PicketBox XACML v2.0.9.Final Released

PicketBox XACML v2.0.9.Final has been released.

You can download it from http://www.jboss.org/picketbox/downloads

Information available at https://community.jboss.org/wiki/PicketBoxXACMLJBossXACML

Mostly a bug fix release. Except that we have made the PDP evaluation configurable with locks.

Release Notes - PicketBox - Version picketbox_xacml_2.0.9.Final

Bug

• [SECURITY-738] - XACML DatabaseResourceAttributeLocator fails when used with Oracle 11g Driver
• [SECURITY-742] - JBossPDP.evaluate() lock should be flexible

Enhancement

• [SECURITY-734] - Slow policy evaluation with a large number of policy sets

Release

• [SECURITY-743] - Release PicketBox XACML 2.0.9.Final

PicketBox XACML v2.0.5.final from JBoss released

It took some extra time (other priorities took precedence). In the end, it all worked out fine.

LGPL licensed free open source project, PicketBox has released the XACML component v2.0.5.final.   Please download it from PicketBox downloads.


Main Wiki Page


PicketBox XACML Dashboard Wiki Page


Main Features Added (compared to v2.0.4)

• LDAP Based Policy Locator.
• LDAP Based Attribute Locator.
• Database Based Attribute Locator.
• Decision Cache for performance.

JIRA
PicketBox JIRA




JBoss Integration

PicketBox XACML is integrated into JBoss Application Server v5.0 and beyond.  Additionally, it is available as part of the JBoss Enterprise Application Platform (EAP) v5.0 and beyond and JBoss SOA Platform v5.0 and beyond.


Release Notes

** Bug

•     * [SECURITY-452] - Don't use Xalan classes directly. Use Java API instead
•     * [SECURITY-461] - AttributeFinder:findAttribute method can throw an NPE if any of the attribute finder modules return null
•     * [SECURITY-462] - JBossRequestContext should throw IllegalArgumentException for null inputstream
•     * [SECURITY-507] - JBossXACML: anyURI mismatch
•     * [SECURITY-518] - JBossPDP should be serializable

** Feature Request

•     * [SECURITY-454] - Database Attribute Locator
•     * [SECURITY-463] - AttributeValue.getValue abstract method * [SECURITY-455] - LDAP based attribute locator
•     * [SECURITY-456] - File based Attribute Locator
•     * [SECURITY-492] - JBossPolicySetLocator should gracefully handle policies
•     * [SECURITY-516] - Create a LDAP policy provider for JBoss XACML
•     * [SECURITY-521] - Decision Cache for constant XACML Requests
•     * [SECURITY-522] - XACML add hashcode and equals to RequestCtx, Attribute
•     * [SECURITY-525] - XACML Attribute Locator should support comma separated list of attributeSupportedIds                                                                                                         

TIP::JBossXACML Logging

If you are interested in seeing the trace messages of the PDP engine in JBossXACML, you will need to add the following line to the logging.properties file in use for your setup.

# Set the default logging level for the logger named org.jboss
org.jboss.security.xacml.sunxacml.level = FINEST


If you are running it in Apache Tomcat, then the file is in conf directory.
In JBoss Application Server, you should just add a trace category in the conf/jboss-log4j.xml


The trace messages will be found in the logs of your server.

JBossXACML v2.0.4 Released

You can get JBossXACML v2.0.4 with minor performance improvements from
http://jboss.org/jbosssecurity/downloads/JBoss%20XACML/?action=a&windowstate=maximized

==================
** Feature Request
* [ SECURITY-423 ] RequestAttributeFactory should have method for multi valued attributes
* [ SECURITY-424 ] Schema Entity Resolver to resolve to local XACML schemas
* [ SECURITY-425 ] Ability to disable JBossXACML Schema Validation
* [ SECURITY-431 ] JAXBContext should be cached in JBossPDP

** Release
* [ SECURITY-432 ] Release JBossXACML 2.0.4
=====================

FAQ:
1) I want to use the latest JBossXACML jar in JBoss AS 5.x
- You need to replace the jbossxacml.jar with the one from this release from the lib directory of your JBoss AS instance. Note if you have a jboss-sunxacml.jar in the lib directory also, discard it.

JBossXACML v2.0.3 Released

Since we had a very successful interoperability experience as part of the Oasis-HITSP Technology Demonstration at HIMSS2009 in Chicago, we are ready to roll the next version of JBossXACML.

JBossXACML v2.0.3 should be available from here. (Click <==)


Release Notes:
==========================
Release Notes for JBoss Security and Identity Management
Includes versions: JBossXACML_2.0.3.alpha JBossXACML_2.0.3.CR1 JBossXACML_2.0.3.CR2 JBossXACML_2.0.3.CR3 JBossXACML_2.0.3.CR4 JBossXACML_2.0.3 JBossXACML_2.0.3.CR5

** Sub-task
* [ SECURITY-390 ] JBossXACML: ResourceLocator
* [ SECURITY-396 ] Rule:: NPE if description of a rule is empty
* [ SECURITY-400 ] XACML Conformance Tests: Mandatory - attribute references, functions, combination algos
* [ SECURITY-401 ] XACML Conformance Tests: Mandatory - schema components

** Feature Request
* [ SECURITY-257 ] AttributeDesignator should throw RuntimeException when a particular attribute that was expected is missing
* [ SECURITY-275 ] JBossSAMLRequest: buildRequest method
* [ SECURITY-382 ] JBossPDP ctr to take Configuration Metadata also
* [ SECURITY-388 ] JBossXACML: AttributeLocator
* [ SECURITY-407 ] XACML: Configuration should allow specifying just the locators (and no policies)

** Bug
* [ SECURITY-206 ] Attribute type not set in constructor
* [ SECURITY-295 ] NPE in JBossPDP -> createValidatingUnMarshaller when schema is missing
* [ SECURITY-351 ] JBossResponseContext->getResult has missing values
* [ SECURITY-391 ] JBossXACML: PDP construction should be one time
* [ SECURITY-394 ] FunctionBase: bag-size throws an IllegalArgumentException
* [ SECURITY-395 ] AbstractPolicy: Empty Description element throws NPE
* [ SECURITY-397 ] XACML: HigherOrderFunction checkInputs needs to relax type checking on evaluations
* [ SECURITY-399 ] XACML: Apply->evaluate method tries to encode an attributeValue that can be a bag
* [ SECURITY-403 ] XACML: Resource can have multiple attributes with resource-id
* [ SECURITY-405 ] XACML:: TimeAttribute computes GMT miliseconds incorrectly when the date is 1 day after Jan 1, 1970

** Task
* [ SECURITY-335 ] Sync up sunxacml bug fixes
* [ SECURITY-337 ] Validate the Oasis XACMLv2 conformance tests
* [ SECURITY-359 ] Retire jboss-xacml-saml module
* [ SECURITY-360 ] Assembly for jbossxacml
* [ SECURITY-409 ] Release JBossXACML 2.0.3
==============================================================

What is new?
* Some performance improvements in the PDP evaluation. Previously we were creating a PDP per evaluation. Now we instantiate a PDP and then use it for each evaluation. (Call this an oversight. We are human!).
* You can specify just locators (policy, attribute or resource) in the configuration file without the need for specifying the policy/policysets. This is useful when you need to write a locator that needs to fetch a policy or attribute from a different location.
* The Oasis v2 Conformance Tests are now part of the JBossXACML test suite. So every release will ensure that we have conformance.

User Guide: http://www.jboss.org/auth/jbosssecurity/docs/jbossxacml/html/jbossxacml.html

JBossXACML 2.0.3.CR5 released

http://www.jboss.org/jbosssecurity/downloads/JBoss XACML

Pick the JBossXACML CR5 version from the xacml downloads section (Ignore the download counter as it is not working).

Bugs Fixed:
SECURITY-403 XACML: Resource can have multiple attributes with resource-id
SECURITY-405 XACML:: TimeAttribute computes GMT miliseconds incorrectly when the date is 1 day after Jan 1, 1970

If you are interested in adding this to JBossAS 5.0.x, then from the common/lib directory, remove the (jboss-xacml.jar and jboss-sunxacml.jar) and place jbossxacml.jar there.


User Guide: http://www.jboss.org/auth/jbosssecurity/docs/jbossxacml/html/jbossxacml.html

JBossXACML 2.0.3.CR4 released

Please pick up the CR4 release of JBossXACML in the 2.0.3 cycle at:
http://www.jboss.org/jbosssecurity/downloads/JBoss%20XACML/

(NOTE: Ignore the download counter which is showing 0. It is broken).

Release Notes for JBoss Security and Identity Management
Includes versions: JBossXACML_2.0.3.CR4

** Sub-task
* [ SECURITY-396 ] Rule:: NPE if description of a rule is empty
* [ SECURITY-400 ] XACML Conformance Tests: Mandatory - attribute references, functions, combination algos
* [ SECURITY-401 ] XACML Conformance Tests: Mandatory - schema components

** Bug
* [ SECURITY-394 ] FunctionBase: bag-size throws an IllegalArgumentException
* [ SECURITY-395 ] AbstractPolicy: Empty Description element throws NPE
* [ SECURITY-397 ] XACML: HigherOrderFunction checkInputs needs to relax type checking on evaluations
* [ SECURITY-399 ] XACML: Apply->evaluate method tries to encode an attributeValue that can be a bag

** Task
* [ SECURITY-337 ] Validate the Oasis XACMLv2 conformance tests
* [ SECURITY-402 ] Release JBossXACML 2.0.3.CR4

References:
JBossXACML Announcements: http://www.jboss.org/index.html?module=bb&op=viewtopic&t=152989

Additional Note: JBossXACML Debugging:
If you are looking at getting debug information for the rule evaluation:

Try to create a logging.properties file
============================
# Specify the handlers to create in the root logger
# (all loggers are children of the root logger)
# The following creates two handlers
handlers = java.util.logging.ConsoleHandler, java.util.logging.FileHandler

# Set the default logging level for the root logger
.level = ALL

# Set the default logging level for new ConsoleHandler instances
java.util.logging.ConsoleHandler.level = ALL

# Set the default logging level for new FileHandler instances
java.util.logging.FileHandler.level = ALL

# Set the default formatter for new ConsoleHandler instances
java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter
java.util.logging.FileHandler.formatter=java.util.logging.SimpleFormatter

# Set the default logging level for the logger named org.jboss
org.jboss.security.xacml.sunxacml.level = FINEST
com.sun.xml.bind.level = OFF
=====================================================

Now pass the system property with the location of this file such as:
-Djava.util.logging.config.file=src/test/resources/logging.properties

Then you should see something like:
=========================================
Mar 30, 2009 3:38:25 PM org.jboss.security.xacml.sunxacml.combine.StandardCombiningAlgFactory initAlgorithms
CONFIG: Initializing standard combining algorithms
Mar 30, 2009 3:38:25 PM org.jboss.security.xacml.sunxacml.cond.StandardFunctionFactory initGeneralFunctions
CONFIG: Initializing standard General functions
Mar 30, 2009 3:38:25 PM org.jboss.security.xacml.sunxacml.cond.StandardFunctionFactory initConditionFunctions
CONFIG: Initializing standard Condition functions
Mar 30, 2009 3:38:25 PM org.jboss.security.xacml.sunxacml.cond.StandardFunctionFactory initTargetFunctions
CONFIG: Initializing standard Target functions
Mar 30, 2009 3:38:25 PM org.jboss.security.xacml.sunxacml.PDP <init>
FINE: creating a PDP
Mar 30, 2009 3:38:25 PM org.jboss.security.xacml.sunxacml.finder.PolicyFinder init
FINER: Initializing PolicyFinder
Resource must contain resource-id attr
Mar 30, 2009 3:38:25 PM org.jboss.security.xacml.sunxacml.cond.Apply evaluate
FINE: Function:urn:oasis:names:tc:xacml:1.0:function:string-bag-size:<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xspa:1.0:resource:org:allowed-organizations" DataType="http://www.w3.org/2001/XMLSchema#string"/>
:::result=2
Mar 30, 2009 3:38:25 PM org.jboss.security.xacml.sunxacml.cond.Apply evaluate
FINE: Function:urn:oasis:names:tc:xacml:1.0:function:integer-equal:<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag-size">
<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xspa:1.0:resource:org:allowed-organizations" DataType="http://www.w3.org/2001/XMLSchema#string"/>
</Apply>
::org.jboss.security.xacml.sunxacml.attr.IntegerAttribute@0:::result=false
Mar 30, 2009 3:38:25 PM org.jboss.security.xacml.sunxacml.cond.Apply evaluate
FINE: Function:urn:oasis:names:tc:xacml:1.0:function:not:<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:integer-equal">
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag-size">
<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xspa:1.0:resource:org:allowed-organizations" DataType="http://www.w3.org/2001/XMLSchema#string"/>
</Apply>
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#integer">0</AttributeValue>
</Apply>
:::result=true
Mar 30, 2009 3:38:25 PM org.jboss.security.xacml.sunxacml.cond.Apply evaluate
FINE: Function:urn:oasis:names:tc:xacml:1.0:function:string-subset:<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="urn:oasis:names:tc:xacml:2.0:subject:locality" DataType="http://www.w3.org/2001/XMLSchema#string"/>
::<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xspa:1.0:resource:org:allowed-organizations" DataType="http://www.w3.org/2001/XMLSchema#string"/>
:::result=true
Mar 30, 2009 3:38:25 PM org.jboss.security.xacml.sunxacml.cond.Apply evaluate
FINE: Function:urn:oasis:names:tc:xacml:1.0:function:not:<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-subset">
<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="urn:oasis:names:tc:xacml:2.0:subject:locality" DataType="http://www.w3.org/2001/XMLSchema#string"/>
<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xspa:1.0:resource:org:allowed-organizations" DataType="http://www.w3.org/2001/XMLSchema#string"/>
</Apply>
:::result=false
Mar 30, 2009 3:38:25 PM org.jboss.security.xacml.sunxacml.cond.Apply evaluate
FINE: Function:urn:oasis:names:tc:xacml:1.0:function:and:<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:not">
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:integer-equal">
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag-size">
<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xspa:1.0:resource:org:allowed-organizations" DataType="http://www.w3.org/2001/XMLSchema#string"/>
</Apply>
<AttributeValue DataType="http://www.w3.org/2001/XMLSchema#integer">0</AttributeValue>
</Apply>
</Apply>
::<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:not">
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-subset">
<SubjectAttributeDesignator SubjectCategory="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject" AttributeId="urn:oasis:names:tc:xacml:2.0:subject:locality" DataType="http://www.w3.org/2001/XMLSchema#string"/>
<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xspa:1.0:resource:org:allowed-organizations" DataType="http://www.w3.org/2001/XMLSchema#string"/>
</Apply>
</Apply>
:::result=false
Mar 30, 2009 3:38:25 PM org.jboss.security.xacml.sunxacml.combine.DenyOverridesRuleAlg combine
FINE: Rule id:urn:oasis:names:tc:xspa:1.0:org:allowed:organizations:deny:result=3
Mar 30, 2009 3:38:25 PM org.jboss.security.xacml.sunxacml.cond.Apply evaluate
FINE: Function:urn:oasis:names:tc:xacml:1.0:function:time-one-and-only:<EnvironmentAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-time" DataType="http://www.w3.org/2001/XMLSchema#time"/>
:::result=15:38:25.553000000-05:00
Mar 30, 2009 3:38:25 PM org.jboss.security.xacml.sunxacml.cond.Apply evaluate
FINE: Function:urn:oasis:names:tc:xacml:1.0:function:time-one-and-only:<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xspa:1.0:resource:org:hoursofoperation:start" DataType="http://www.w3.org/2001/XMLSchema#time"/>
:::result=00:00:00-08:00
Mar 30, 2009 3:38:25 PM org.jboss.security.xacml.sunxacml.cond.Apply evaluate
FINE: Function:urn:oasis:names:tc:xacml:1.0:function:time-greater-than-or-equal:<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-one-and-only">
<EnvironmentAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-time" DataType="http://www.w3.org/2001/XMLSchema#time"/>
</Apply>
::<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-one-and-only">
<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xspa:1.0:resource:org:hoursofoperation:start" DataType="http://www.w3.org/2001/XMLSchema#time"/>
</Apply>
:::result=true
Mar 30, 2009 3:38:25 PM org.jboss.security.xacml.sunxacml.cond.Apply evaluate
FINE: Function:urn:oasis:names:tc:xacml:1.0:function:not:<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-greater-than-or-equal">
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-one-and-only">
<EnvironmentAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-time" DataType="http://www.w3.org/2001/XMLSchema#time"/>
</Apply>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-one-and-only">
<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xspa:1.0:resource:org:hoursofoperation:start" DataType="http://www.w3.org/2001/XMLSchema#time"/>
</Apply>
</Apply>
:::result=false
Mar 30, 2009 3:38:25 PM org.jboss.security.xacml.sunxacml.cond.Apply evaluate
FINE: Function:urn:oasis:names:tc:xacml:1.0:function:time-one-and-only:<EnvironmentAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-time" DataType="http://www.w3.org/2001/XMLSchema#time"/>
:::result=15:38:25.553000000-05:00
Mar 30, 2009 3:38:25 PM org.jboss.security.xacml.sunxacml.cond.Apply evaluate
FINE: Function:urn:oasis:names:tc:xacml:1.0:function:time-one-and-only:<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xspa:1.0:resource:org:hoursofoperation:end" DataType="http://www.w3.org/2001/XMLSchema#time"/>
:::result=23:59:00-08:00
Mar 30, 2009 3:38:25 PM org.jboss.security.xacml.sunxacml.cond.Apply evaluate
FINE: Function:urn:oasis:names:tc:xacml:1.0:function:time-less-than-or-equal:<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-one-and-only">
<EnvironmentAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-time" DataType="http://www.w3.org/2001/XMLSchema#time"/>
</Apply>
::<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-one-and-only">
<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xspa:1.0:resource:org:hoursofoperation:end" DataType="http://www.w3.org/2001/XMLSchema#time"/>
</Apply>
:::result=false
Mar 30, 2009 3:38:25 PM org.jboss.security.xacml.sunxacml.cond.Apply evaluate
FINE: Function:urn:oasis:names:tc:xacml:1.0:function:not:<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-less-than-or-equal">
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-one-and-only">
<EnvironmentAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-time" DataType="http://www.w3.org/2001/XMLSchema#time"/>
</Apply>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-one-and-only">
<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xspa:1.0:resource:org:hoursofoperation:end" DataType="http://www.w3.org/2001/XMLSchema#time"/>
</Apply>
</Apply>
:::result=true
Mar 30, 2009 3:38:25 PM org.jboss.security.xacml.sunxacml.cond.Apply evaluate
FINE: Function:urn:oasis:names:tc:xacml:1.0:function:or:<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:not">
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-greater-than-or-equal">
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-one-and-only">
<EnvironmentAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-time" DataType="http://www.w3.org/2001/XMLSchema#time"/>
</Apply>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-one-and-only">
<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xspa:1.0:resource:org:hoursofoperation:start" DataType="http://www.w3.org/2001/XMLSchema#time"/>
</Apply>
</Apply>
</Apply>
::<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:not">
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-less-than-or-equal">
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-one-and-only">
<EnvironmentAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-time" DataType="http://www.w3.org/2001/XMLSchema#time"/>
</Apply>
<Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:time-one-and-only">
<ResourceAttributeDesignator AttributeId="urn:oasis:names:tc:xspa:1.0:resource:org:hoursofoperation:end" DataType="http://www.w3.org/2001/XMLSchema#time"/>
</Apply>
</Apply>
</Apply>
:::result=true
Mar 30, 2009 3:38:25 PM org.jboss.security.xacml.sunxacml.combine.DenyOverridesRuleAlg combine
FINE: Rule id:urn:oasis:names:tc:xspa:1.0:org:hoursofoperation:deny:result=1
=============================

This is very good debug information.


User Guide: http://www.jboss.org/auth/jbosssecurity/docs/jbossxacml/html/jbossxacml.html

JBossXACML 2.0.3.CR3 released

The next iteration of JBossXACML in the 2.0.3 is available now. It can be downloaded from the downloads page here:
http://www.jboss.org/jbosssecurity/downloads/JBoss%20XACML

====================
Release Notes for JBoss Security and Identity Management
Includes versions: JBossXACML_2.0.3.CR3

** Sub-task
* [ SECURITY-390 ] JBossXACML: ResourceLocator

** Feature Request
* [ SECURITY-388 ] JBossXACML: AttributeLocator

** Bug
* [ SECURITY-391 ] JBossXACML: PDP construction should be one time

** Task
* [ SECURITY-392 ] Release JBossXACML 2.0.3.CR3
=========================================

That is the release notes.

Improvements in 2.0.3.CR3:
* Support for specifying Attribute Locators and Resource Locators.
* Minor performance improvement where the internal pdp is constructed one time rather than at each request evaluation.

What are Attribute Locators?
Attribute Locators are consulted when the Policy specifies certain attributes to be necessary for evaluation and the the request comes without the required attribute. In that case, the PDP is going to ask the attribute locator for a value for the attribute to make an evaluation. Again, remember the attribute locator is driven by the POLICY and not the REQUEST.

Procedure for Attribute Locators:

• Write a subclass of org.jboss.security.xacml.locators.AttributeLocator
• The following methods need to be overridden in your attribute locator
  * @see AttributeFinderModule#findAttribute(String, org.w3c.dom.Node, URI, org.jboss.security.xacml.sunxacml.EvaluationCtx, String)
  * @see AttributeFinderModule#findAttribute(URI, URI, URI, URI, org.jboss.security.xacml.sunxacml.EvaluationCtx, int)
• Then specify the attribute locator in your configuration file as shown in the example below.
  
  

Resource Locators
These are used in the Hierarchical Profile if you decide to use it.

Configuration File

=================================
<ns:jbosspdp xmlns:ns="urn:jboss:xacml:2.0">
<ns:Policies>
<ns:PolicySet>
<ns:Location>test/policies/interop/xacml-policySet.xml</ns:Location>
<ns:Policy>
<ns:Location>test/policies/interop/xacml-policy2.xml</ns:Location>
</ns:Policy>

<ns:Policy>
<ns:Location>test/policies/interop/xacml-policy3.xml</ns:Location>
</ns:Policy>
<ns:Policy>
<ns:Location>test/policies/interop/xacml-policy4.xml</ns:Location>
</ns:Policy>

<ns:Policy>
<ns:Location>test/policies/interop/xacml-policy5.xml</ns:Location>
</ns:Policy>

</ns:PolicySet>
</ns:Policies>
<ns:Locators>
<ns:Locator Name="org.jboss.security.xacml.locators.JBossPolicySetLocator"/>

<ns:Locator Name="org.jboss.test.security.xacml.locators.TestAttributeLocator">
<ns:Option Name="identifier">test-attrib</ns:Option>
<ns:Option Name="attributeDesignatorSupport">true</ns:Option>
<ns:Option Name="attributeSelectorSupport">true</ns:Option>
<ns:Option Name="attributeDesignatorInt">0</ns:Option>
<ns:Option Name="attributeDesignatorInt">1</ns:Option>
<ns:Option Name="attributeDesignatorInt">2</ns:Option>
<ns:Option Name="attributeSupportedId">urn:oasis:names:tc:xacml:1.0:action:action-id</ns:Option>
<ns:Option Name="attributeSupportedId">http://www.w3.org/2001/XMLSchema#string</ns:Option>
<ns:Option Name="attributeSupportedId">urn:xacml:2.0:interop:example:subject:buy-offer-price</ns:Option>
<ns:Option Name="attributeSupportedId">urn:oasis:names:tc:xacml:1.0:subject:subject-id</ns:Option>
</ns:Locator>

<ns:Locator Name="org.jboss.test.security.xacml.locators.TestResourceLocator">
<ns:Option Name="identifier">test-resource</ns:Option>
<ns:Option Name="resourceChildSupport">true</ns:Option>
<ns:Option Name="resourceDescendantSupport">true</ns:Option>
</ns:Locator>

</ns:Locators>
</ns:jbosspdp>
=================================

The "Option" element tags are got from AbstractLocator interface.
http://anonsvn.jboss.org/repos/jbossas/projects/security/security-xacml/tags/2.0.3.CR3/jboss-xacml/src/main/java/org/jboss/security/xacml/interfaces/AbstractLocator.java

------------------------

   String IDENTIFIER_TAG = "identifier";
 
  String ATTRIBUTE_DESIGNATOR_SUPPORT_TAG = "attributeDesignatorSupport";
 
  String ATTRIBUTE_SELECTOR_SUPPORT_TAG = "attributeSelectorSupport";
 
  String ATTRIBUTE_SUPPORTED_ID_TAG = "attributeSupportedId";
 
  String ATTRIBUTE_DESIGNATOR_INTEGER_TAG = "attributeDesignatorInt";
 
  String RESOURCE_CHILD_SUPPORTED_TAG = "resourceChildSupport";
 

  String RESOURCE_DESCENDANT_SUPPORTED_TAG = "resourceDescendantSupport";

================================


User Forum: http://www.jboss.org/index.html?module=bb&op=viewforum&f=49

JBossXACML 2.0.3.CR1 released

I would like to announce the availability of JBossXACML v2.0.3.CR1 release. You can get to it from the downloads page here:
JBossXACML Download

What does this have over the last v2.0.2.SP1 release?
* Bug fixes.
* Consolidation of jboss-xacml.jar and jboss-sunxacml.jar into one jar - jbossxacml.jar
* Discontinuation of the jboss-xacml-saml.jar as this functionality is currently provided by JBossIdentity.

As always, please provide feedback at the user forum.

FAQ:
1) How do I use this CR1 jar in AS5.x?
AS5.0.0.GA and 5.0.1.GA contain the v2.0.2.SP1 release of JBossXACML. Just replace the jboss-xacml.jar and jboss-sunxacml.jar from common/lib directory with the jbossxacml.jar

2) Are there any tutorials?
http://java.dzone.com/articles/fine-grained-web-authorization

Summary Review: Oasis XACML Interoperability Event at the RSA Conference 2008

Now that the RSA Conference 2008 has finished in San Francisco, I would like to take some time to inform you about the grand success of the Oasis XACML Interoperability event with JBoss/RedHat and other interoperability participants namely BEA Systems, IBM, Oracle, Sun, Axiomatics, Cisco and Department of Veteran Affairs.

Information from the Oasis site is here.

The press release for the event from Oasis is here.

The code that has undergone two successful consecutive Oasis XACML Interoperability Event will be soon (matter of days) as JBossXACML v2.0.2.GA. The pending item is some documentation on usage. This library will also be included in the JBoss AS 5.0 to provide xacml capabilities.

References:
1) PolicySets used in the interop.
2) Tests used for the interop.

Details:
In a nutshell, XACML is a language focused solely on Access Control. All it does is Access Control and nothing else. Given this, at the interoperability event, the VA folks came out with health care scenarios associated with Patient Privacy. There are HL7 Confidentiality Codes that can be associated with Patient medical records.

Let me give some examples:
1) Your neighbor is a doctor and is snoopy in nature. You certainly do not want him to have access to your medical records. Would you? As a patient, you can associate the UBA confidentiality code with a list of doctors that you do not want to have access to your records (dissent list).
2) A patient arrives at a facility in an emergency. The providers do not have access to the patient records that is housed at another facility. They can trigger an "emergency override" to get access to the records. Shouldn't they in an emergency?
3) A patient can decide to mask a portion of his medical records (eg. radiology tests ' results) from a list of providers.

The VA developed an excellent application that had a decent GUI and in the background, it interacted with its own PIP (Policy Information Point) to derive the attributes needed to create the XACML requests. Once the xacml requests were generated (based on the application interaction), then they were passed to the PDP (Policy Decision Point) of the vendors.

Summary:
A simulated health care application with real medical records' data that was driven by xacml based use cases.

Additional References:
Oasis XACML Interoperability Document Bundle
^^^^^ (VERY IMPORTANT RESOURCE) ^^^^

Samples:
The following are examples of SAML2 payload carrying XACML request/responses.

Here is a sample of the request coming from the health care web application to back end PDP.

<?xml version="1.0" encoding="UTF-8"?>
<samlp:RequestAbstract Destination="destination-uri" 
ID="s2846efb514a944cc3dc5b65ed8a76dde449787617" 
IssueInstant="2008-03-19T22:18:42Z" Version="2.0" 
xacml-samlp:InputContextOnly="true" xacml-samlp:ReturnContext="true" 
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" 
xmlns:xacml-samlp="urn:oasis:xacml:2.0:saml:protocol:schema:os" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xacml-samlp:XACMLAuthzDecisionQueryType">
<saml:Issuer 
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">vaPepEntity</saml:Issuer>
<xacml-context:Request xmlns="urn:oasis:names:tc:xacml:2.0:context:schema:os" 
xmlns:xacml-context="urn:oasis:names:tc:xacml:2.0:context:schema:os" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:schemaLocation="urn:oasis:names:tc:xacml:2.0:context:schema:os 
http://docs.oasis-open.org/xacml/access_control-xacml-2.0-context-schema-os.xsd">


<xacml-context:Subject>
<xacml-context:Attribute 
AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" 
DataType="http://www.w3.org/2001/XMLSchema#string">
<xacml-context:AttributeValue>Dr. Alice</xacml-context:AttributeValue>
</xacml-context:Attribute>
<xacml-context:Attribute 
AttributeId="urn:va:xacml:2.0:interop:rsa8:subject:hl7:permission" 
DataType="http://www.w3.org/2001/XMLSchema#string">
<xacml-context:AttributeValue>urn:va:xacml:2.0:interop:rsa8:hl7:prd-003
</xacml-context:AttributeValue>
<xacml-context:AttributeValue>urn:va:xacml:2.0:interop:rsa8:hl7:prd-005
</xacml-context:AttributeValue>
<xacml-context:AttributeValue>urn:va:xacml:2.0:interop:rsa8:hl7:prd-006
</xacml-context:AttributeValue>
<xacml-context:AttributeValue>urn:va:xacml:2.0:interop:rsa8:hl7:prd-009
</xacml-context:AttributeValue>
<xacml-context:AttributeValue>urn:va:xacml:2.0:interop:rsa8:hl7:prd-010
</xacml-context:AttributeValue>
<xacml-context:AttributeValue>urn:va:xacml:2.0:interop:rsa8:hl7:prd-012
</xacml-context:AttributeValue>
<xacml-context:AttributeValue>urn:va:xacml:2.0:interop:rsa8:hl7:prd-017
</xacml-context:AttributeValue>
</xacml-context:Attribute>
</xacml-context:Subject>

<xacml-context:Resource>
<xacml-context:Attribute 
AttributeId="urn:oasis:names:tc:xacml:1.0:resource: resource-id" 
DataType="http://www.w3.org/2001/XMLSchema#string">
<xacml-context:AttributeValue>Anthony Gurrola</xacml-context:AttributeValue>
</xacml-context:Attribute>
<xacml-context:Attribute 
AttributeId="urn:va:xacml:2.0:interop:rsa8:resource:hl7:permission" 
DataType="http://www.w3.org/2001/XMLSchema#string">
<xacml-context:AttributeValue>urn:va:xacml:2.0:interop:rsa8:hl7:prd-003
</xacml-context:AttributeValue>
<xacml-context:AttributeValue>urn:va:xacml:2.0:interop:rsa8:hl7:prd-005
</xacml-context:AttributeValue>
<xacml-context:AttributeValue>urn:va:xacml:2.0:interop:rsa8:hl7:prd-006
</xacml-context:AttributeValue>
<xacml-context:AttributeValue>urn:va:xacml:2.0:interop:rsa8:hl7:prd-009
</xacml-context:AttributeValue>
<xacml-context:AttributeValue>urn:va:xacml:2.0:interop:rsa8:hl7:prd-010
</xacml-context:AttributeValue>
<xacml-context:AttributeValue>urn:va:xacml:2.0:interop:rsa8:hl7:prd-012
</xacml-context:AttributeValue>
<xacml-context:AttributeValue>urn:va:xacml:2.0:interop:rsa8:hl7:prd-017
</xacml-context:AttributeValue>
</xacml-context:Attribute>

<xacml-context:Attribute 
AttributeId="urn:va:xacml:2.0:interop:rsa8:resource:hl7:confidentiality-code" 
DataType="http://www.w3.org/2001/XMLSchema#string">
<xacml-context:AttributeValue>xxx-DummyConfCode</xacml-context:AttributeValue>
</xacml-context:Attribute>
<xacml-context:Attribute 
AttributeId="urn:va:xacml:2.0:interop:rsa8:resource:hl7:dissented-subject-id" 
DataType="http://www.w3.org/2001/XMLSchema#string">
<xacml-context:AttributeValue>Dr. Alice</xacml-context:AttributeValue>
</xacml-context:Attribute>
<xacml-context:Attribute 
AttributeId="urn:va:xacml:2.0:interop:rsa8:resource:hl7:type" 
DataType="http://www.w3.org/2001/XMLSchema#string">
<xacml-context:AttributeValue>
urn:va:xacml:2.0:interop:rsa8:resource:hl7:medical-record</xacml-context:AttributeValue>
</xacml-context:Attribute>
</xacml-context:Resource>
<xacml-context:Action/>
<xacml-context:Environment>
<xacml-context:Attribute 
AttributeId="urn:va:xacml:2.0:interop:rsa8:environment:locality" 
DataType="http://www.w3.org/2001/XMLSchema#string">
<xacml-context:AttributeValue>Facility A</xacml-context:AttributeValue>
</xacml-context:Attribute>
</xacml-context:Environment>
</xacml-context:Request>
</samlp:RequestAbstract>

Now a sample of a response (which does include the xacml request for which the response is)

<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" 
ID="response-id:1" Version="2.0" 
IssueInstant="2008-03-19T22:17:13Z">
<samlp:Status xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
<samlp:StatusCode  xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
Value="urn:oasis:names:tc:xacml:1.0:status:ok">
</samlp:StatusCode>
</samlp:Status>
<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" 
Version="2.0" ID="response-id:1" IssueInstant="2008-03-19T22:17:13Z">
<saml:Issuer>issuer-1</saml:Issuer>
<saml:Statement xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"  
xsi:type="xacml-samlp:XACMLAuthzDecisionStatementType" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"   
xmlns:xacml-samlp="urn:oasis:xacml:2.0:saml:protocol:schema:os"
xmlns:xacml-saml="urn:oasis:names:tc:xacml:2.0:saml:assertion:schema:os" >
<xacml-context:Response xmlns:xacml-context="urn:oasis:names:tc:xacml:2.0:context:schema:os" >
<xacml-context:Result >
<xacml-context:Decision>Permit</xacml-context:Decision>
<xacml-context:Status>
<xacml-context:StatusCode Value="urn:oasis:names:tc:xacml:1.0:status:ok"></xacml-context:StatusCode>
<xacml-context:StatusMessage>ok</xacml-context:StatusMessage> 
</xacml-context:Status>
<xacml:Obligations  xmlns:xacml="urn:oasis:names:tc:xacml:2.0:policy:schema:os" >
<xacml:Obligation ObligationId="obligation-10" FulfillOn="Permit">
</xacml:Obligation>
<xacml:Obligation ObligationId="obligation-20" FulfillOn="Permit">
<xacml:AttributeAssignment AttributeId="a-120" 
DataType="http://www.w3.org/2001/XMLSchema#string" 
xmlns:xacml="urn:oasis:names:tc:xacml:2.0:policy:schema:os"/>
</xacml:Obligation>
</xacml:Obligations>
</xacml-context:Result>
</xacml-context:Response>

<xacml-context:Request xmlns:xacml-context="urn:oasis:names:tc:xacml:2.0:context:schema:os"  
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance/" 
xsi:schemaLocation="urn:oasis:names:tc:xacml:2.0:context:schema:os 
http://docs.oasis-open.org/xacml/access_control-xacml-2.0-context-schema-os.xsd">
<Subject SubjectCategory="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject">
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:subject:subject-id" 
DataType="http://www.w3.org/2001/XMLSchema#string" >
<AttributeValue>100001</AttributeValue>
</Attribute>
<Attribute AttributeId="urn:va:names:xacml:2.0:subject:role" 
DataType="http://www.w3.org/2001/XMLSchema#string" >
<AttributeValue>Chief Resident</AttributeValue>
<AttributeValue>Doctor</AttributeValue>
</Attribute>
<Attribute AttributeId="urn:va:names:xacml:2.0:subject:hl7permission" 
DataType="http://www.w3.org/2001/XMLSchema#string" >
<AttributeValue>PRD-017</AttributeValue>
<AttributeValue>PRD-003</AttributeValue>
<AttributeValue>PRD-010</AttributeValue>
<AttributeValue>PRD-006</AttributeValue>
</Attribute>
<Attribute AttributeId="urn:va:names:xacml:2.0:subject:locality" 
DataType="http://www.w3.org/2001/XMLSchema#string" >
<AttributeValue>Facility A</AttributeValue>
</Attribute>
</Subject>
<xacml-context:Resource>
<Attribute AttributeId="urn:va:names:xacml:2.0:record_type" 
DataType="http://www.w3.org/2001/XMLSchema#string" >
<AttributeValue>patientchart</AttributeValue>
</Attribute>
</xacml-context:Resource>
<xacml-context:Action>
<Attribute AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" 
DataType="http://www.w3.org/2001/XMLSchema#string" >
<AttributeValue>read</AttributeValue>
</Attribute>
</xacml-context:Action>
<xacml-context:Environment></xacml-context:Environment>
</xacml-context:Request>

</saml:Statement>
</saml:Assertion>
</samlp:Response> 

Reference:
Oasis XACML Interoperability (RSA Conference 2008)

NOTE:If you need additional info, do not hesistate to email me at "asaldhan at redhat dot com" <======

JBossXACML v2.0.2.GA released

Note: JBossXACML v2.0.3.CR1 is here. <=======

After a very successful interoperability at the Oasis XACML Interoperability event at the RSA Conference 2008, I released the v2.0.2.GA libraries of JBossXACML. The JIRA issue is SECURITY-193.

What should be expected in 2.0.2.GA libraries?
1) Oasis XACML v2.0 core.
2) SOAP v1.1/SAML2.0Payload carrying XACML requests/response capabilities (Using OpenSAML v2.0).
- We will have packaged servlets for usage. :)
3) JAXB v2.0 Object Model to deal with policies, requests etc (if not interested in dealing with xml).

Stay tuned.

Additionally, as part of the Open Console or Embedded Console of JBoss AS5, we should have a decent free xacml editor to create policy sets (in the works now).

Where should I look for the files to download?
http://www.jboss.org/jbosssecurity/download/index.html

Information:
Wiki: http://wiki.jboss.org/wiki/JBossXACML

My appreciation to Marcus Moyses for all the help he rendered during the pre-interop preparation. Marcus is leading our xacml console effort.

Testimonials

April 24, 2008

The demo is now operational, so no code changes are necessary at the moment. We started from a commercial product that did not meet expectations. In fourteen days effort we were able to retarget and deliver using JBossXACML, mainly by closely following the JBossXACML test cases. I am very happy we discovered the alternative, and it is much more robust than the commercial alternative. Well done!

UPDATE: November 16, 2008
I know that many folks out there in the community and the industry are making use of JBossXACML. I would really like to know if JBossXACML has been useful to you. So please drop me a note at (Anil dot Saldhana at redhat dot com) if you find JBossXACML useful. When people find OSS projects useful, it gives its developers satisfaction. CHEERS!!!