9:40 a.m.
Hi All,
any objections to getting the Entitlements Manager concept into
PicketLink Authorization? That way we cover all based with both Fine
Grained Authorization (Permissions API/Implementation) as well as
download of entitlements.
My previous prototype:
https://docs.jboss.org/author/display/SECURITY/EntitlementsManager
(there are bugs in the test case which I will fix)
While the FGA is what I call the Enforcement Model, the
EntitlementsManager concept is what I call the Entitlement Model.
I am currently writing a specification at OASIS for this:
https://www.oasis-open.org/committees/document.php?document_id=52098&...
Regards,
Anil
9:43 a.m.
The idea is if rather than make 100 enforcement (Access Checks), you
make one call and download
the entitlements and then do local authorization checks.
As an example, there is a mobile phone that has a rich native app. It
connects to a server and downloads
the entitlements on the fly. That way it can make local decisions as to
what the permissions are, rather than
make individual server access checks. Useful in environments such as
financial apps.
On 01/31/2014 09:40 AM, Anil Saldhana wrote:
Hi All,
any objections to getting the Entitlements Manager concept into
PicketLink Authorization? That way we cover all based with both Fine
Grained Authorization (Permissions API/Implementation) as well as
download of entitlements.
My previous prototype:
https://docs.jboss.org/author/display/SECURITY/EntitlementsManager
(there are bugs in the test case which I will fix)
While the FGA is what I call the Enforcement Model, the
EntitlementsManager concept is what I call the Entitlement Model.
I am currently writing a specification at OASIS for this:
https://www.oasis-open.org/committees/document.php?document_id=52098&...
Regards,
Anil
9:45 a.m.
Another example would be something like Drools Guvnor where the display
of assets needs to be regulated. So instead of checking on individual asset
check, one call is made for the entire permission collection and the UI
is rendered faster.
On 01/31/2014 09:43 AM, Anil Saldhana wrote:
The idea is if rather than make 100 enforcement (Access Checks), you
make one call and download
the entitlements and then do local authorization checks.
As an example, there is a mobile phone that has a rich native app. It
connects to a server and downloads
the entitlements on the fly. That way it can make local decisions as to
what the permissions are, rather than
make individual server access checks. Useful in environments such as
financial apps.
On 01/31/2014 09:40 AM, Anil Saldhana wrote:
> Hi All,
> any objections to getting the Entitlements Manager concept into
> PicketLink Authorization? That way we cover all based with both Fine
> Grained Authorization (Permissions API/Implementation) as well as
> download of entitlements.
> My previous prototype:
> https://docs.jboss.org/author/display/SECURITY/EntitlementsManager
> (there are bugs in the test case which I will fix)
>
> While the FGA is what I call the Enforcement Model, the
> EntitlementsManager concept is what I call the Entitlement Model.
>
> I am currently writing a specification at OASIS for this:
>
https://www.oasis-open.org/committees/document.php?document_id=52098&...
>
> Regards,
> Anil
>
10:05 a.m.
In some way we support that, one just need to use the Permission API to obtain the
permissions and return them back using JSON, for example.
Maybe once we start working with the REST module we can provide that OOTB.
But how entitlements relates with XACML ? Is it a enabler ?
----- Original Message -----
From: "Anil Saldhana" <Anil.Saldhana(a)redhat.com>
To: security-dev(a)lists.jboss.org
Sent: Friday, January 31, 2014 1:45:33 PM
Subject: Re: [security-dev] Entitlements Concept
Another example would be something like Drools Guvnor where the display
of assets needs to be regulated. So instead of checking on individual asset
check, one call is made for the entire permission collection and the UI
is rendered faster.
On 01/31/2014 09:43 AM, Anil Saldhana wrote:
The idea is if rather than make 100 enforcement (Access Checks), you
make one call and download
the entitlements and then do local authorization checks.
As an example, there is a mobile phone that has a rich native app. It
connects to a server and downloads
the entitlements on the fly. That way it can make local decisions as to
what the permissions are, rather than
make individual server access checks. Useful in environments such as
financial apps.
On 01/31/2014 09:40 AM, Anil Saldhana wrote:
> Hi All,
> any objections to getting the Entitlements Manager concept into
> PicketLink Authorization? That way we cover all based with both Fine
> Grained Authorization (Permissions API/Implementation) as well as
> download of entitlements.
> My previous prototype:
> https://docs.jboss.org/author/display/SECURITY/EntitlementsManager
> (there are bugs in the test case which I will fix)
>
> While the FGA is what I call the Enforcement Model, the
> EntitlementsManager concept is what I call the Entitlement Model.
>
> I am currently writing a specification at OASIS for this:
>
https://www.oasis-open.org/committees/document.php?document_id=52098&...
>
> Regards,
> Anil
>
_______________________________________________
security-dev mailing list
security-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/security-dev
10:07 a.m.
On 01/31/2014 10:05 AM, Pedro Igor Silva wrote:
In some way we support that, one just need to use the Permission API
to obtain the permissions and return them back using JSON, for example.
Maybe once we start working with the REST module we can provide that OOTB.
But how entitlements relates with XACML ? Is it a enabler ?
XACML is still and
enforcement model. You get answers (Y/N).
Rather than - here is the Context (user, role, group, time, IP)
and now give me the relevant permissions.
----- Original Message -----
From: "Anil Saldhana" <Anil.Saldhana(a)redhat.com>
To: security-dev(a)lists.jboss.org
Sent: Friday, January 31, 2014 1:45:33 PM
Subject: Re: [security-dev] Entitlements Concept
Another example would be something like Drools Guvnor where the display
of assets needs to be regulated. So instead of checking on individual asset
check, one call is made for the entire permission collection and the UI
is rendered faster.
On 01/31/2014 09:43 AM, Anil Saldhana wrote:
> The idea is if rather than make 100 enforcement (Access Checks), you
> make one call and download
> the entitlements and then do local authorization checks.
>
> As an example, there is a mobile phone that has a rich native app. It
> connects to a server and downloads
> the entitlements on the fly. That way it can make local decisions as to
> what the permissions are, rather than
> make individual server access checks. Useful in environments such as
> financial apps.
>
> On 01/31/2014 09:40 AM, Anil Saldhana wrote:
>> Hi All,
>> any objections to getting the Entitlements Manager concept into
>> PicketLink Authorization? That way we cover all based with both Fine
>> Grained Authorization (Permissions API/Implementation) as well as
>> download of entitlements.
>> My previous prototype:
>> https://docs.jboss.org/author/display/SECURITY/EntitlementsManager
>> (there are bugs in the test case which I will fix)
>>
>> While the FGA is what I call the Enforcement Model, the
>> EntitlementsManager concept is what I call the Entitlement Model.
>>
>> I am currently writing a specification at OASIS for this:
>>
https://www.oasis-open.org/committees/document.php?document_id=52098&...
>>
>> Regards,
>> Anil
>>
>>
3:28 p.m.
On 01/31/2014 10:05 AM, Pedro Igor Silva wrote:
In some way we support that, one just need to use the Permission API
to obtain the permissions and return them back using JSON, for example.
Think so.
Maybe once we start working with the REST module we can provide that
OOTB.
Think so.
But how entitlements relates with XACML ? Is it a enabler ?
----- Original Message -----
From: "Anil Saldhana" <Anil.Saldhana(a)redhat.com>
To: security-dev(a)lists.jboss.org
Sent: Friday, January 31, 2014 1:45:33 PM
Subject: Re: [security-dev] Entitlements Concept
Another example would be something like Drools Guvnor where the display
of assets needs to be regulated. So instead of checking on individual asset
check, one call is made for the entire permission collection and the UI
is rendered faster.
On 01/31/2014 09:43 AM, Anil Saldhana wrote:
> The idea is if rather than make 100 enforcement (Access Checks), you
> make one call and download
> the entitlements and then do local authorization checks.
>
> As an example, there is a mobile phone that has a rich native app. It
> connects to a server and downloads
> the entitlements on the fly. That way it can make local decisions as to
> what the permissions are, rather than
> make individual server access checks. Useful in environments such as
> financial apps.
>
> On 01/31/2014 09:40 AM, Anil Saldhana wrote:
>> Hi All,
>> any objections to getting the Entitlements Manager concept into
>> PicketLink Authorization? That way we cover all based with both Fine
>> Grained Authorization (Permissions API/Implementation) as well as
>> download of entitlements.
>> My previous prototype:
>> https://docs.jboss.org/author/display/SECURITY/EntitlementsManager
>> (there are bugs in the test case which I will fix)
>>
>> While the FGA is what I call the Enforcement Model, the
>> EntitlementsManager concept is what I call the Entitlement Model.
>>
>> I am currently writing a specification at OASIS for this:
>>
https://www.oasis-open.org/committees/document.php?document_id=52098&...
>>
>> Regards,
>> Anil
>>
>>
7:04 a.m.
Am I right assuming that mobile application will pick one entitlement from collection of
entitlements in hand and use it in request
getting a resource/data from service provider?
In case mobile app already has the data and using entitlements locally, what prevent
anybody of modifying the mobile app and render
whatever he wants from the local data?
Or I am wrong and mobile app will download entitlements and then based on them will ask
for data which are covered by entitlements
in hand.
Peter
On 01/31/2014 04:43 PM, Anil Saldhana wrote:
The idea is if rather than make 100 enforcement (Access Checks), you
make one call and download
the entitlements and then do local authorization checks.
As an example, there is a mobile phone that has a rich native app. It
connects to a server and downloads
the entitlements on the fly. That way it can make local decisions as to
what the permissions are, rather than
make individual server access checks. Useful in environments such as
financial apps.
On 01/31/2014 09:40 AM, Anil Saldhana wrote:
> Hi All,
> any objections to getting the Entitlements Manager concept into
> PicketLink Authorization? That way we cover all based with both Fine
> Grained Authorization (Permissions API/Implementation) as well as
> download of entitlements.
> My previous prototype:
> https://docs.jboss.org/author/display/SECURITY/EntitlementsManager
> (there are bugs in the test case which I will fix)
>
> While the FGA is what I call the Enforcement Model, the
> EntitlementsManager concept is what I call the Entitlement Model.
>
> I am currently writing a specification at OASIS for this:
>
https://www.oasis-open.org/committees/document.php?document_id=52098&...
>
> Regards,
> Anil
_______________________________________________
security-dev mailing list
security-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/security-dev
7:50 a.m.
From a server perspective, you can perform additional checks in order
to make sure the client is able to perform a specific operation or retrieve data.
From a mobile perspective, I think depends how the mobile app is
storing sensitive data by using secure/encrypted storage. I think Aerogear is addressing
this ...
----- Original Message -----
From: "Peter Skopek" <pskopek(a)redhat.com>
To: "Anil Saldhana" <Anil.Saldhana(a)redhat.com>,
security-dev(a)lists.jboss.org
Sent: Wednesday, February 5, 2014 11:04:07 AM
Subject: Re: [security-dev] Entitlements Concept
Am I right assuming that mobile application will pick one entitlement from collection of
entitlements in hand and use it in request
getting a resource/data from service provider?
In case mobile app already has the data and using entitlements locally, what prevent
anybody of modifying the mobile app and render
whatever he wants from the local data?
Or I am wrong and mobile app will download entitlements and then based on them will ask
for data which are covered by entitlements
in hand.
Peter
On 01/31/2014 04:43 PM, Anil Saldhana wrote:
The idea is if rather than make 100 enforcement (Access Checks), you
make one call and download
the entitlements and then do local authorization checks.
As an example, there is a mobile phone that has a rich native app. It
connects to a server and downloads
the entitlements on the fly. That way it can make local decisions as to
what the permissions are, rather than
make individual server access checks. Useful in environments such as
financial apps.
On 01/31/2014 09:40 AM, Anil Saldhana wrote:
> Hi All,
> any objections to getting the Entitlements Manager concept into
> PicketLink Authorization? That way we cover all based with both Fine
> Grained Authorization (Permissions API/Implementation) as well as
> download of entitlements.
> My previous prototype:
> https://docs.jboss.org/author/display/SECURITY/EntitlementsManager
> (there are bugs in the test case which I will fix)
>
> While the FGA is what I call the Enforcement Model, the
> EntitlementsManager concept is what I call the Entitlement Model.
>
> I am currently writing a specification at OASIS for this:
>
https://www.oasis-open.org/committees/document.php?document_id=52098&...
>
> Regards,
> Anil
_______________________________________________
security-dev mailing list
security-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/security-dev
_______________________________________________
security-dev mailing list
security-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/security-dev
11:56 a.m.
Imagine a mobile app with many potential functions:
a) Withdraw money
b) Transfer money
c) Trade stocks
d) Deposit money
At a particular instant of time, you can turn on/off these features at
the app level based on the downloaded permission set, rather than check
whether the user has permission for each. The feature set can grow
exponentially and may not be very cost effective from bandwidth/resource
perspective.
Somebody at the server side would have configured the permissions.
On 02/05/2014 07:04 AM, Peter Skopek wrote:
Am I right assuming that mobile application will pick one entitlement
from collection of entitlements in hand and use it in request
getting a resource/data from service provider?
In case mobile app already has the data and using entitlements locally, what prevent
anybody of modifying the mobile app and render
whatever he wants from the local data?
Or I am wrong and mobile app will download entitlements and then based on them will ask
for data which are covered by entitlements
in hand.
Peter
On 01/31/2014 04:43 PM, Anil Saldhana wrote:
> The idea is if rather than make 100 enforcement (Access Checks), you
> make one call and download
> the entitlements and then do local authorization checks.
>
> As an example, there is a mobile phone that has a rich native app. It
> connects to a server and downloads
> the entitlements on the fly. That way it can make local decisions as to
> what the permissions are, rather than
> make individual server access checks. Useful in environments such as
> financial apps.
>
> On 01/31/2014 09:40 AM, Anil Saldhana wrote:
>> Hi All,
>> any objections to getting the Entitlements Manager concept into
>> PicketLink Authorization? That way we cover all based with both Fine
>> Grained Authorization (Permissions API/Implementation) as well as
>> download of entitlements.
>> My previous prototype:
>> https://docs.jboss.org/author/display/SECURITY/EntitlementsManager
>> (there are bugs in the test case which I will fix)
>>
>> While the FGA is what I call the Enforcement Model, the
>> EntitlementsManager concept is what I call the Entitlement Model.
>>
>> I am currently writing a specification at OASIS for this:
>>
https://www.oasis-open.org/committees/document.php?document_id=52098&...
>>
>> Regards,
>> Anil
>>
3953
days inactive
3959
days old
8 comments
3 participants
participants (3)
-
Anil Saldhana -
Pedro Igor Silva -
Peter Skopek