Common XACML Authorization Profiles

The goal is to define a common XACML authorization profile usable by the EMI components (CREAM, gLExec-WN, StoRM, UNICORE, ARC, ...) and to integrate these components with the Argus Authorization Service. Authorization decision, eventually containing obligation and attribute assignments should also be supported.

The Argus Authorization Service was primary designed to ban users (Deny decision), secondary to allow users to perform action on a resource (Permit decisions).

It is not intended to replace the internal inter-components decision engine (internal component A is allowed to interact with component B), but to render authorization decisions about users, like:

Ban user X to perform any action on any resource!

Can user X perform action Y on resource Z?

In order to achieve such authorization decisions, it is required to define XACML attributes to:

  1. Identify the user X using XACML Subject attribute(s)
  2. Identify the resource Y using XACML Resource attribute
  3. Identify the action Z using XACML Action attribute

Common XACML Profile

Services which shall implement or use the common XACML Profile

  • Argus
    • Implements the profile
    • Extends the simple policy language (SPL) to support the profile
  • UNICORE
    • UNICORE PDP integrates directly with Argus PDP in XACML
  • ARC
  • CREAM CE
    • Updates to use the new profile
  • gLExec WN
    • Updates to use the new profile
  • StoRM (candidate)
    • Integrates with its banning engine
  • EMI Execution Service (candidate)
    • Integrates for authorization ???

Profile Drafts

High Level Workplan

  1. Define the XACML attributes and values required by each stack (glite, ARC, UNICORE)
  2. Identify the common set of attributes and values
  3. Identify the policies ruling these attributes
  4. Implement the profile(s) and policies

Useful Specifications

Additional Information

Topic attachments
I Attachment History Action Size Date Who Comment
Microsoft Word filedoc EMI-DOC-JRA1-CommonXACMLProfile-v1.0.doc r1 manage 143.5 K 2011-10-16 - 12:13 ValeryTschoppExCern EMI Common XACML Profile v.1.0
Microsoft Word filedoc EMI-DOC-JRA1-CommonXACMLProfile-v1.1.1.doc r1 manage 168.0 K 2012-11-19 - 12:53 ValeryTschoppExCern EMI Common XACML Profile v.1.1.1
Microsoft Word filedoc EMI-DOC-JRA1-CommonXACMLProfile-v1.1.doc r2 r1 manage 159.5 K 2011-11-21 - 10:05 ValeryTschoppExCern EMI Common XACML Profile v.1.1
Edit | Attach | Watch | Print version | History: r22 < r21 < r20 < r19 < r18 | Backlinks | Raw View | WYSIWYG | More topic actions
Topic revision: r22 - 2012-12-21 - SimonLeinenExCern
 
    • Cern Search Icon Cern Search
    • TWiki Search Icon TWiki Search
    • Google Search Icon Google Search

    EMI All webs login

This site is powered by the TWiki collaboration platform Powered by PerlCopyright & 2008-2020 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding TWiki? Send feedback