FIWARE Orion-LD 实体类型的访问控制规则

Question

Is it possible to configure access-control rules for Orion-LD based on the entity type? Or, alternatively, on the presence of some attributes in the entities?

A similar question was asked here: Get a list of all resources accessible to users in FIWARE . The answer seems to imply that in the so-called Advanced Authorization scenario it is possible to achieve something like this by means of XACML filters for broker endpoints, allowing for instance GET access to the endpoint /entities?type=SomeEntityType for certain users. However, this appears like a very brittle solution, since the type query parameter may be preceded by other params in a real-world request. Furthermore, there are other ways to filter resources returned by the /entities endpoint, eg by means of parameters q or attrs (according to the NGSI-LD spec, https://www.etsi.org/deliver/etsi_gs/CIM/001_099/009/01.06.01_60/gs_CIM009v010601p.pdf , see 6.4.3.2), hence separate rules would be needed for all of these and it seems impossible to keep them consistent. Ideally, I would also like GET requests to /entites/{entityId} to be evaluated against the type of the entity, without configuring this individually for every entity.

Am I missing a simple solution to this problem?

Answer 1

This will depend on the capabilities of the PDP you are using. Of course, a flexible XACML-based PDP like Authzforce is able to adjudicate on anything given sufficient information from the PEP, but you could also use something like Open Policy Agent it is just the matter of extracting sufficient information from the payload and passing it on for analysis.

To take the Keyrock/Wilma as an example, they support a payload-based PDP permit/deny decision process. In Keyrock you have 3 different PDP levels - basic , payload and advanced . If you set - IDM_PDP_LEVEL=payload , you can set permissions like this:

Where the type , id and attrs in the payload can be filtered.

Keyrock's basic /user?access_token=..&action=..&resource=.. PDP only covers basic rules, so to check payloads you'll need to switch to use a more advanced PDP. Keyrock's /pdp/xacml handler accepts XACML JSON from a PEP, so Wilma can be configured to use that endpoint instead.

PEP_PROXY_PDP=xacml 
PEP_PROXY_PDP_PROTOCOL=https               
PEP_PROXY_PDP_HOST=<hostname_of_keyrock>            
PEP_PROXY_PDP_PORT=<port of keyrock>              
PEP_PROXY_PDP_PATH=pdp/xacml

Of course this is just an example, the PDP could just as easily be pointed towards Authzforce for adjudication and send over XACML XML. The point is that whichever PDP you decide to use, the PEP needs to be able to extract the right info and pass on a request to your chosen PDP.