PicketBox XACML v2.0.9.Final Released

PicketBox XACML v2.0.9.Final has been released.

You can download it from http://www.jboss.org/picketbox/downloads

Information available at https://community.jboss.org/wiki/PicketBoxXACMLJBossXACML

Mostly a bug fix release. Except that we have made the PDP evaluation configurable with locks.

Release Notes - PicketBox - Version picketbox_xacml_2.0.9.Final

Bug

• [SECURITY-738] - XACML DatabaseResourceAttributeLocator fails when used with Oracle 11g Driver
• [SECURITY-742] - JBossPDP.evaluate() lock should be flexible

Enhancement

• [SECURITY-734] - Slow policy evaluation with a large number of policy sets

Release

• [SECURITY-743] - Release PicketBox XACML 2.0.9.Final

PicketBox XACML v2.0.6.Final Released

I am pleased to announced the community release of PicketBox XACML v2.0.6.Final.

More details are available at:
http://community.jboss.org/wiki/PicketBoxXACMLJBossXACML

What is new?
1. Core RBAC Profile of XACML v2.0
2. Reading policies by just specifying the directory location in the config file.
3. Bug fixes.

Enjoy.

PicketBox XACML v2.0.5.final from JBoss released

It took some extra time (other priorities took precedence). In the end, it all worked out fine.

LGPL licensed free open source project, PicketBox has released the XACML component v2.0.5.final.   Please download it from PicketBox downloads.


Main Wiki Page


PicketBox XACML Dashboard Wiki Page


Main Features Added (compared to v2.0.4)

• LDAP Based Policy Locator.
• LDAP Based Attribute Locator.
• Database Based Attribute Locator.
• Decision Cache for performance.

JIRA
PicketBox JIRA




JBoss Integration

PicketBox XACML is integrated into JBoss Application Server v5.0 and beyond.  Additionally, it is available as part of the JBoss Enterprise Application Platform (EAP) v5.0 and beyond and JBoss SOA Platform v5.0 and beyond.


Release Notes

** Bug

•     * [SECURITY-452] - Don't use Xalan classes directly. Use Java API instead
•     * [SECURITY-461] - AttributeFinder:findAttribute method can throw an NPE if any of the attribute finder modules return null
•     * [SECURITY-462] - JBossRequestContext should throw IllegalArgumentException for null inputstream
•     * [SECURITY-507] - JBossXACML: anyURI mismatch
•     * [SECURITY-518] - JBossPDP should be serializable

** Feature Request

•     * [SECURITY-454] - Database Attribute Locator
•     * [SECURITY-463] - AttributeValue.getValue abstract method * [SECURITY-455] - LDAP based attribute locator
•     * [SECURITY-456] - File based Attribute Locator
•     * [SECURITY-492] - JBossPolicySetLocator should gracefully handle policies
•     * [SECURITY-516] - Create a LDAP policy provider for JBoss XACML
•     * [SECURITY-521] - Decision Cache for constant XACML Requests
•     * [SECURITY-522] - XACML add hashcode and equals to RequestCtx, Attribute
•     * [SECURITY-525] - XACML Attribute Locator should support comma separated list of attributeSupportedIds                                                                                                         

XACML with ExistDB Integration

I was recently asked about Exist DB support for PicketBox XACML (formerly JBossXACML) mainly to retrieve missing XACML attributes during policy evaluation. The question was asked by one of our beta testers of PicketLink (http://jboss.org/picketlink).

We now have ExistDB integration support for our XACML Engine. You can read about it here:
PicketBox XACML Integration with Exist DB

I think storing xml files (policies) in an XML native database is a fine idea as long as it is a small set.

Project PicketBox (Security for Java Applications)

I would like to introduce you to Project PicketBox, a security framework for Java Application developers.

Project Page: PicketBox


What does it provide?
An API that can provide the following security features:
* Authentication using JAAS.
* Authorization (Coarse Grained and Fine Grained).
* Audit
* Security Mapping.


What is the latest version?
Latest version for download is 3.0.0.Final (http://www.jboss.org/picketbox/downloads )
Since PicketBox is derived out of "JBoss Security" v2.0 code base, we have chosen to start with v3.


Where I can read the documentation?
You can read it here: PicketBox Overview


Does it provide annotations?
Yes, it does provide Security annotations. (PicketBoxSecurityAnnotations)


Who is planning to use PicketBox?
* The Seam Development team has immediate plans to use PicketBox for Seam v3.
* PicketBox will be available in JBoss Application Server v6.0 M3 and beyond.