OPA for HTTP Authorization

Open Policy Agent[1] is a promising, light weight and very generic policy engine to govern authorization is any type of domain. I found this comparion[2] very attractive in evaluating OPA for a project I am currently working on, where they demonstrate how OPA can cater same functionality defined in RBAC, RBAC with Seperation of Duty, ABAC and XACML.  
Here are the steps to a brief demonstration of OPA used for HTTP API authorization based on the sample [3], taking it another level up.
Running OPA Server First we need to download OPA from [4], based on the operating system we are running on.  For linux, curl -L -o opa https://github.com/open-policy-agent/opa/releases/download/v0.10.3/opa_linux_amd64 Make it executable, chmod 755 ./opa Once done, we can start OPA policy engine as a server.
./opa run --server Define Data and Rules Next we need to load data and authorization rules to the server, so it can make decisions. OPA defines these in files in the format of .rego. Below is a sample …

Identity Mediation for PSD2

Partners, mergers, legal entities, government entities, customers all need to work together in this era, while honoring the boundaries they should work within. This is with link to my previous post on challenges of future IAM requirements arising with increased interchangeability requirements between diversified parties.
  1. Challenges of Future IAM (concerned with Mergers , Acquisitions, Startups) -http://pushpalankajaya.blogspot.com/2017/07/challenges-of-future-iam-concerned-with.html
  2. Future of Identity and Access Management (IAM)- http://pushpalankajaya.blogspot.com/2017/07/future-of-identity-and-access.html
This need is much more emphasized with the new regulations such as PSD2 in EU region that is putting foundation for Open Banking. While these standards define guidance for implementation interfaces, 
  • End user authentication and authorization
  • Third party authentication and authorization
  • Identity mgt of internal staff,
 has hidden needs of identity mediation. Federated authentication is going to be a key feature requirement in Open banking for any institution that is looking for a long term journey in the arena as a giant.

With the Strong Customer Authentication requirements, it also highlights the need of an 'ESB like' power in an identity mediation solution. Without being limited to identity mediation between different protocols, a comprehensive solution needs to be flexible and powerful enough to easily define the sequences the authentication and authorization flow should follow. 

How about having an 'ESB like' Identity Mediation Engine that is based on event driven architecture, written in functional programming paradigm and can be dynamically configured in JavaScript? I have seen Identity Mediation Solutions written in OOP paradigm and configured via XML or a UI, then solutions that are written in OOP paradigm, but sequence can be handled via Java Script syntax.what's next?


Post a Comment

Popular posts from this blog

Signing SOAP Messages - Generation of Enveloped XML Signatures

OPA for HTTP Authorization

How to Write a Custom User Store Manager - WSO2 Identity Server 4.5.0