XACML, the eXtensible Access Control Markup Language, is an authorization language that implements Attribute­Based Access Control (ABAC). XACML uses attributes inside policies to convey authorization statements. Policy authoring can be an art form and we won’t be getting into every aspect of policy authoring in this article. For a brief overview of what a policy is check this Axiomatics article out.

I’m often asked “Why would I use a policy reference when writing a policy?” There are several reasons why but if I answer them all here I’ll quickly run out of topics for future “Question of the Week” articles. For now let’s start with explaining what a policy reference is. 

The definition of a XACML Policy Reference can be found in the XACML core specification here and here.

In layman’s terms a policy reference is a pointer to another policy set or policy object. Some of the reasons to use a policy reference are:

  • Provide structure and organization>
  • Make a large policy easier to work with
  • Re­use common components at various points within a policy package
  • Enable collaborative policy authoring

Example

Below is an example of policy references generated by the Axiomatics Policy Editor. In this screenshot, we have a parent policy set (Main) which contains 2 policy sets (Internal

Applications and External Applications). The Internal Applications policy set is expanded and contains 3 policy references.  What is a XACML Policy Reference 1

References to other policies.

Policy references can point to policies and policy sets in the same tree or in a separate tree/file.

If we take a look at the Human Resources policy set, we will find a complete policy structure of all the policies and rules needed to support the applications for Human Resources.

What is a XACML Policy Reference 2

View of the referenced Human Resources policy.

XACML XML Representation

The raw xml of the main.xml policy above contains a P olicySetIdReference to a policy with an ID of: B11d213a­2514­46d6­ad6b­295ff8532574. This is a reference to the Human Resources Policy set. 

The main policy xml

Now if we look at the Human Resources.xml we will see that it has a PolicySetId of “b11d213a­2514­46d6­ad6b­295ff8532574.” 

The referenced Human Resources policy xml

XACML Representation in ALFA

In the ALFA example below, we have a main policy which contains 2 branches: one about documents and the other about contracts. Each branch references / links to a common policy called checkTime. 

Linking to policies inside the same file / tree

A policy reference does not need to point to a policy that exists in a separate file or policy tree. A reference can be to to other policies contained in the same tree as illustrated below. What is a XACML Policy Reference 3

Reference to another policy within the same policy file

Conclusion

XACML policy references are essentially pointers to other policies which are used to:

  • Provide structure and organization
  • Make a large policy easier to work with
  • Reuse common components at various points within a policy package
  • Enable collaborative policy authoring

If you’ve ever worked with a large policy and wondered “there must be an easier way!” know you have your answer! Use a policy reference. Not can policy references make managing a large policy easier but they are fun to use. If you haven’t tried using a policy reference it’s time you joined in on the fun and gave them a try.



Leave a Reply

Your email address will not be published. Required fields are marked *