Tools for policy generation

[kanchanna]

Do you have documents or tools for policy generation?

[René Eggenschwiler]

Hi,

It depends on what kind of "generation" you mean?
We do not provide a Policy Administration Point (meaning a user interface for policy editing) thats generates policies.
We edit our policies either in XML or use our Java classes (those are very XML-oriented because they are based on JAXB) and do then marshal them to XML.

Maybe you could explain a little bit more on your target or intent?

Best regards,
René

[kanchanna]

Thanks for the reply.
I need some documentation or tutorial on how the policies are created in XML. Do you have any such documentation?

[René Eggenschwiler]

Hi,

How to design policies depends heaviliy on your use case.

Let us make an example by taking natural language as a metapher:
The XACML specification defines the grammar of the policy language and define how to interprete/evaluate it. The vocabulary has to be defined by the writer.

So in my opinion I don't think that you will find a simple "how to write a policy" tutorial that will help you.

I think it will be the easiest way to read through the XACML specification (e.g. http://docs.oasis-open.org/xacml/2.0/access_control-xacml-2.0-core-spec-os.pdf). Especially the non-normative parts (Chapter 1-4) explain XACML very well.
You could also look through example policies you'll find on the internet.

Then I would suggest you to use an XML-Editor that supports schema validation for writing policies by yourself.

Florian has written a thesis that deals about an approach on "how could policies being analysed/developed" (see http://www.herasaf.org/uploads/theses/2008/2008_fall_MasterStudentResearchProject_Analysis_of_Access_Control_Policies.pdf).
He made also a case study in that thesis. Maybe that could help you.

Regards,
René

[kanchanna]

Hi,
Thanks again.

I am looking for some library that would help composition of the policies readily using the subject, subject-attributes, action and resource, resource-attributes fields.

[René Eggenschwiler]

Hi,

Unfortunately we don't have such a convinience API for creating policies.
But you could wirte such a convinience layer based on our policy types in our API.

In another post I made an example for creating requests: http://forum.herasaf.org/index.php/topic,132.msg371.html#msg371
The creation of policies would be analogue for policy types.

You can refer to our javadoc: http://maven.herasaf.org/herasaf-release/org/herasaf/xacml/core/herasaf-xacml-core/1.0.0-M2/herasaf-xacml-core-1.0.0-M2-javadoc.jar
Starting points are PolicyType and PolicySetType. All according types could be found in the package org.herasaf.xacml.core.policy.impl

Best regards,
René

[kanchanna]

Thanks a million. That is helpful.