Common XACML Authorization Profiles

The goal is to define a common XACML authorization profile usable by the EMI components (CREAM, gLExec-WN, StoRM, UNICORE, ARC, ...) and to integrate these components with the Argus Authorization Service. Authorization decision, eventually containing obligation and attribute assignments should also be supported.

The Argus Authorization Service was primary designed to ban users (Deny decision), secondary to allow users to perform action on a resource (Permit decisions).

It is not intended to replace the internal inter-components decision engine (internal component A is allowed to interact with component B), but to render authorization decisions about users, like:

Ban user X to perform any action on any resource!

Can user X perform action Y on resource Z?

In order to achieve such authorization decisions, it is required to define XACML attributes to:

1. Identify the user X using XACML Subject attribute(s)
2. Identify the resource Y using XACML Resource attribute
3. Identify the action Z using XACML Action attribute

Common XACML Profile

• EMI Common XACML Authorization Profile v.1.1.1 technical document EMI-DOC-JRA1-CommonXACMLProfile-v1.1.1.doc
• Wiki page for the EMI Common XACML Authorization Profile v.1.1.1

• EMI Common XACML Authorization Profile v.1.1 technical document EMI-DOC-JRA1-CommonXACMLProfile-v1.1.doc
• EMI Common CE XACML Authorization Profile v.1.0 technical document EMI-DOC-JRA1-CommonXACMLProfile-v1.0.doc:
• Wiki page for the Common CE XACML Authorization Profile v.1.0

Services which shall implement or use the common XACML Profile

• Argus
  • Implements the profile
  • Extends the simple policy language (SPL) to support the profile
• UNICORE
  • UNICORE PDP integrates directly with Argus PDP in XACML
• ARC
  • SecurityHandler integrates using the PEP client API ?
• CREAM CE
  • Updates to use the new profile
• gLExec WN
  • Updates to use the new profile
• StoRM (candidate)
  • Integrates with its banning engine
• EMI Execution Service (candidate)
  • Integrates for authorization ???

Profile Drafts

• Common CE XACML Authorization Profile v.0 (draft)
• Common CE XACML Authorization Profile v.1 (draft)

High Level Workplan

1. Define the XACML attributes and values required by each stack (glite, ARC, UNICORE)
2. Identify the common set of attributes and values
3. Identify the policies ruling these attributes
4. Implement the profile(s) and policies

Useful Specifications

• XACML 2.0 Specifications eXtensible Access Control Markup Language (XACML) Version 2.0
• XACML Profile for the gLite WN XACML Grid Worker Node Authorization Profile (v. 1.0)
• XACML Profile for the gLite CE XACML Grid Computing Element Authorization Profile (Draft)

Additional Information

• EMI Common SAML Attributes Profile
• ARC Attributes