Attribute based access control - Revision history

DavidStables: DavidStables moved page Discovery ABAC language to Attribute based access control

2020-12-27T12:51:03Z

DavidStables moved page Discovery ABAC language to Attribute based access control

← Older revision	Revision as of 12:51, 27 December 2020
(No difference)

DavidStables: /* Syntax as a language */

2020-08-10T08:50:09Z

Syntax as a language

← Older revision		Revision as of 08:50, 10 August 2020
Line 64:		Line 64:
	'''MatchIntersection :=''''Intersection' '''MatchUnion\|MatchIntersection\|{Match}'''		'''MatchIntersection :=''''Intersection' '''MatchUnion\|MatchIntersection\|{Match}'''

	'''Match:= ''''Subject' \| 'Resource' \| 'Action' \| 'Environment' ['''Mandatory] Attribute'''		'''Match:= ''''Match'''<nowiki/>' ''''Subject' \| 'Resource' \| 'Action' \| 'Environment' ['''Mandatory] Attribute'''

	'''Mandatory := ''''Mandatory' 'true\|false'		'''Mandatory := ''''Mandatory' 'true\|false'

	'''Attribute :=''' ''~~Any object or data property from the semantic ontology~~ '''{AttributeValue~~}''~~'''		'''Attribute :=''' '''AttributeType''' '''AttributeValue [DataType]'''

	'''AttributeValue:= Literal ~~[DataType]~~ \| {Attribute}'''		'''AttributeType:''' ''Any object property or data property from the semantic ontology''

			'''DataType:= ''''DataType' ''Any data type from the semantic ontology''

			'''AttributeValue:= Literal \| {Attribute}'''

	'''Policy := ''''Policy' '''iri name [description] Effect [CombiningAlgorithm] {Target} {Rule} {Obligation}'''		'''Policy := ''''Policy' '''iri name [description] Effect [CombiningAlgorithm] {Target} {Rule} {Obligation}'''

DavidStables: /* Syntax as a language */

2020-08-10T08:34:36Z

Syntax as a language

← Older revision		Revision as of 08:34, 10 August 2020
Line 58:		Line 58:
	'''CombiningAlgorithm := ''''CombiningAlgorithm' 'deny-overrides' \| 'permit-overrides'		'''CombiningAlgorithm := ''''CombiningAlgorithm' 'deny-overrides' \| 'permit-overrides'

	'''Target:= ''''Target' '''{~~Category~~}'''		'''Target:= ''''Target' '''MatchUnion\|MatchIntersection\|{Match}'''

	'''~~Category~~:= ''''Subject' \| 'Resource' \| 'Action' \| 'Environment' ['''Mandatory] Attribute'''		'''MatchUnion :=''''Union' '''MatchUnion\|MatchIntersection\|{Match}'''

			'''MatchIntersection :=''''Intersection' '''MatchUnion\|MatchIntersection\|{Match}'''

			'''Match:= ''''Subject' \| 'Resource' \| 'Action' \| 'Environment' ['''Mandatory] Attribute'''

	'''Mandatory := ''''Mandatory' 'true\|false'		'''Mandatory := ''''Mandatory' 'true\|false'
Line 116:		Line 120:
	\|-		\|-
	\|'''Target'''		\|'''Target'''
	\|An index consisting of a set of attributes and values used to indicates that a policy set or policy or rule is the target of a request. The target is itself is a rule in that if the attributes and values match, and no other condition is placed up it, then the policy can make a decision at that point.		\|An index consisting of a set of matches of attributes and values used to indicates that a policy set or policy or rule is the target of a request. The target is itself is a rule in that if the attributes and values match, and no other condition is placed up it, then the policy can make a decision at that point.
			Target attributes are evaluated as single attributes, union of attributes or intersection of attributes. A list of matches is considered an intersection (all of) by default
			\|
			\|
			\|-
			\|'''Union'''
			\|Indicates an OR against the ensuing match list. The term "Any of" is used in XACML but the term Union is used to align with Owl and set approaches
	\|		\|
	\|		\|

DavidStables: /* Syntax as a language */

2020-08-10T08:04:38Z

Syntax as a language

← Older revision		Revision as of 08:04, 10 August 2020
Line 60:		Line 60:
	'''Target:= ''''Target' '''{Category}'''		'''Target:= ''''Target' '''{Category}'''

	'''Category:= ''''Subject' \| 'Resource' \| 'Action' \| 'Environment' '''Attribute'''		'''Category:= ''''Subject' \| 'Resource' \| 'Action' \| 'Environment' ['''Mandatory] Attribute'''

			'''Mandatory := ''''Mandatory' 'true\|false'

	'''Attribute :=''' ''Any object or data property from the semantic ontology '''{AttributeValue}'''''		'''Attribute :=''' ''Any object or data property from the semantic ontology '''{AttributeValue}'''''
Line 115:		Line 117:
	\|'''Target'''		\|'''Target'''
	\|An index consisting of a set of attributes and values used to indicates that a policy set or policy or rule is the target of a request. The target is itself is a rule in that if the attributes and values match, and no other condition is placed up it, then the policy can make a decision at that point.		\|An index consisting of a set of attributes and values used to indicates that a policy set or policy or rule is the target of a request. The target is itself is a rule in that if the attributes and values match, and no other condition is placed up it, then the policy can make a decision at that point.
			\|
			\|
			\|-
			\|'''Mandatory'''
			\|indicates whether the attributes being tested must be present in order for the policy to return an indeterminate outcome or simple an empty collection
	\|		\|
	\|		\|

DavidStables at 09:32, 9 August 2020

2020-08-09T09:32:45Z

← Older revision		Revision as of 09:32, 9 August 2020
Line 3:		Line 3:
	The language is used to support some of the data access authorisation processes as described in the specification - [[Identity Authentication Authorisation\|Identity, authentication and authorisation]] .		The language is used to support some of the data access authorisation processes as described in the specification - [[Identity Authentication Authorisation\|Identity, authentication and authorisation]] .

	This article specifies the scope of the language , the grammar and the syntax, together with examples. Whilst presented as a JSON syntax, in line with other components of the information modelling language, the syntax can also be accessed via the [https://github.com/endeavourhealth-discovery/InformationManager/blob/master/datafiles/schema/IMDocument.xsd Information model XSD schema]on the ~~discovery Github~~, and example content viewed in the [https://github.com/endeavourhealth-discovery/InformationManager/tree/master/datafiles/json information manager data files folder]		This article specifies the scope of the language , the grammar and the syntax, together with examples. Whilst presented as a JSON syntax, in line with other components of the information modelling language, the syntax can also be accessed via the [https://github.com/endeavourhealth-discovery/InformationManager/tree/master/datafiles/schema ABAC xml schema] which includes the baseline [https://github.com/endeavourhealth-discovery/InformationManager/blob/master/datafiles/schema/IMDocument.xsd Information model XSD schema]on the Endeavour GitHub, and example content viewed in the [https://github.com/endeavourhealth-discovery/InformationManager/tree/master/datafiles/json information manager data files folder]

	== Scope of ABAC language and approach ==		== Scope of ABAC language and approach ==
Line 43:		Line 43:

	=== Syntax as a language ===		=== Syntax as a language ===
	The language is represented in BNF notation with terminals in ' '. non terminals in '''bold face''',zero or more as { }, zero or one as [ ], alternatives as '\|' and ''descriptions in italics''		The language is represented here in BNF notation with terminals in ' '. non terminals in '''bold face''',zero or more as { }, zero or one as [ ], alternatives as '\|' and ''descriptions in italics''

	A JSON representation directly follows the syntax with the tokens or values in their relevant name value JSON space		A [https://github.com/endeavourhealth-discovery/InformationManager/tree/master/datafiles/schema JSON representation] conforming to an XML schema directly follows the syntax with the tokens or values in their relevant name value JSON space

	<div style="border:dotted">		<div style="border:dotted">
	'''iri :=''' a''n iri either as a full iri or an abbreviated iri where namespace prefixes are declared by the PIP''		'''iri :=''' a''n iri either as a full iri or an abbreviated iri where namespace prefixes are declared by the PIP''

	'''Literal :''' ''a finite sequence of characters in which " (U+22) and \ (U+5C) occur only in pairs of the form \" (U+5C, U+22) and \\ (U+5C, U+5C), enclosed in a pair of " (U+22) characters. The data type of the literal is determined by the range of the data type property as defined in the ontology.''		'''Literal :''' ''a finite sequence of characters in which " (U+22) and \ (U+5C) occur only in pairs of the form \" (U+5C, U+22) and \\ (U+5C, U+5C), enclosed in a pair of " (U+22) characters. The data type of the literal is determined by the range of the data type property as defined in the ontology, optionally specified at instance level''

			'''DataType: ''''DataType' '''iri'''

	'''PolicySet :=''' 'PolicySet' '''iri name [description] CombiningAlgorithm {PolicySet} {Target} {Policy}'''		'''PolicySet :=''' 'PolicySet' '''iri name [description] CombiningAlgorithm {PolicySet} {Target} {Policy}'''
Line 62:		Line 64:
	'''Attribute :=''' ''Any object or data property from the semantic ontology '''{AttributeValue}'''''		'''Attribute :=''' ''Any object or data property from the semantic ontology '''{AttributeValue}'''''

	'''AttributeValue:= Literal \| {Attribute}'''		'''AttributeValue:= Literal [DataType] \| {Attribute}'''

	'''Policy := ''''Policy' '''iri name [description] Effect [CombiningAlgorithm] {Target} {Rule} {Obligation}'''		'''Policy := ''''Policy' '''iri name [description] Effect [CombiningAlgorithm] {Target} {Rule} {Obligation}'''
Line 163:		Line 165:
	\|'''Result'''		\|'''Result'''
	\|Result of the request Indeterminate would suggest an error in policy authoring. Unknown or not applicable means that no policy has been found. How the application operates in these circumstances will be a matter of non computable IG policy.		\|Result of the request Indeterminate would suggest an error in policy authoring. Unknown or not applicable means that no policy has been found. How the application operates in these circumstances will be a matter of non computable IG policy.
			\|
			\|
			\|-
			\|'''DataType'''
			\|Indicates the data type of the literal when used as an attribute value
			\|
			\|
			\|-
			\|'''Attribute'''
			\|A property iri together with its value
	\|		\|
	\|		\|

DavidStables: /* Language tokens */

2020-08-06T16:02:43Z

Language tokens

← Older revision		Revision as of 16:02, 6 August 2020
Line 87:		Line 87:
	</div>		</div>

			=== Documentation of tokens ===
	The following table documents the tokens		The following table documents the tokens
	{\| class="wikitable"		{\| class="wikitable"

DavidStables: /* Language tokens */

2020-08-06T16:02:09Z

Language tokens

@@ Line 41: / Line 41: @@
 The main classes are illustrated in the diagram on the right.
 The language is represented in BNF notation with terminals in '  '. non terminals in '''bold face''',zero or more as { }, zero or one as [  ], alternatives as '|' and ''descriptions in italics''
@@ Line 64: / Line 66: @@
 '''Policy := ''''Policy' '''iri name [description] Effect [CombiningAlgorithm] {Target} {Rule} {Obligation}'''
-'''Effect:= '<nowiki/>'''Effect'  '''<nowiki/>''''Permit' | 'Deny'
+'''Effect:= ''''Effect'  '''<nowiki/>''''Permit' | 'Deny'
 '''Rule:= ''''Rule' ''SPARQL where/ filter clause assuming ?Subject ?Resource etc as parameters where abbreviated iris mus have namespace prefixes declared''
@@ Line 75: / Line 77: @@
 '''Parameter:=Literal'''
 </div>
@@ Line 137: / Line 147: @@
 |'''AccessResource'''
 |Indicates that the application is requesting access to a resource.
+|
+|

DavidStables: /* Language tokens */

2020-08-06T15:52:22Z

Language tokens

Show changes

DavidStables: /* Language tokens */

2020-08-06T14:54:20Z

Language tokens

← Older revision		Revision as of 14:54, 6 August 2020
Line 43:		Line 43:
	The language is represented in BNF notation		The language is represented in BNF notation

	<div style="border:~~solid~~">		<div style="border:dotted">
	<br />		<br />
	</div>		</div>

DavidStables: /* Language tokens */

2020-08-06T14:54:04Z

Language tokens

← Older revision		Revision as of 14:54, 6 August 2020
Line 33:		Line 33:
	== Language tokens ==		== Language tokens ==
	[[File:ABAC policy classes.jpg\|thumb\|Main ABAC policy structures]]		[[File:ABAC policy classes.jpg\|thumb\|Main ABAC policy structures]]
	A set of classes represent the language of policies. Each class ~~type~~ is also a token in the language. Some of the classes are modelled as concept structures and thus inherit the main concept property of IRI, name description.		A set of classes represent the language of policies. Each class name is also a token in the language. Some of the classes are modelled as concept structures and thus inherit the main concept property of IRI, name description.

	Each business related property of each class is also a token.		Each business related property of each class is also a token.

	Attributes identifiers and value identifiers are pragmatically modelled as IRIs in the semantic ontology and are used in the objects at run time, therefore are not inherently tokens.		Attributes identifiers and value identifiers are pragmatically modelled as IRIs in the semantic ontology and are used in the objects at run time, therefore are not inherently tokens.

			The main classes are illustrated in the diagram on the right.

	The language is represented in BNF notation		The language is represented in BNF notation