X A C M Light Reference

1. Introduction.

XACMLight is an Axis2 [1] web service that implements a Policy Decision Point (PDP) and a Policy Administration Point (PAP) that are defined in XACML 2.0 [2] specification. This implementation covers all functions that are defined by XAMCL 2.0 (including optional), all mandatory elements and almost all optional features. The current implementation has been successfully tested against XACML 2.0 conformance test suite [10] : all applicable tests have been completed successfully.

2. Implemented Features and Limitations.

The following mandatory features defined in XACML 2.0 have been implemented:

1. Mandatory functions
2. All mandatory elements
3. All mandatory data types
4. Intrinsic XACML attributes:
1. urn:oasis:names:tc:xacml:1.0:environment:current-time
2. urn:oasis:names:tc:xacml:1.0:environment:current-date
3. urn:oasis:names:tc:xacml:1.0:environment:current-dateTime

The following optional XACML features have been implemented:

1. Multiple results
2. <MissingAttributeDetail> element
3. <StatusMessage> element
4. <StatusDetail> element
5. <AttributeSelector> element
6. Optional functions

The first optional feature above is very useful from practical point of view because it allows evaluating multiple resources in a single XACML request, the next three are very helpful for understanding what is wrong with authorization request and/or policy when the engine returns a 'Indeterminate' result.

XACMLight uses JDK 1.5 XPath implementation for implementing the following optional functions and elements:

1. <AttributeSelector>
2. xpath-node-count
3. xpath-node-equal
4. xpath-node-match

It means that the version of XPath is determined by the version of this particular implementation and the version provided in <PolicyDefaults> and <PolicySetDefaults> will be ignored.

2.1. Policy, Policy Set References and Local Repo.

XACML 2.0 doesn't define how references to policies and policy sets should be resolved. It says only that if reference is a URL a reference MAY be resolved. XACMLight uses the following strategy to resolve references:

2.2. Configuration File.

The name of default configuration file is gryb_info_xacml_config.xml. It must be placed to an Axis2 CLASSPATH (e.g. to AXIS2_HOME directory) to be available for XACMLight service. The XSD schema for this file is defined in xacml.wsdl file and contains the following elements:

1. <Config> - the root element of configuration file. It can contain one <Policy> or one <PolicySet> element inside.
2. <Repo> - this element is described in section 2.1

3. Supported Platforms.

Since XACMLight is implemented as an Axis2 service, it can run on native Axis2 Apache server or on any other J2EE compliant container using Axix2 war file that allows deploying aar files to other application servers. The current implementation has been tested with the native Axis2 server only.

4. WSDL Operations.

WSDL for XACMLight was built using XML schema definitions provided by OASIS ([8]-[9]). The latter schema definitions use abstract XML types and substitution groups that are not handled well by Apache Data Binding Frameworks ([5]-[6]). The following WSDL operations have been defined in XACMLight's WSDL and implemented in the scope of this project:

where XML namespaces are defined as follows:

5. Binary Installation.

It would be sufficient to copy the authz.aar file to $AXIS2_HOME/repository/services directory to make the service working. However, it's recommended to validate the deployment by running a test that is included to the installation. The following steps will conduct a shake-up test and validate the service:

6. Building from Sources.

XACMLight is a Maven2 [3] project and Maven2 must be installed before the service could be built. The building machine should have access to Internet because Maven will download dependency from online repositories. The following steps will allow to build the project:

6.1. Useful Scripts.

The following useful scripts could be found in <xacmllight>/bin directory of source distribution. Please check the source to find out what the parameters and their default values are.

6.2. Axis2 Limitations and Bugs.

The following problems have been found in Axis2 framework in the process of XACMLight implementation:

7. Source and Binary Locations.

7.1. Version 'SNAPSHOT' Locations.

7.2. Other version locations.

The following versions are available: 2.0, 2.1, 2.2. The latest and recommended stable version is 2.2. The table below provides locations for SVN, source and binary distributions:

* Replace <ver> with a version number to get a real URL.

8. Test Cases.

8.1. Internal Tests

The main test can be performed by calling send.sh authz1.xml (or send.bat authz1.xml) script from <xacmllight>/bin directory. It will send the authorization request for 10 resources to PDP engine. On UNIX/Linux it will also restart the Axis2 server. On Windows starting/stopping of Axis2 server should be done manually.

To test PAP/PDP engines use following commands:

   send.sh <path-to-file> <service-url> <wsdl-operation>

The valid <path-to-file> and <wsdl-operation> values are provided in table below:

The location of XML sample files:

1. Source distribution: <xacmllight>/authz/src/main/resources
2. Binary distribution: <xacmllight>/test

The URLs for PAP/PDP engines are provided below (assuming that Axis2 server runs on the local machine):

8.2. XACML 2.0 Conformance Tests.

To test PAP/PDP engines against official XACML conformance tests [10] use the following command:

   perl test.pl  <XACML-conformance-test-dir> 2>test.txt
   where <XACML-conformance-test-dir> - a directory with conformance tests
   text.tx - the results of tests

8.2.1 Mandatory Test Results.

The total number of tests was: 333, out of which 328 where successful, 5 were not applicable. The notes on some mandatory tests are provided below:

8.2.2 Optional Test Results.

The total number of optional tests was: 44. All of them have been completed successfully using test.pl utility described above.

9. References.