Access control patterns
4 likes2,761 views
This document discusses access control patterns and practices using WSO2 middleware. It provides an overview of the speaker's background and experience. It then covers topics such as discretionary vs mandatory access control, authorization tables vs access control lists vs capabilities, XACML as the standard for policy-based access control, and examples of implementing access control in WSO2 products using XACML, SAML, and other technologies.
Access control patterns
- 1. Access Control Pa.erns & Prac0ces with WSO2 Middleware Prabath Siriwardena
- 2. About Me • Director of Security Architecture at WSO2 • Leads WSO2 Iden8ty Server – an open source iden8ty and en8tlement management product. • Apache Axis2/Rampart commiCer / PMC • A member of OASIS Iden8ty Metasystem Interoperability (IMI) TC, OASIS eXtensible Access Control Markup Language (XACML) TC and OASIS Security Services (SAML) TC. • TwiCer : @prabath • Email : prabath@apache.org • Blog : hCp://blog.facilelogin.com • LinkedIn : hCp://www.linkedin.com/in/prabathsiriwardena
- 3. Discretionary Access Control (DAC) vs. Mandatory Access Control (MAC)
- 4. With the Discretionary Access Control, the user can be the owner of the data and at his discretion can transfer the rights to another user.
- 5. With Mandatory Access Control, only designated users are allowed to grant rights and, users cannot transfer them.
- 6. All WSO2 Carbon based products are based on Mandatory Access Control.
- 7. Group is a collection of Users - while a Role is a collection of permissions.
- 8. Authorization Table vs. Access Control Lists vs. Capabilities
- 9. Authorization Table is a three column table with subject, action and resource.
- 10. With Access Control Lists, each resource is associated with a list, indicating, for each subject, the actions that the subject can exercise on the resource.
- 11. With Capabilities, each subject has an associated list, called capability list, indicating, for each resource, the accesses that the user is allowed to exercise on the resource.
- 12. Access Control List is resource driven while capabilities are subject driven.
- 13. With policy based access control we can have authorization policies with a fine granularity.
- 14. Capabilities and Access Control Lists can be dynamically derived from policies.
- 15. XACML is the de facto standard for policy based access control.
- 16. XACML provides a reference architecture, a request response protocol and a policy language.
- 17. XACML Reference Architecture Policy Administra0on Point (PAP) Policy Decision Point (PDP) Policy Store Policy Enforcement Point (PEP) Policy Informa0on Point (PIP)
- 18. WSO2 Iden0ty Server (XACML PDP) XACML Request XACML with Capabili0es (WS-‐Trust) Hierarchical Resource Profile XACML Response WSO2 Iden0ty Server (STS) WSO2 Applica0on Server (SOAP Service) SAML token with Authen0ca0on and Authoriza0on Asser0ons (Capabili0es) SAML token request Client Applica0on SAML token with Authen0ca0on and Authoriza0on Asser0on + Service Request
- 19. WSO2 Iden0ty Server (XACML PDP) XACML Request XACML with Capabili0es (WS-‐Trust) Hierarchical Resource Profile XACML Response WSO2 Iden0ty Server (SAML2 IdP) WSO2 Applica0on Server (Web Applica0on) SAML token with Authen0ca0on and Authoriza0on Asser0on (Capabili0es) Browser Redirect with SAML Request Unauthen0cated Request
- 20. Role Based Access Control WSO2 Applica0on Server (SOAP Service) Client Applica0on Service Request + Creden0als WSO2 ESB (Policy Enforcement Point) RBAC
- 21. WSO2 ESB as the XACML PEP (SOAP and REST) WSO2 Iden0ty Server (XACML PDP) XACML Response WSO2 Applica0on Server (SOAP Service) XACML Request WSO2 ESB (Policy Enforcement Point) Client Applica0on Service Request + Creden0als
- 22. XACML PEP as a Servlet Filter WSO2 Iden0ty Server (XACML PDP) XACML Response XACML Request XACML Servlet Filter Client Applica0on WSO2 Applica0on Server Service Request + Creden0als
- 23. OAuth + XACML WSO2 Iden0ty Server (OAuth Authoriza0on Server) XACML Request Validate() XACML Response WSO2 Iden0ty Server (XACML PDP) API Gateway Access Token Client Applica0on
- 24. Authoriza0on with External IdPs (Role Mapping) WSO2 Iden0ty Server IdP Groups External SAML2 IdP (Salesforce) SAML token with Authen0ca0on and A.ribute Asser0ons with IdP groups Web App roles WSO2 Applica0on Server (Web Applica0on) Browser Redirect with SAML Request Unauthen0cated Request
- 25. Liferay Portal XACML Mul0ple Decisions and Applica0on Specific Roles XACML Request WSO2 Iden0ty Server (XAML PDP) XACML Response Login
- 26. lean . enterprise . middleware