WebApp Sec mailing list archives
Re: Authorization in workflows
From: Yuri Demchenko <demch () chello nl>
Date: Wed, 12 Apr 2006 14:08:20 +0200
Hi Juan, You actually rose quite interesting topic of rather research character.This is especially relevant to Web Services and Grid areas where the major technology development is focused on providing dynamic services. And the workflow is considered as an upper service abstraction layer for such dynamic service provisioning.
Given the workflow is developing quite actively around OASIS BPEL, two issues remains open/unsolved:
- adding security/policy control to the workflow, and- having an access control infrastructure capable to accept changing/dynamic security context.
We are trying to work out both. These two documents may be useful to you:
Using Workflow for Dynamic Security Context Management in Complex Resource Provisioning
http://www.uazone.org/demch/papers/hpdc2006-workflow-dynamic-security-context-03.pdfFilling the Gap with GAAA-P: Gap Analysis of Authorisation technologies and solutions for Optical Light Path Provisioning
http://www.uazone.org/demch/analytic/airg-gp6-ron-gap-aaa-12.pdfWe'll appreciate comments, ideas and cooperation. I will also be ready to answer possible questions.
Regards, Yuri Juan C Calderon wrote:
Hello all I'm making some research on authorization. I'm describing RBAC to secure Web application, however, sometimes web application have more granurar and especial requierements. For example, in a Workflow, authorization to perform an action is not only dependant of user permissions but of worflow item state (you cannot allow aproval on an item if it is not complete even if the user is an approver). So... my question is, do you know about a tool to describe this in a document, something like a well defined "workflow tree methodology" or similar. Thank in advance, Juan Carlos __________________________________________________ Correo Yahoo!Espacio para todos tus mensajes, antivirus y antispam ¡gratis! Regístrate ya - http://correo.espanol.yahoo.com/------------------------------------------------------------------------- This List Sponsored by: SPI DynamicsALERT: "How A Hacker Launches A Web Application Attack!" Step-by-Step - SPI Dynamics White Paper Learn how to defend against Web Application Attacks with real-world examples of recent hacking methods such as: SQL Injection, Cross Site Scripting and Parameter Manipulationhttps://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003gRl --------------------------------------------------------------------------
------------------------------------------------------------------------- This List Sponsored by: SPI DynamicsALERT: "How A Hacker Launches A Web Application Attack!" Step-by-Step - SPI Dynamics White Paper Learn how to defend against Web Application Attacks with real-world examples of recent hacking methods such as: SQL Injection, Cross Site Scripting and Parameter Manipulation
https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003gRl --------------------------------------------------------------------------
Current thread:
- Authorization in workflows Juan C Calderon (Apr 12)
- Re: Authorization in workflows Yuri Demchenko (Apr 12)