supports multi-valued Attributes.

Note that the PIP component needs to be able to extract a value from the Request (see below) that belongs to the Subject attribute named in the SubjectAttributeDesignator element (role in the above example). An alternative way of extracting values from the Request is by providing an XPath expression in the AttributeSelector element.

The PDP component needs to be able to understand the function specified using the MatchId attribute (urn:oasis:names:tc:xacml:2.0:function:string-equal in the example). XACML makes many standard functions available to policy writers, and the specification allows for adding custom ones as well.

A Rule can also contain a Condition that must be satisfied for the Rule to return its Effect. If the Condition returns Indeterminate, the Rule also returns Indeterminate. If the Condition returns False, the Rule returns NotApplicable. If the Condition returns True, the value of the Effect element is returned, which is either Permit or Deny. If the Condition is missing, as in the above example, it is assumed to be True.

Rules can be separately evaluated, but they cannot live on their own: they must be part of a Policy. Rules are the smallest unit of reuse in XACML, while Policies are the smallest unit of evaluation.

Policies

A Policy has a Target, a Rule-Combining Algorithm, some Rules, and some Obligations. We've seen the Target already as part of a Rule. Since a Policy also specifies a Target, a Rule need not specify one. If it doesn't, then it inherits the Target from the Policy. The Rule-Combining Algorithm specifies the procedure by which the results of evaluating the Rules are combined when evaluating the Policy. An Obligation is an operation specified in a Policy that should be performed by the PEP in conjunction with the enforcement of an authorization decision.

Here's the above example Rule wrapped in a Policy:

    "urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides">
 
    Some optional text that explains the purpose of the policy
 
 
   
     
                    "urn:oasis:names:tc:xacml:2.0:function:string-equal">
                        "http://www.w3.org/2001/XMLSchema#string">
            developer
         
         

         
       
     
   
 
 

The RuleCombiningAlgId attribute on the Policy identifies the algorithm that combines Effects from multiple Rules into a single result. The PDP must implement such an algorithm. The Policy may also specify parameters to be used as input for combining algorithms.

The Rule in this Policy example does not specify a Target, but it could. In that case, the Rule would only be evaluated for the Policy if its Target is matched.

Policy Sets

Just as Rules can be reused in Policies, entire Policies can be reused in Policy Sets. A Policy Set contains a Target, a Policy-Combining Algorithm, a set of Policies, and some Obligations. The Policy-Combining Algorithm specifies the procedure by which the results of evaluating the component Policies are combined. Note that a Policy Set can reuse not just Policies, but also entire Policy Sets. This Lego-like structure makes it possible to build complex security policies without duplication.

Here's the above Policy wrapped in a Policy Set:

More Here


Courtesy:https://community.emc.com/docs/DOC-7314

145 comments:

  1. www.happyfriendshipdayimagesquotes.com

    ReplyDelete

  2. In the past I used Juggernox as an example. When one selects a Juggernox, there are a number of particulars that you have to toss around. Certainly, more trouble for Juggernox is coming in the form of Juggernox. We'll run it up the flagpole and see who salutes. No opinion is completely original. You need a coordinated idea but the greatest strength of Juggernox is that really effortless fact. >>>http://www.kingsizemaleenhancements.com/juggernox/

    ReplyDelete
  3. I have read your blog its very attractive and impressive. I like it your blog.

    Java Online Training Java EE Online Training Java EE Online Training Java 8 online training Java 8 online training

    Java Online Training from India Java Online Training from India Core Java Training Online Core Java Training Online Java Training InstitutesJava Training Institutes

    ReplyDelete
  4. Thanks alot for this great information. I really enjoyed the article and will read all others to get more information. I am bookmarking your blog for future again thanks :)


    Daily Inspirational Messages
    Christmas Quotes
    Christmas Images
    New Year Images

    ReplyDelete
  5. Awesome blog. I enjoyed reading your articles. This is truly a great read for me. I have bookmarked it and I am looking forward to reading new articles. Keep up the good work!
    Anti-Valentine Day
    Confession Day Images
    Missing Day Images
    Flirting Day Images
    slap day images
    kick day images
    perfume day images

    ReplyDelete
  6. Visit us now to view & share beautiful collection of Best Images of
    rose day 2017

    ReplyDelete
  7. Visit us now to view & share beautiful collection of Best Images of
    rose day quotes

    ReplyDelete
  8. www.ipllivestreaming2017.in This is great information you have share here. I will be looking forward to reaching out to see what We can do to help the world as you do

    ReplyDelete
  9. This is a great post. I like this topic.This site has lots of advantage.I found many interesting things from this site.
    romantic good morning
    fake friends quotes
    birthday wishes for mother from daughter

    ReplyDelete
  10. Fancy designer wear our website and resonable price More....
    We Have Some For You In Your Budget For more…..
    Eid Mubarak

    ReplyDelete
  11. Best Outfits For Young ladies,Womens and Girls
    We Have Some For You In Your Budget For more…
    Plz visit:- Designer Salwar Suits

    ReplyDelete
  12. Have Lovely and Beautiful Salwar Suit And Many More…
    We Have Some For You In Your Budget For more…
    Plz visit:- Online Shopping clothes

    ReplyDelete

  13. Best Outfits For Young ladies,Womens and Girls
    We Have Some For You In Your Budget For more…
    Plz visit:- Punjabi Suit

    ReplyDelete
  14. Best Outfits For Young ladies,Womens and Girls
    We Have Some For You In Your Budget For more…
    Plz visit:- Wedding Lahenga

    ReplyDelete
  15. Best Outfits For Young ladies, Womens and Girls
    We Have Some For You In Your Budget For more…
    Plz visit:- Ghagra Choli

    ReplyDelete

  16. Eid Mubarak SMS in Hindi most recent of 2017 which can’t be discovered anyplace on net. You can duplicate these Eid SMS and send to your Parents, Relatives and companions.
    eid mubarak images
    eidimages.com

    ReplyDelete
  17. The best collection of Happy Mothers Day 2017 Images, Photos, Pictures, Wallpapers, Mothers Day Quotes, Wishes, Messages, Greetings,
    Happy Mothers Day Poems & Sayings, Mothers Day Messages, SMS, Text Messages,
    happy fathers day images
    happy fathers day image
    fathers day pictures 2017
    fathers day cards 2017
    father day images free
    happy fathers day quotes
    happy fathers day message
    happy fathers day to my husband
    happy fathers day wishes
    father's day quote
    eid mubarak 2017
    Mothers Day WhatsApp Status & Facebook Status, DP Images,
    Mothers Day FB Profile Pics, FB Timeline Cover Photos etc.

    ReplyDelete
  18. I like this Article. Thanks for sharing the valuable information with us. Keep Posting.
    The best five movers and packers are rank in Top 5 packers and movers in Chandigarh. From packing to unpacking, loading to unloading, home shifting to corporate shifting, the best five Movers and packers Chandigarh is the one stop shop for all.
    Packers and Movers in panchkula
    Packers and Movers in chandigarh
    Packers and Movers in mumbai
    Packers and Movers in pune
    Packers and Movers in bangalore

    ReplyDelete
  19. This is what i was looking for thak you for sharing this amazing post. keep on posting these kind of nice post
    happy independence day
    Eid Mubarak images
    Crack center
    botany

    ReplyDelete
  20. Through the passage of time festivals are undergoing modifications. Raksha Bandhan is also known as Rakhi. Rakhi has become a sacred festival for sisters and brothers. Sisters tie them to brothers. Priests tie them to people of his congregation.for more..
    Plz visit:- Rakhi Wishes

    ReplyDelete
  21. India is a country of colorful festivals. All the festivals in India are according to the Indian Hindu Calendar.Each one of them has either religious significance or they signify different Indian relations.for more..
    Plz visit:- Raksha Bandhan Images

    ReplyDelete
  22. Rakhi is the traditional Indian festival where a sister ties Rakhi string around her brother's wrist.
    Like many other Indian festivals, this too is a gift-giving occasion when brother and sisters exchange their token of love.
    There are many quotes are available for sibling in our article......
    For More....
    Plz visit:- Raksha Bandhan Quotes

    ReplyDelete


  23. As India celebrates its 70th Independence Day on 15 August 2017, its citizens rejoice celebrating a different kind of freedom - the freedom to travel, explore, and unwind. The Indian citizens are all perked up for a much awaited long weekend during Independence Day.
    Please visit Independence Day

    India is known worldwide for its rich heritage and cultural beliefs. For the richness and sweetness attained, the country pays tribute to various people who played an influential role in this attainment.
    Please visit Independence Day Status

    ReplyDelete
  24. You can get a Amazing variety of bridal dresses at our sites.
    The dresses are very beautiful to look at and you can pick them up from online shops.
    we have some for you in your budget...
    For More...
    Plz Visit: Bridal Lehengas

    ReplyDelete
  25. Wedding Saree, Designer Saree, sari, or shari is a female garment from
    the Indian subcontinent. The designs that we have at
    our website are select very carefully so that you can make your decision quickly.
    Plz visit:- WeddingSaree

    ReplyDelete
  26. Designer Bridal Lehenga is perhaps the desire of every single girl in this world to look amazing on her wedding day.
    It is certainly important that the bride must be the star of the show.The most beautiful woman at the wedding venue.
    In India,Bridal Lehenga are the most obvious choice for the brides.There are many designer Bridal Lehenga in our site...
    For more...
    Plz visit:- Bridal Lehenga

    ReplyDelete
  27. Designer Bridal Lehenga is perhaps the desire of every single girl in this world to look amazing on her wedding day.
    It is certainly important that the bride must be the star of the show.The most beautiful woman at the wedding venue.
    In India,Bridal Lehenga are the most obvious choice for the brides.There are many designer Bridal Lehenga in our site...
    For more...
    Plz visit:- Bridal Lehenga

    ReplyDelete
  28. You can buy from our large and diverse collection of salwar kameez, party wear suits, Bollywood collection, cotton Kurtis, Anarkali suits, Bollywood saree and many other products.....
    We Have Some For You In Your Budget For more…
    Plz visit:- Kurtis

    ReplyDelete
  29. Hello visit our website for best Cargo Trailer We are providing enclosed trailer and must visit website for enclosed motorcycle trailers.we are also providing following trailers that includes
    car haulers
    Diamond cargo
    cheap enclosed trailer
    Concession trailers
    Enclosed Gooseneck Trailers
    Transport trailers
    It is one of the best website for trailer.We hope you will like it.

    ReplyDelete
  30. India is the country of culture Festival.People in india are so crazy about festivals.Diwali is the biggest festival of India.It is the Festival Of Lights.
    Christmas is the New Year of Christians.
    Plz visit:- Happy Diwali Status
    Merry Christmas Status
    Happy New Year Status

    ReplyDelete
  31. The most beautiful woman at the venue.
    In India Kurtis is are the most obvious choice for the brides.There are many designer Kurtis in our site...
    We have New Massive Collection For Here....
    Pakistani Dress
    Designer Sarees
    Wedding Lehenga
    Salwar Kameez
    Salwar Suit
    Anarkali Suit
    Anarkali Dress
    Kurtis
    Wedding Dress
    Punjabi Suits

    ReplyDelete
  32. An adorable personality partnered with a perfect choice for Designer Dress unbeatable.
    Even before the blossom of modernization in Indian culture, kurta, sarees, and salwar kameez had been part of India's unique civilization.
    In India,Designer Salwar Kameez are the most obvious choice for the Young Ladies & Girls.There are many Designer Salwar Kameez in our site...
    Punjabi Dress
    Wedding Saree
    Lehenga Choli
    Ghagra Choli
    Silk Saree
    Ladie Suit
    Indian Saree
    Designer Dress
    Brindal Dresses
    Designer Kurtis

    ReplyDelete
  33. Have Lovely and Beautiful Salwar Suit Saree, Gown And Many More…
    We Have Some For You In Your Budget For more…
    Plz visit:
    Lehenga
    Saree
    Gown
    Brindal Lehenga
    Pakistani Dress
    Designer Saree
    Wedding Lehenga
    Salwar Kameez
    Salwar Suit
    Anarkali Suit

    ReplyDelete
  34. Fancy designer wear like that saree,salwar suit,Kurtis our website and reasonable price More…
    We Have Some For You In Your Budget For more…
    Anarkali Dress
    Punjabi Dress
    Wedding Saree
    Lehenga Choli
    Ghagra Choli
    Silk Saree
    Ladies Suit
    Indian Saree
    Designer Dress
    Brindal Dress

    ReplyDelete
  35. An adorable personality partnered with a perfect choice for Designer Dress unbeatable. Even before the blossom of modernization in Indian culture, kurta, sarees, and salwar kameez had been part of India's unique civilization. There are many Designer gown in our site...
    For more... Gown

    ReplyDelete
  36. A movie is used for an entertainment of busy people.
    By seeing movie person experiences refreshment from their day to day life.
    For watching movie plz visit following site:-
    kingsman-thegoldencircle
    kingsman: the golden circle

    ReplyDelete