1. Spocp@nordunet2003 August 20, 2003 Slide 1 A Middleware Service for Policy Based Authorization Presentation at Nordunet 2003 by Roland Hedberg

2. Spocp@nordunet2003 August 20, 2003 Slide 2 Why middleware services ? TODAY: The application portfolio of most corporations are a patchwork of independent systems. FUTURE: To efficiently build and integrate applications using a unified approach and a single platform for application development and integration.

3. Spocp@nordunet2003 August 20, 2003 Slide 3 Key benefits of middleware A common application programming/protocol interface across all platforms Shields from complexity Improve controllability, simpler administration Improve productivity, efficiency and service

4. Spocp@nordunet2003 August 20, 2003 Slide 4 Spocp Simple POlicy Control Pod Swedish/Norwegian development project Started 1 june 2002, will run at least until 31 May 2004 Will be used by the NyA and “Ladok på web” services Will be implemented as the authorization system at Stockholm university

5. Spocp@nordunet2003 August 20, 2003 Slide 5 Spocp – key features Built around a well defined rule syntax (S- expression), no specified semantics Should be possible to model almost any kind of policies Allows for the usage of external information services through 'boundary conditions' Can be placed as 'close' to the application as needed A positive answer can be ackompanied by additional information

6. Spocp@nordunet2003 August 20, 2003 Slide 6 Rule basics Everything that is not explicitly permitted is prohibited Only positive rules exists Every rule allows someone to do something No order between rules A request is granted if there is a rule in the rule database to which the query is a subset

7. Spocp@nordunet2003 August 20, 2003 Slide 7 Lessons learnt so far Sofar we have failed to find policies that can not be translated into S-expression. Seems to be fast enough for the applications tested Technology as usual only part of the game When the number of policies increases and is managed in a decentralized way it is essential that one can test whether the combined policies really expresses what they should. Tools for 'Post mortem' analysis necessary