OPA for HTTP Authorization

Open Policy Agent[1] is a promising, light weight and very generic policy engine to govern authorization is any type of domain. I found this comparion[2] very attractive in evaluating OPA for a project I am currently working on, where they demonstrate how OPA can cater same functionality defined in RBAC, RBAC with Seperation of Duty, ABAC and XACML.  
Here are the steps to a brief demonstration of OPA used for HTTP API authorization based on the sample [3], taking it another level up.
Running OPA Server First we need to download OPA from [4], based on the operating system we are running on.  For linux, curl -L -o opa https://github.com/open-policy-agent/opa/releases/download/v0.10.3/opa_linux_amd64 Make it executable, chmod 755 ./opa Once done, we can start OPA policy engine as a server.
./opa run --server Define Data and Rules Next we need to load data and authorization rules to the server, so it can make decisions. OPA defines these in files in the format of .rego. Below is a sample …

Implementing SAML to XACML

Before Implementing SAML

This is how a XACML request will looks like when it is arriving at PDP(Policy Decision Point) to be evaluated.

Basically it states who is(Subject) wanting to access which resource and what action it wants to perform on the resource. PDP trusts that request made is not altered while being sent and received, evaluates the request against existing enabled policies and reply with the decision which will be as follows.

Again there is no guarantee for the party who is using this response that this decision is not altered since sent from PDP until been received.

In order achieve the security of XACML requests and responses in server to server communication SAML profile for XACML is defined by OASIS.This take the system security to a higher level by allowing the usage of fine-grained authorization provided by XACML, to be signed.

After Implementing SAML

Following is how the previous XACML request looks like after wrapped into a XACMLAuthzDecisionQueryType, which is generated using OpenSAML 2.0.0 library which is supporting SAML profile of XACML as declared in 2004. The diagram shows the basic structure of a XACMLAuthzDecisionQueryType.

Following is a sample XACMLAuthzDecisionQuery.

As you can see it carries lot of information related to the content of the request like who issued it , when, signature with the X509Certificate and the XACML request. Data integrity can be preserved in this way.

After executing the request and gaining the response from PDP, it is also sent secured with a signature. The diagram shows the structure of a basic SAML Response.

Following is a sample SAML response that carries XACML response.

The XACML response is wrapped into a SAML statement which is included in a SAML assertion that is again wrapped by a SAML response.I have only signed the response according to the context and included only one assertion. We can separately sign both the assertion and response according to the spec and include more assertions in one response. Also it is possible to send the relevant XACML request inside the response and lot more options are there according to the spec. With OpenSAML we can get most of them into action.


  1. Nice post! Thank you very much!

  2. WSO2 Identity Server v4.0.0 is now released with this feature as WS-XACML, http://wso2.com/products/identity-server/. It is 100% free and open source that you can can have a try.

  3. Excellent BLOG with clearly defined SAML authentication process

  4. there is an error in the example:
    XACMLAuthzDecisionQueryType should be XACMLAuthzDecisionQuery and the Id is missing.

  5. very useful information can you help me, do you have any links for how to implement the profiles for saml and xacml, i got the pdf but unable to understand on how to change the profile in my code so that my authentication request is changed

  6. I used to so confused about why wrapping XACML into SAML, thanks to this article for clean things up.

    Another question, in addition to authentication function that SAML provided, Is there any other benefits when using SAML and XACML together? What’s the disadvantage and shortage when using XACML alone?

    Thank you so much!


Post a Comment

Popular posts from this blog

Signing SOAP Messages - Generation of Enveloped XML Signatures

OPA for HTTP Authorization

How to Write a Custom User Store Manager - WSO2 Identity Server 4.5.0