What is XACML Fine Grained Authorization ?
When we talk about a resource ( Here resource is the Webapp hosted in either WSO2 Application Server, Apache Tomcat etc.) we have to talk about authorization of the users who use those resources. That means some users are authorized to uses the resource and some are not. So what is mean by Fine Grained Authorization ? Traditionally authorization of the user for resource is decided by the users,resource and the action which user does on the resource. But if we can provided authorization based on user, resource, action user does on resources, environment, time, user's role etc. that is fine grained authorization. We use more details of the scenario to decide the authorization of the user. For a example if there is requirement like this, " This document can be edited by only AndunSLG, who is a Teacher and between 8am to 10am at the school office premises". The given requirement is a fine grained authorization requirement.
To evaluate such requirement against users request, we have to document those fine grained authorization requirements. Those are called Polices. XACML is used to document these kind of polices. We can evaluate user's requirements against these XACML polices using a XACML engine.
We can use WSO2 Identity Server for this requirement. It have a XACML Policy Engine where users can evaluate there requests. Also it provides so many functionalities related to XACML Authorization At the end I have given lot of references where you can learn about XACML.
References,
XACML Policy Language
- http://wso2.org/library/articles/2011/10/understanding-xacml-policy-language-xacml-extended-assertion-markup-langue-part-1/
- http://wso2.org/library/articles/2011/10/understanding-xacml-policy-language-xacml-extended-assertion-markup-language-part-2/
- https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=xacml
- http://en.wikipedia.org/wiki/XACML
- http://sunxacml.sourceforge.net/
- http://xacmlinfo.com/category/wso2/
- http://wso2.org/library/webinars/2012/01/the-wso2-identity-server-an-answer-to-your-common-dilemmas-xacml-delimmas/
- http://blog.facilelogin.com/2009/05/identity-server-20-as-xacml-engine.html
- http://wso2.com/solutions/security-and-identity-gateway/centralized-policy-based-authorization/
No comments:
Post a Comment