authorization.theory.txt

                 
   AUTHORIZATION  
                 



DIFFERENT PARTS ==>               #Subject:
                                  #  - who performs the action, e.g. user
                                  #  - can be organized in groups
                                  #Permission:
                                  #  - abstract set of operations, e.g. updateTags
                                  #Operation:
                                  #  - concrete action on an object, i.e. in application code, e.g. openUpdateTagsPage
                                  #Object:
                                  #  - resource the operation acts upon
                                  #Policy:
                                  #  - subject + permission + object
                                  #Most of the above have n-n relationship to each other

WHAT POLICY CHECKS ==>            #RBAC ("role-based access control") checks roles:
                                  #  - are like subject groups
                                  #  - assigned temporarily ("assumed") during a "session", e.g. during authentication
                                  #  - can have multiple roles
                                  #  - can have parent role (tree hierarchy)
                                  #  - can make some roles exclusive to each other ("separation of duties")
                                  #ABAC ("Attribute-based access control"):
                                  #  - checks subject's attributes, e.g. USER.nationality or USER.age
                                  #Operation's attributes:
                                  #  - e.g. updating a specific attribute, or updating it to a specific value
                                  #  - can be the request, but also the response
                                  #Object's attributes:
                                  #  - e.g.:
                                  #     - object.id: implied by using ACL
                                  #     - object's owner: often used by ACL
                                  #     - object.locked {boolean}
                                  #Context:
                                  #  - time, place, user agent, host (HBAC), etc.
                                  #  - intent (IBAC): why request originated
                                  #  - emotion (EBAC): subject state of mind
                                  #Rule-based access control (called RBAC too):
                                  #  - combination of any of the above
                                  #Latice-based access control (LBAC):
                                  #  - like rule-based, but with logic related to combining several subjects, permissions or objects
                                  #  - e.g. permission allowed to subjectA, but not if together with subjectB

POLICIES INTERACTION ==>          #Whitelist vs blacklist, and their interaction
                                  #Default policy if none defined (allow|deny)

WHERE POLICY CAN BE STORED ==>    #In the system:
                                  #  - statically (e.g. hardcoded in application code)
                                  #  - dynamically (e.g. in a database)
                                  #On the objects instances:
                                  #  - ACL ("access-control list") made of ACEs ("access-control entry")
                                  #Capability:
                                  #  - in secret token

POLICIES MANAGEMENT ==>           #Example of actions on policies:
                                  #  - creating
                                  #  - reading, sharing
                                  #  - updating
                                  #  - full|partial deleting
                                  #Can be performed:
                                  #  - MAC ("mandatory access control"): by system, not users, i.e. centralized
                                  #  - DAC ("discretionary access control"): by users, not system, i.e. decentralized
                                  #Often coupled with where policy is stored:
                                  #  - usually in system for MAC
                                  #  - usually in objects or capabilities for DAC