Access Control and Markup Languages Pages 183 – 187 in the CISSP 1
Mark-up languages A way to structure text and data sets Control how it looks and some of the functionality 2
XML As the web grew, we needed additional functionality beyond HTML Foundational standard providing a structure for other independent mark-up languages XML is like English and independent standards may be something like the difference between a lawyer's vocabulary and a doctor's vocabulary – different, but with the same underlying root. XML for identity management and access control purposes SPML SAML XACML 3
XML for identity management and access control purposes Service Provisioning Markup Language (SPML) Allows for the exchange of provisioning data between applications & the automation of user management Three main entities Requesting Authority Provisioning Service Provider (software that responds to requests) Provisioning Service Target (carries out requests on the system) See page 185 for a diagram 4
Security Assertion Markup Language (SAML) Allows for the exchange of authentication and authorization data (ex. password, key, digital certificate) Does NOT tell the receiving system how to interpret this data Provides the authentication pieces to federated identity management systems Transmission of SAML data is typically done over Simple Object Access Protocol (SOAP) See Figure 3-8 on page 186 Allows for Service Oriented Architecture (SOA) A way to provide independent services residing on different systems in one consistent manner 5 XML for identity management and access control purposes
Extensible Access Control Markup Language (XACML) Express security policies and access rights Access policies are developed in XACML but enforced through the software Policies can be installed on multiple systems to ensure consistent security enforcement and management 3 Elements Subject (Requesting Entity) Resource (Requested Entity) Action (Type of access) 6 XML for identity management and access control purposes