Subject: Re: [Ace] Access Control Lists in CoAP

From: "Hannes Tschofenig" <[email-masked]>
Date: Tue, 14 Jan 2014 14:34:37 +0100 (CET)

Hi Ludwig,

I forgot to respond to this mail.

The XACML statistics you see are mostly a marketing trick. What big companies selling identity management servers do is to bundle many of the protocols together (whether you need it or not).

Then, these boxes may internally use something like XACML (like Nokia used the OMA SUPL protocol between their Nokia phones and their Nokia-operated location server).

The question we have to deal with here is where is the need for interoperability. Do you get away without specifying a language that describes your access control decisions. FreeRADIUS also uses an access control policy language but it does not require interoperability.

In fact it turns out that the security functionality is an important part of product stickiness and so there is little incentive for companies selling identity products to have individual parts exchangable. Therefore, they claim to be standards compliant but then they have all sorts of extensions that it does not work well in a real-world environment.

Just search for "XACML is dead"  and you will see lots of discussions from last year about the "success' of XACML and how vendors and "independent" consultants react to those.

In any case, what is important here for this group is not whether XACML is a good protocol or not. I think we all agree that it is completely unsuitable for the IoT context.

In the discussions I have understood that some folks want to standardize the "offline case", as I call it, where a device wants to request resources on a server and the server does not, in real-time, reaches out to some backend database/policy decision point/etc.

This unfortunately requires some form of policy to be conveyed. Whether the minimalistic approach of OAuth is the right way (with the scopes) or whether something like a KeyNote http://tools.ietf.org/html/rfc2704 or something else I don't really know. The group will have to figure it out based on some real-world use cases.

Ciao

Hannes

Gesendet: Dienstag, 17. Dezember 2013 um 10:08 Uhr

Von: "Ludwig Seitz" <[email-masked]>

An: Kein Empfänger

Cc: [email-masked]

Betreff: Re: [Ace] Access Control Lists in CoAP

On 12/16/2013 09:58 PM, Hannes Tschofenig wrote:

> Very good question, Paul.

> Historically, standardizing access control policies has not been very

> successful (neither in the IETF nor in other organizations).

Sorry, but this is just wrong.

Just have a look at XACML and the list of companies using it [1] (and

that list is hardly up to date).

There are several companies selling XACML products (including Oracle,

IBM, Quest, NextLabs, and Axiomatics).

If you look at e.g. the Axiomatics customer list [2] a lot of companies

are buying these products (e.g. Bank of America, PayPal, Bell

Helicopter, Boeing, the Swedish Public Employment Service, DATEV, Swiss Re).

Identity and Access Management is a very small market and it takes a lot

of convincing to make companies buy anything new in that sector (since

it doesn't affect sales immediately), but I'd claim that

XACML has been very successful as far as standardizing access control

policies goes.

/Ludwig

[1]

https://www.oasis-open.org/committees/download.php/42588/xacmlRefs-V1-85.html#Products

[2] https://axiomatics.com/customers.html

--

Ludwig Seitz, PhD

SICS Swedish ICT AB

Ideon Science Park

Building Beta 2

Scheelevägen 17

SE-223 70 Lund

Phone +46(0)70-349 92 51

http://www.sics.se

_______________________________________________

Ace mailing list

[email-masked]

https://www.ietf.org/mailman/listinfo/ace

---

From: Ludwig Seitz <[email-masked]>
Date: Tue, 14 Jan 2014 14:58:47 +0100

On 01/14/2014 02:34 PM, Hannes Tschofenig wrote:
> The XACML statistics you see are mostly [...] vendors and
> "independent" consultants react to those.

I'll take that discussion another time and off-list, since this would be 
off-topic here.

> In any case, what is important here for this group is not whether XACML
> is a good protocol or not. I think we all agree that it is completely
> unsuitable for the IoT context.

It is clearly unsuitable to expect constrained devices to process XACML, 
what the unconstrained back-end AAA-servers do is a completely different 
question.

I think you are mixing together two things here that should be separate:

Access control policies and statements about authorization decisions.

I'd go as far as saying that it's unrealistic to expect constrained 
devices to evaluate _any_ access control policy that is more complex 
than an ACL. Therefore, if the use case calls for something more 
sophisticated than an ACL we should transfer authorization decisions 
(made by unconstrained AAA servers) to the device and have them enforce 
that decision instead of trying to send them access control policies.

-- 
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2
Scheelevägen 17
SE-223 70 Lund

Phone +46(0)70-349 92 51
http://www.sics.se