Re: [xacml-users] Handle Multiple Users/Subjects

At first I want to say thank you for the fast replies!

The more tricky question is how to design the policies that handle these requests. You will probably not be able to do that with Target element alone, instead you will need to use Condition elements.I think this will be the main part of my research to describe the right multi user policies for our need. 

Can Alice and Bob both do X? --> Permit

Can Alice do X? Can Bob do X? Permit, Permit

Can Alice who is also Bob do X? Permit

I would say it’s a mix out of 

Can Alice and Bob both do X? --> Permit

and 

Can Alice who is also Bob do X? Permit

But it’s good to hear that my idea with modelling the multiple users as attribute is a possible approach. 

Best regards

Arno 

Am 09.01.2018 um 17:56 schrieb David Brossard <>:

Hi Arno,

When you model your request, do you intend to ask:

Can Alice and Bob both do X? --> Permit

Can Alice do X? Can Bob do X? Permit, Permit

Can Alice who is also Bob do X? Permit

This will help us determine how you would model the authorization request and policies.

David

On Tue, Jan 9, 2018 at 10:40 AM, Ludwig Seitz <> wrote:
On 2018-01-09 17:14, Arno Appenzeller wrote:

Hi,

I’m researching about Multi User Authorisation and decided to work on a prototype with XACML.

In the Core Spec there is a paragraph about Multiple Subjects. But if I get it right it’s more about multiple Subjects in terms of one Access-Subject which uses a Programm (as another subject) to access resource X.

In my reserach I consider the scenario where Bob and Alice are both on one system and want to access a resource.

I have several ideas how to realise this but I’m not sure if I miss a fundamental point in XACML.

Is it supported that two access-subjects request one resource in a single request?

Best regards,

Arno

I am assuming that you are referring to XACML 3.0 in my answer, the answer might be a bit different for 2.0 (too lazy to think it through).

There is nothing in the standard to prohibit you from putting multiple access-subject attributes in the request, describing both Alice and Bob.

Note that you shouldn't put them in separate <Attributes> elements, since that would trigger the Multiple Decision Profile (if your implementation supports it).

The more tricky question is how to design the policies that handle these requests. You will probably not be able to do that with Target element alone, instead you will need to use Condition elements.

Hope this helps.

/Ludwig

-- 

Ludwig Seitz, PhD

Security Lab, RISE SICS

Phone +46(0)70-349 92 51

---------------------------------------------------------------------

To unsubscribe, e-mail: 

For additional commands, e-mail: 

-- 

David Brossard
VP of Customer Relations

+1 312 774-9163

+1 502 922 6538

+46(0)760 25 85 75

Axiomatics | 525 W. Monroe Suite 2310 | Chicago 60661

Support: https://support.axiomatics.com 
Web: http://www.axiomatics.com

Axiomatics Blog | Events | Resources, Webinars & Whitepapers

Connect with us on LinkedIn | Twitter | Google + | Facebook | YouTube