Understanding Digital Identity Management - Phil Windley's ...

More documents

Recommendations

Info

urn:oasis:names:tc:SPML:interop:interopUserJane Doejdoe@acme.comJane Doe interopUser Subscription1Jane Doe Supply Co17-Nov-2002 12:00 The PSP might respond to this request as follows:
SAML provides a format for exchanging identity and access information, XACMLprovides a format for describing what to do with that information. There is someoverlap between SAML and XACML: both provide a request/response language.The two standards are complimentary, however, using the same definitions forsubjects and actions. But XACML goes beyond SAML in creating a rule-basedlanguage for expressing access control policies.Because XACML is at its core a rule-based language, it is much morecomplicated than the other standards that we’ve discussed which are used forrepresenting data. Policy rules can be created which allow fine-grained controlover access. These rules can be based on items such as:• Attributes of the user making the request (i.e. only people who work inaccounting are allowed to access this document).• The action to be taken (i.e. reading a document vs. updating a document).• The time of day (i.e. users can only log in between 9am and 5pm, orduring their shift).• The authentication mechanism (i.e. only allow users to log in who presenta digital signature as their authentication mechanism)• The protocol used for access (i.e. allow HTTPS access, but not HTTPaccess for this resource).• These can be combined using Boolean connectives to create complexpolicies (i.e. only allow users from accounting to update this documentover HTTPS but allow users from other departments to read it anytimeover HTTP).XACML also has a concept called a “combining algorithm” which allows multiple,perhaps conflicting, policies to be applied to a resource and some action takenas a result. For example, the combining algorithm might simply state “deny if anypolicy denies” or it might be more complicated.The following XACML request (from Sun’s XACML paper—see Resources)states that an unstated subject wants to log into a server called “SampleServer.”The request has three primary parts: it identifies the subject making the request,names the resource, and describes the action.SampleServerDigital Identity Management 15 of 20 Phillip J. Windleywww.windley.com
Page 1 and 2: Understanding DigitalIdentity Manag
Page 3 and 4: perfectly understandable given our
Page 5 and 6: Algorithm="http://www.w3.org/2000/0
Page 7 and 8: • Issuer ID and issuance timestam
Page 9 and 10: authenticated. The site recommends
Page 11 and 12: Figure 5: Web Services ProfileIdent
Page 13: Figure 6 diagrams an example of the
Page 17 and 18: Notice that operators and types are
Page 19 and 20: Enterprises who implement an identi

Understanding Digital Identity Management - Phil Windley's ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?