Policy Enforcement Service Access Control Services

SANY D2.3.4 Specification of the Sensor Service Architecture V3 Doc.V3.1 Copyright © 2007-2009 SANY Consortium Page 149 of 233

8.3.5 Policy Enforcement Service

Name Policy Enforcement Service Standard Specifications The following standards are by the Policy Enforcement Service: OASIS Security Assertion Markup Language SAML v2.0 OASIS SAML 2.0 profile of XACML v2.0 Description The Policy Enforcement Service is a dedicated policy enforcement point PEP that handles the necessary interaction with Authorisation Service and Authentication Service. The PEP comprises the service independent part of a proxy solution for non-security enabled web services and thus is one important component of non-intrusive web service security for services compliant with the SANY W3C Web Services Platform section 9.2.1. It enables both security-enabled and non-security-enabled clients to access a proxied web service via the same interface. The PEP always works in conjunction with a service specific proxy andor a service specific client facade. As suggested in OASIS WS-Security standards, the optional security information encoded in SAML is provided in the SOAP header while the actual service request in the SOAP body remains unchanged. The Policy Enforcement Service provides its functionality through the following interfaces: ServiceCapabilities PEP Interface ServiceCapabilities getCapabilities Informs the client about both common and specific capabilities of a Policy Enforcement Service instance. Interface PEP doRequest This operation performs a service request and enforces access restrictions by calling a service that implements the Authorisation Interface. In general doRequest is called by a proxy andor client facade.. Example usage The Policy Enforcement Service is designed to interact with the Authentication and the Policy Management and Authorisation Service. It verifies the genuineness of the security information by calling the Identity Management and Authentication Service and then delegating the evaluation of the access policies to an external policy decision point PDP, the Policy Management and Authorisation Service. Comments none Table 8-10: Description of the Policy Enforcement Service SANY D2.3.4 Specification of the Sensor Service Architecture V3 Doc.V3.1 Copyright © 2007-2009 SANY Consortium Page 150 of 233

8.4. Services of the Mediation, Processing and Application Domain