Upload
arnav
View
53
Download
0
Tags:
Embed Size (px)
DESCRIPTION
Access Control Patterns & Practices with WSO2 Middleware. Prabath Siriwardena. About Me. Director of Security Architecture at WSO2 Leads WSO2 Identity Server – an open source identity and entitlement management product. Apache Axis2/Rampart committer / PMC - PowerPoint PPT Presentation
Citation preview
Access Control Patterns & Practiceswith
WSO2 Middleware
Prabath Siriwardena
About Me• Director of Security Architecture at WSO2• Leads WSO2 Identity Server – an open source identity and
entitlement management product.• Apache Axis2/Rampart committer / PMC• A member of OASIS Identity Metasystem Interoperability (IMI)
TC, OASIS eXtensible Access Control Markup Language (XACML) TC and OASIS Security Services (SAML) TC.
• Twitter : @prabath• Email : [email protected]• Blog : http://blog.facilelogin.com• LinkedIn : http://www.linkedin.com/in/prabathsiriwardena
Discretionary Access Control (DAC)
vs. Mandatory Access Control (MAC)
With the Discretionary Access Control, the user can be the owner
of the data and at his discretion can transfer the rights to another
user.
With Mandatory Access Control, only designated users are allowed to grant rights and, users cannot
transfer them.
All WSO2 Carbon based products are based on Mandatory Access
Control.
Group is a collection of Users - while a Role is a collection of
permissions.
Authorization Table vs.
Access Control Lists vs.
Capabilities
Authorization Table is a three column table with subject, action
and resource.
With Access Control Lists, each resource is associated with a list, indicating, for each subject, the actions that the subject can
exercise on the resource.
With Capabilities, each subject has an associated list, called capability list,
indicating, for each resource, the accesses that the user is allowed to exercise on the
resource.
Access Control List is resource driven while capabilities are
subject driven.
With policy based access control we can have authorization policies
with a fine granularity.
Capabilities and Access Control Lists can be dynamically derived
from policies.
XACML is the de facto standard for policy based access control.
XACML provides a reference architecture, a request response protocol and a policy language.
Policy Enforcement Point (PEP)
Policy Information Point (PIP)
Policy Administration Point (PAP)
Policy Decision Point (PDP)
Policy Store
XACML Reference Architecture
WSO2 Application Server (SOAP Service)
WSO2 Identity Server (STS)
Client Application
SAML token request
SAML token with Authentication and
Authorization Assertions (Capabilities)SAML token with Authentication
and Authorization Assertion
+Service Request
WSO2 Identity Server (XACML PDP)
XACML ResponseXACML Request
XACML with Capabilities (WS-Trust) Hierarchical Resource Profile
WSO2 Application Server (Web Application)
WSO2 Identity Server (SAML2 IdP)
Browser Redirect with SAML Request
WSO2 Identity Server (XACML PDP)
Unauthenticated Request
SAML token with Authentication and
Authorization Assertion (Capabilities)
XACML ResponseXACML Request
XACML with Capabilities (WS-Trust) Hierarchical Resource Profile
WSO2 ESB(Policy Enforcement
Point)Client Application
Service Request + Credentials
WSO2 Application Server (SOAP Service)
RBAC
Role Based Access Control
WSO2 ESB(Policy Enforcement
Point)Client Application
Service Request + Credentials
WSO2 Identity Server (XACML PDP)
WSO2 Application Server (SOAP Service)XACML Response
XACML Request
WSO2 ESB as the XACML PEP (SOAP and REST)
WSO2 Application ServerClient Application
Service Request + Credentials
WSO2 Identity Server (XACML PDP) XACML Response
XACML Request
XACML Servlet Filter
XACML PEP as a Servlet Filter
WSO2 Identity Server (XACML PDP)
XACML ResponseXACML Request
WSO2 Identity Server (OAuth Authorization
Server)API Gateway
Access Token
Client Application
Validate()
OAuth + XACML
WSO2 Application Server (Web Application)
External SAML2 IdP (Salesforce)
Browser Redirect with SAML RequestUnauthenticated Request
SAML token with Authentication and Attribute Assertions with IdP groups
WSO2 Identity Server
Web App roles
IdP Groups
Authorization with External IdPs (Role Mapping)
Login
WSO2 Identity Server(XAML PDP)
XACML Request
XACML Response
Liferay Portal
XACML Multiple Decisions and Application Specific Roles
lean . enterprise . middleware