[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Blended Authentication (AKA "Granular Access Control")

• To: Chiusano Joseph <chiusano_joseph@b...>
• Subject: Re: Blended Authentication (AKA "Granular Access Control")
• From: Rich Salz <rsalz@d...>
• Date: Wed, 07 May 2003 10:26:30 -0400
• Cc: xml-dev@l...
• In-reply-to: <3EB920CC.11978223@b...>
• References: <3EB9048B.87D3964E@b...> <3EB910ED.7010103@d...> <3EB920CC.11978223@b...>
• User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3) Gecko/20030312

>
>
>That works well from the perspective of A (the sender side) because it
>asserts that A has the proper claims to access B (this appears to me to
>be more of a "push" method). But what if B does not consider A to be a
>valid user? How can B enforce this?
>  
>
In delegation, the invoker credentials become a *chain of delegation*, 
so that B sees A's rights, and User1's rights.  B gets enough 
information to know that A is operating on behalf of User1.  (Again, the 
degenerate case is impersonation, where B only "sees" User1)

B could enforce that A never appear in the delegation chain, although 
from a security perspective this probably doesn't make sense.

>Also, what about a more granular level, such as at a WSDL Operation or
>Message level?
>
I don't think XACML (e.g.) has defined WSDL extensions to allow you to 
specify "require rights" on an operation.  There's currently some 
tension between XACML and WS-something-or-other as to whether or not 
XACML should be "the" access control language. ...

    /r$

• References:
  • Blended Authentication (AKA "Granular Access Control")
    • From: "Chiusano Joseph" <chiusano_joseph@b...>
  • Re: Blended Authentication (AKA "Granular Access Control")
    • From: Rich Salz <rsalz@d...>
  • Re: Blended Authentication (AKA "Granular Access Control")
    • From: "Chiusano Joseph" <chiusano_joseph@b...>

• Prev by Date: RE: Blended Authentication (AKA "Granular Access Control")
• Next by Date: Re: Blended Authentication (AKA "Granular Access Control")
• Previous by thread: RE: Blended Authentication (AKA "Granular Access Control")
• Next by thread: Re: Blended Authentication (AKA "Granular Access Control")
• Index(es):
  • Date
  • Thread