= `ndg_xacml` = `ndg_xacml` is a XACML 2.0 implementation for [http://ceda.ac.uk CEDA] (the Centre for Environmental Data Archival) STFC, Rutherford Appleton Laboratory. This is follow on work from the NERC (Natural Environment Research Council) !DataGrid 3 Project. [http://www.oasis-open.org/committees/xacml/ XACML] (eXtensible Access Control Mark-up Language), is an XML based language for expressing access control policies. == Current Status == === Version 0.2 === The first Alpha release to PyPI has been made 288 June 2010: Only the parts of the specification immediately required for CEDA have been implemented in this initial release: * Deny overrides and Permit overrides rule combining algorithms * !AttributeDesignators * various function types: see ndg.xacml.core.functions * and attribute types: see ndg.xacml.core.attribute * incomplete support for ``s, ``, ``. `` * includes an !ElementTree based parser for Policies. No support for writing out policies or read/write of XML representation of and The software follows a modular structure to allow it to be extended easily to include new parsers, functions and attribute types. == Installation == {{{ $ easy_install ndg_xacml }}} == Tests and Examples == See `ndg.xacml.test` in the distribution for unit tests and examples. Here is a brief overview of one of the examples... The first use case for the CEDA access control policy is to restrict access based on resource URIs. Rules are defined based on regular expression based matching of these. Access is permitted to a given ''subject'' if they have an entitlement of at least one of the attributes specified in the rule. This is the content of the test policy file: {{{ NDG XACML example for unit tests: allow access for resource URIs matching given regular expressions. The subject must have at least one of a set of named attributes allocated ^http://localhost/.*$ ^http://localhost/test_securedURI.*$ staff admin postdoc ^http://localhost/test_securedURI2$ restricted privileged }}} In the above, the first `` element filters out requests which don't apply to the rules which follow, so if the URI doesn't start with, `http://localhost/` it's ignored. After this a series of rules are specified, the first rule denies accesses to all requests. However, the top-most `` element specifies the so called ''Rule Combining Algorithm'' to permit overrides: {{{ RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:permit-overrides" }}} Any rule which follows for which a match is made grants access. For example, the second rule grants access to any URI which begins with `http://localhost/test_securedURI`, provided the subject (the person or entity requesting access) has at least one of the attributes, `staff`, `admin` or `postdoc`. ---- Philip Kershaw, 28 June 2010