IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Difference between Access Control Policies

    Posted 10/06/20 06:32 AM
    There are different ways to configure a Access Control Policy:
    1. Secure Access Control -> Policy -> Access Control -> Create a Policy
    2. Secure Federation -> Global Settings -> Access Policies -> Add

    What is the difference between them?

    ------------------------------
    Joao Goncalves
    Pyxis, Lda.
    Sintra
    +351 91 721 4994
    ------------------------------


  • 2.  RE: Difference between Access Control Policies

    Posted 10/06/20 07:10 AM
    Joao,

    Despite their (unfortunately) similar names, these are two independent things.

    Secure Access Control-->Policy: Access Control-->Create Policy is where you create what I call a "Context-based Access Policy".
    Secure Federation --> Global Settings: Access Policies --> Add is where you create what I would call a "Federation Access Policy"

    A "Context-based Access policy" allows fine-grained authorization to be applied to resources (URLs) being accessed via the Reverse Proxy.  These policies are created with a policy editor in the UI.  They are (under the covers) implemented in XACML.  These policies have access to the user credential, information extracted from the HTTP request, and can call out for additional context using "Policy Information Points".  I covered these policies at the Master Skills University event (as part of the presentation on risk-based access).  Also covered here: https://www.securitylearningacademy.com/course/view.php?id=5018

    A "Federation Access policy" allows an access decision to be made during the Identity Provider processing of a SAML 2.0 or OIDC flow.  In addition to the authenticated user information, the policy has access to information about the federation definition and the federation request (including things like requested authentication level from partner).  These policies are written in JavaScript.  There is a section on Access Policies in this course on SLA: https://www.securitylearningacademy.com/course/view.php?id=3307

    I hope this helps,

    Jon.


    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------



  • 3.  RE: Difference between Access Control Policies

    Posted 10/07/20 04:09 PM
    Apparently there are multiple ways to configure the policies, and I would like to understand how the work.
    There are the base policies (ACL, POP).
    Then we add Context-Based policies which are a feature of AAC.
    Then we have Federation policies.

    If I connect to ISAM, which policy is evaluated first? And how are they merged?

    ------------------------------
    Joao Goncalves
    Pyxis, Lda.
    Sintra
    +351 91 721 4994
    ------------------------------

    Original Message


  • 4.  RE: Difference between Access Control Policies

    Posted 10/08/20 05:42 AM
    Hi Joao,

    When you request a resource via Reverse Proxy, it checks policy items in this order:

    1. ACL
    2. POP
    (3. Authzn Rules - not sure you're using these)
    4. Context-based Access Policy (call out to AAC for decision)

    If all of these policies allow access then the request will be passed to the requested resource.

    An "Federation Access Policy" is not invoked from the Reverse Proxy.  It is invoked within the AAC Federation runtime.  So, it comes after all of the other policies listed above.

    These policies are not merged.  They must all be passed for access to be granted.

    Jon.

    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------

    Original Message


Related Content