Fine-grained authorization with PIP points - WSO2 IS

Use Case Scenario :-

•User ‘john’ trying to get READ access by using his user id.

•Authorization should be given by validating the user id against user name, requesting use name information via PIP point.

•PIP requesting information from a web service.

Now lets see how to implement this use case scenario.

1 ) First of all you need to have the jax-rs service implemented.

Refer the blog post : http://umeshagunasinghe.blogspot.com/2013/09/how-to-create-jax-rs-service-using-wso2.html

2) Then you need to deploy it in the application server.

Refer the blog post: http://umeshagunasinghe.blogspot.com/2013/09/how-to-deploy-jax-rs-service-in-wso2.html

3) Then you have to write the PIP :http://umeshagunasinghe.blogspot.com/2013/10/how-to-write-pip-point-for-wso2-is.html

4) Now, register it in the Identity Server : http://umeshagunasinghe.blogspot.com/2013/10/how-to-register-pip-in-wso2-is.html

5) Write the XACML policy : http://umeshagunasinghe.blogspot.com/2013/10/how-to-write-simple-xacml-policy-in.html

6) You can use the TryIt tool in Identity Server as the PEP to test the XACML policy

:http://umeshagunasinghe.blogspot.com/2013/10/how-to-use-try-it-tool-in-wso2-is.html

7) You need to expose the entitlement service of the IS and then send request via SoapUI (you can also configure WSO2 ESB to further enhance the use case ) 

http://umeshagunasinghe.blogspot.com/2013/10/how-to-expose-entitlement-service-in.html

Fine grained xacml authorization with pip points from Umesha Gunasinghe

Thank You!

How to expose the entitlement service in WSO2 Identity Server and send requests via SoapUI

Hi All,

First lets talk about how to expose the entitlement service in the Identity Server.

1) Go to <IS HOME>\wso2is-4.5.0\repository\conf and open the carbon.xml.

2) Change <HideAdminServiceWSDLs> to false as follows.

3) Start the Identity Server.

4) Copy and paste the following url on the browser address bar.

https://localhost:9444/services/EntitlementService?wsdl

If you have saved the settings correctly , you should be able to view the entitlement server wsdl.

5) Save the wsdl file.

Now lets see how to use the wsdl and SoapUI to send requests.

1) Open SoapUI.

2) Go to File in top menu bar and select New SoapUI Project.

3) Give a project and browse for the wsdl file.

4) Then click OK and the simple requests for all operations will be created automatically.

5) Then Select getDecisionByAttributes request as follows.

6) Then fill in the parameter details as follows for our xacml policy we have written.

7) Then you have to authorize the request by entering authorization values as admin , admin for username and password respectively.

Now you can send the request and check for the decisions. The Permit is received as the decision only when the user id 124 trying to READ.

In the next post we will look at a use case scenario where fine grained authorization achieved via xacml engine in WSO2 IS 4.5.0 with PIP points.

Thank you!

How to use the TryIt tool in WSO2 IS

Lets try out the xacml policy we have written using WSO2 IS TryIt tool.

Login to IS and go to PEP > TryIt

Lets look at the picture above and understand the input values for xacml request.

Here we are using the TryIt tool as the Policy Enforcement Point in XACML engine.

We are trying to send the request and enforce the policy and get the policy decision from PEP.

Lets fill out the input values as follows in the tool :-

1) Resource - the service name you have given in the policy

2) Subject Name :- the user trying to access . Here, we are sending the user id of the user, where the policy send the request to PIP to get the user informaiton

3) Action - We are mentioning the action of the user in this case is READ

4) Environment Name - since we haven't mentioned any in the policy , we do not have to input it here

Now lets look at the Request created by the TryIt tool. Click on the Create Request button.

 The request is created with the values we have filled out.

Now lets Evaluate with PDP to get the decision. Click on Evaluate with PDP button.

You can see the decision is Permit.

You can go back and try to evaluate with different input values and see the decision of the PDP.

The policy only permits when user id 124 trying to READ.

Thank you and see you all soon :)