Anil Saldhana [https://community.jboss.org/people/anil.saldhana] created the discussion "Re: Get something started with XACML - Requirements Discussion" To view the discussion, visit: https://community.jboss.org/message/647185#647185 -------------------------------------------------------------- Hi Dan,  I am sorry I have not been able to answer your posts.  Been busy with JBoss AS7.  Let me answer you in a bit. -------------------------------------------------------------- Reply to this message by going to Community [https://community.jboss.org/message/647185#647185] Start a new discussion in PicketBox Development at Community [https://community.jboss.org/choose-container!input.jspa?contentType=1&...]

Dan Gradl [https://community.jboss.org/people/dgradl] created the discussion "Re: Get something started with XACML - Requirements Discussion" To view the discussion, visit: https://community.jboss.org/message/647501#647501 -------------------------------------------------------------- I obviously agree on the need for a GUI policy administration point.    There's too much work involved to implement xacml based access control without it.  I also think that people won't see value in XACML when all that is there is a decision engine.  There are commercial XACML implementations out there... they don't neccessarily even promote the XACML name, but they are full solutions and they are obviously seeing use in various places such as in the finance industry.  Like I may have mentioned to you before, I implemented XACML at a large bank and we looked at the products because there was no open source alternative, and building and maintaining something like that ourself didn't make sense.    I'd definitely be interested to work towards creating a more complete open source XACML solution.   It would seem, however, that given the low interest it would end up being me running solo on it.  At least until it had enough features to be more interesting to others.   -------------------------------------------------------------- Reply to this message by going to Community [https://community.jboss.org/message/647501#647501] Start a new discussion in PicketBox Development at Community [https://community.jboss.org/choose-container!input.jspa?contentType=1&...]

Christian QD93S7 [https://community.jboss.org/people/ceebee] created the discussion "Re: Get something started with XACML - Requirements Discussion" To view the discussion, visit: https://community.jboss.org/message/752902#752902 -------------------------------------------------------------- Hi, what I see is that there are COTS solutions, that are conceptually not much further on the "adoption curve"... We need a good pap implementation that is tailorable to the domain experts, to their vocabulary. The role of the "policy modeller" is not very well described up to now. It is not an IT admin, it is more the Service Manager. So we build a kind of eclipse rcp app that consumes a dsl to generate XACML and distributes it on a set of preconfigured pdps... May be requirements analysis helps us to understand, why the standard is still not widely used. ->cb -------------------------------------------------------------- Reply to this message by going to Community [https://community.jboss.org/message/752902#752902] Start a new discussion in PicketBox Development at Community [https://community.jboss.org/choose-container!input.jspa?contentType=1&...]

Christian QD93S7 [https://community.jboss.org/people/ceebee] created the discussion "Re: Get something started with XACML - Requirements Discussion" To view the discussion, visit: https://community.jboss.org/message/753046#753046 -------------------------------------------------------------- the policy modeller as part of the info security team- interesting point. I thought the possible advantage of XACML -besides from interop- is the ability to change and adapt existing access rules while the system is running, i.e. is already developed. So if we restrict the ability to change the rules to specialized people, it tends to get adjusted one time or twice in the lifecycle of the software. It is not much different from hardcoding the rules in the software. If we really want to use the advantage, we need to enable the business guys to understand what happens. But I haven't seen such a system working. So as you describe it - this organization has some procedure to work with "meta-rules" and then they give the order to change to the security team. The question is, how often occur changes ? But even if you have specialized people- the policysets get big and complex and so the GUI should really be able to structure them according to different perspectives (like eclipse perspectives) There might be an application perspective, an organization perspective, a dictionary. It is a special kind of rule management system. There have been various attempts to write good editors, see http://www.tfgordon.de/publications http://www.tfgordon.de/publications. But it is worth a try. -------------------------------------------------------------- Reply to this message by going to Community [https://community.jboss.org/message/753046#753046] Start a new discussion in PicketBox Development at Community [https://community.jboss.org/choose-container!input.jspa?contentType=1&...]