During Gartner’s recent IAM conference, I noticed an emerging conversation around the issues of API usage at the enterprise level. Enterprise adoption of APIs is viewed as an inevitable consequence of the ongoing digital transformation many IT professionals are managing. API stands for
This use case happens in many different industries, such as: Banking: account management Healthcare: medical record access There are other types of delegation possible, e.g. a parent-child delegation. For instance, as a parent, I want access to my underage children’s medical records. This
This year’s Gartner IAM Conference was full of thoughtful keynotes and a reflection of things to come for IT professionals in 2017. Over 1500 professionals concerned with keeping customer and proprietary data more secure attended the conference last week, which took place in Las Vegas, Nevada,
Some examples of policies are: Managers can view documents in their city Users can edit documents they own Each policy uses attributes. In the examples above, the policies use the following attributes: A user’s role e.g. manager An action e.g. view, edit. A resource type e.g.
We have written in the past about using time in XACML policies. This can be useful when wanting to control access outside office hours for instance. Sometimes, we also want to use dates to achieve similar and complementary use cases. Using the Date Datatype in XACML The Date Datatype XACML
Break the Glass Scenario By default users have access to what they need to get access to. Example authorization policy: doctors can view the medical records of their patients. Sometimes, though, in the case of an emergency, users need access to information they don't normally have access