Access Controller: Authorization and Authentication

Author: Michael Wechner (michael.wechner@lenya.org)
Created: 2001.11.30
Version: 2002.01.22

Contents

  1. Cocoon2
    1. sitemap.xmap
    2. Remarks
  2. Authorization
    1. Abstract Authorizer
    2. PML (Policy Markup Language) Authorizer
    3. XACML Authorizer
  3. Authentication
    1. Abstract Authenticator
    2. Abstract Username-Password Authenticator
    3. IML (Identity Markup Language) Authenticator
    4. RDB Authenticator
    5. LDAP Authenticator
  4. Related Resources

Cocoon2

sitemap.xmap

<map:pipelines>
  <map:pipeline>
    <map:match pattern="**">
      <map:act type="authorizer">
        <map:parameter name="log" value="off"/> <!-- URI history per client -->
        <map:parameter name="public" value="identify;authenticate"/>
        <map:parameter name="concrete-authorizer" value="org.apache.lenya.cms.ac.PMLAuthorizer"/>
        <!--<map:parameter name="concrete-authorizer" value="org.oasis-open.xacml.Authorizer"/>-->

        <map:match pattern="identify">
          <map:generate/>
          <map:transform src="stylesheets/login.xsl"/>
          <map:serialize/>
        </map:match">

        <map:match pattern="authenticate">
          <map:act type="authenticator">
            <map:parameter name="log" value="on"/>
            <map:parameter name="concrete-authenticator" value="org.apache.lenya.cms.ac.IMLAuthenticator"/>
            <!--<map:parameter name="concrete-authenticator" value="org.apache.lenya.cms.ac.LDAPAuthenticator"/>-->

            <map:redirect-to uri="{protected_destination}" session="true"/>
          </map:act>
          <map:redirect-to uri="identify" session="true"/>
        </map:match">

        <!-- you finally made it -->
        <map:match pattern="**">
          <map:read src="resources/html/permission-granted.html" mime-type="text/html"/>
        </map:match">

      </map:act>
      <map:redirect-to uri="identify" session="true"/>
    </map:match>
  </map:pipeline>
</map:pipelines>

Remarks:

Authorizer

The authorizer should be exchangeable.

PML (Policy Markup Language) Authorizer

Example PML-Document "levi.iml.pml":
<?xml version"1.0"?>
<policy>
  <object match="/">
    <subjects>
      <machine ip="127.0.0.1">
        <actions>
          <read/>
        </actions>
      </machine>

      <user id="levi">
        <actions>
          <read/>
        </actions>
      </user>

      <group id="useradministrator">
        <actions>
          <read/>
          <write/>
        </actions>
      </group>
    </subjects>
  </object>

  <object match="/identity/password">
    <subjects>
      <user id="levi">
        <actions>
          <write/>
        </actions>
      </user>
    </subjects>
  </object>
</policy>

Authenticator

The authenticator should be exchangeable.
Example 1: org.apache.lenya.cms.ac.IMLAuthenticator (donald.iml)
Example 2: org.apache.lenya.cms.ac.LDAPAuthenticator (LDAP on central server)

The authenticator should be able to negotiate the encryption method with the requestor.

The authenticator should be able to communicate with the authorizer. This is for instance necessary in the case of conditional authorization:
Example: For the user "levi" all requests shall be logged by the authorizer. For the user "anonymous" only "permission denied requests" shall be logged.

IML (Identitity Markup Language) Authenticator

Example IML-Document "levi.iml":
<?xml version"1.0"?>
<identity>
  <password type="md5">sdsdsds6868fy8678sd68</password>
  <comment>Levi Brucker</comment>
  <groups>
    <group>editor</group>
  </groups>
  <expire>
    <year>2001</year>
  </expire>
</identity>

Related Resources

XACML
XML Access Control