Fine-grained authorization with PIP points - WSO2 IS

Use Case Scenario :-

•User ‘john’ trying to get READ access by using his user id.

•Authorization should be given by validating the user id against user name, requesting use name information via PIP point.

•PIP requesting information from a web service.

Now lets see how to implement this use case scenario.

1 ) First of all you need to have the jax-rs service implemented.

Refer the blog post : http://umeshagunasinghe.blogspot.com/2013/09/how-to-create-jax-rs-service-using-wso2.html

2) Then you need to deploy it in the application server.

Refer the blog post: http://umeshagunasinghe.blogspot.com/2013/09/how-to-deploy-jax-rs-service-in-wso2.html

3) Then you have to write the PIP :http://umeshagunasinghe.blogspot.com/2013/10/how-to-write-pip-point-for-wso2-is.html

4) Now, register it in the Identity Server : http://umeshagunasinghe.blogspot.com/2013/10/how-to-register-pip-in-wso2-is.html

5) Write the XACML policy : http://umeshagunasinghe.blogspot.com/2013/10/how-to-write-simple-xacml-policy-in.html

6) You can use the TryIt tool in Identity Server as the PEP to test the XACML policy

:http://umeshagunasinghe.blogspot.com/2013/10/how-to-use-try-it-tool-in-wso2-is.html

7) You need to expose the entitlement service of the IS and then send request via SoapUI (you can also configure WSO2 ESB to further enhance the use case ) 

http://umeshagunasinghe.blogspot.com/2013/10/how-to-expose-entitlement-service-in.html

Fine grained xacml authorization with pip points from Umesha Gunasinghe

Thank You!

How to write a simple XACML policy in WSO2 IS

We meet again :)

Lets talk about how to write a simple xacml policy in WSO2 IS.

First lets recall our scenario.

Please refer the following links on understanding the scenario.

1) http://umeshagunasinghe.blogspot.com/2013/09/how-to-create-jax-rs-service-using-wso2.html

2) http://umeshagunasinghe.blogspot.com/2013/09/how-to-deploy-jax-rs-service-in-wso2.html

3) http://umeshagunasinghe.blogspot.com/2013/10/how-to-write-pip-point-for-wso2-is.html

4) http://umeshagunasinghe.blogspot.com/2013/10/how-to-register-pip-in-wso2-is.html

We wrote our jax-rs service with users initialized.

Lets say we had 'john' user with user id 124 and another user with user id 125.

Now we have a requirement that we need to permit john to read something.
But nobody else should be able to read it.

So how can we handle this authorization situation?? 

It is really simple to write xacml policies with new user interface provided by WSO2 IS 4.5.0.

Login to IS and go to 

Now lets fill in the necessary information.

1) First give the xacml policy a name

2) Then you can fill in a description

3) Then select on what this policy is based on. For our scenario this based on the resource we have which is the web service that is deployed on the Application Server. Therefore we can select Resource.

4) Then give the resource name
Note that the input values may change on what the policy is based on

5) Now lets focus on the bottom part. We do not intend to give child resource.
Our user is john
The action is READ
you can give an environment even.

Now we have filled the information we need to implement the policy.

You  can follow the following links to get in depth understanding of writing xacml policies in WSO2 IS.

1) http://xacmlinfo.org/2013/09/02/how-write-xacml-policies-1/

2) http://xacmlinfo.org/2013/09/03/how-to-write-xacml-policies-part-2/

3) http://xacmlinfo.org/2013/09/05/how-to-write-xacml-policies-part-3-basic-policy-editor/

After filling the information regarding the xacml policy click on finish button.

Now lets think about what is the purpose of we registered the PIP. The reason because we needed to get user information needed for authorization.
What user information we were trying to access form the web service? It was the username that is given to the user id.

So what we have actually done? We have written a xacml policy to permit READ access to john.

Now, we need to mention in the policy that "Look, you have to give permit 'john' to give READ rights to certain information, but only the user id of john is provided. So you have to verify the user id with the username before giving any permission. You have to look for a PIP to get this information."

But actually we haven't mention in the policy how to get this information.

Lets go do that. Go to 

Home

> Entitlement

> PAP

> Policy Administration

> Policy

Open the policy you have created and you can see the generated policy in editable format.

You can see the information we have given. Check out the user information section. There you have to mention where to get the user information to permit access to john. There you have to mention the attribute Id you have given when you wrote the PIP. In this case it is 'USERNAME'.

Now the policy knows everything :). Go to Policy Administration and Click on Publish to My PDP to publish the policy.

Then click on Publish.

Then go to Policy View and Enable the policy.

Now the policy is all ready. In the next post lets talk about the Try It tool to checkout the policy.

See y'all!

How to create a jax-rs service using WSO2 Developer Studio

Hi All,

Today we are going to talk about how to create a jax-rs service using WSO2 Developer Studio.

First of all you have to download the WSO2 Developer Studio form the WSO2 product page.

Developer studio comes as a plugin for eclips.

Using Developer Studio it is really easy to create the service and deploy.

Once you have WSO2 Developer Studio Downloaded, extract the content to a local folder. Then open eclips.

There you can find “Developer Studio” on the top menu bar and select open dashboard.

Here you have to select JSX-RS Service Project.

Select Create New JAX-RS Service and click Next.

Fill in the project details

Then click on finish.

Then the environment for the jax-rs service project will be created.

Here we are creating a simple service with User Object class and service class to get user information.

You can create a simple user object class as follows with defining it as the root element.

Developer Studio provides the options to auto generate the getters and setters as well.

 

Then you can write the jax-rs service using the object creted as User as follows:-

When you are writing a jax-rs service, the attention should be given to jax-rs annotations.

You can see that the @Path element is set for the service and two @GET methods are written each having the specific @Path defined.

You can follow the below links to read more about jax-rs and xml annoatations:-

1)https://wikis.oracle.com/display/Jersey/Overview+of+JAX-RS+1.0+Features

2)http://docs.oracle.com/javase/7/docs/api/javax/xml/bind/annotation/XmlRootElement.html

3)http://www.techferry.com/articles/RESTful-web-services-JAX-RS-annotations.html

Once the service is completed, you can simply deploy it by right clicking on the project -> and selecting Export Project as Deployable Archive.

Here you can mention the path you want to create the .war file.

See you next time. Cheers!