Chapter 4. Defining Entitlements
Prev |  | Next

# Chapter 4. Defining Entitlements

This chapter covers how to define entitlements for fine-grained authorization to access particular resources.

## 4.1. About Entitlements

OpenAM entitlements serve much the same purpose as OpenAM policies, defining who has access to what, under what conditions. OpenAM stores and manages policies centrally using the standard eXtensible Access Control Markup Language (XACML). You can access OpenAM entitlements and policy decisions using the RESTful web interface, for even lighter weight policy enforcement than with OpenAM policy agents.

The OpenAM entitlements service uses XACML terminology to refer to the different points dealing with policy.

- OpenAM serves as a policy administration point (PAP) where you define, store, and manage policies. OpenAM uses the configuration directory to store entitlements, whereas profiles are stored in the identity repository (user data store).

- OpenAM also serves as a policy decision point (PDP), evaluating policies and issuing authorization decisions, and as a policy information point, providing the information needed for authorization decisions.

- OpenAM policy agents act as policy enforcement points, obtaining decisions from PDPs to protect access to resources.

Entitlement policies define who has who has access to what, under what conditions, in the same way that other OpenAM policies define policy. Entitlement policies do let you define virtual subjects and subjects based on attribute lookup to determine who has access to the resources.

Entitlements apply for applications, which in this context mean protected resources that share a common set of actions and related policies. For example, the web agent application protects web resources accessed through HTTP GET and POST actions using a web policy agent to enforce decisions to allow or deny access. You can also define more specific applications as demonstrated by the examples delivered with OpenAM.

Delegations grant specific users privileges to manage policies.

## 4.2. Managing Entitlements on the Command Line

To manage entitlements, you can use the ssoadm command. The ssoadm command provides several other subcommands for managing entitlements in addition to those shown here.

Procedure 4.1. To List Current Policies

- Use the ssoadm list-xacml command to list current policies, ready for export.

      $ ssoadm list-xacml --realm / --adminid amadmin --password-file /tmp/pwd.txt

      <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
      <PolicySet PolicyCombiningAlgId="urn:oasis:names:tc:xacml:3.0:
       rule-combining-algorithm:deny-overrides" Version="2011.10.07.12.22.04.705"
       PolicySetId="/:2011.10.07.12.22.04.704" xmlns="urn:oasis:names:tc:xacml:3.0:
       core:schema:cd-1">
          <Target/>
      ... other policies ...
          <Policy RuleCombiningAlgId="urn:oasis:names:tc:xacml:3.0:
       rule-combining-algorithm:deny-overrides" Version="2011.10.07.11.51.27.444"
       PolicyId="New Policy">
      ... policy content here ...
          </Policy>
      </PolicySet>

Procedure 4.2. To Import an Entitlements Policy

- Use the ssoadm create-xacml command to import a policy.

      $ ssoadm
       create-xacml
       --realm /
       --xmlfile policy.xml
       --adminid amadmin
       --password-file /tmp/pwd.txt

Procedure 4.3. To Create an Application

- Use the ssoadm create-appl command to create an application type.

      $ cat application.txt
      resources=http://myapp.example.com:80/*
      subjects=com.sun.identity.admin.model.IdRepoUserViewSubject
      subjects=com.sun.identity.admin.model.VirtualViewSubject
      subjects=com.sun.identity.admin.model.OrViewSubject
      subjects=com.sun.identity.admin.model.AndViewSubject
      conditions=com.sun.identity.admin.model.DateRangeCondition
      conditions=com.sun.identity.admin.model.DaysOfWeekCondition
      conditions=com.sun.identity.admin.model.IpRangeViewCondition
      conditions=com.sun.identity.admin.model.DnsNameViewCondition
      conditions=com.sun.identity.admin.model.TimeRangeCondition
      conditions=com.sun.identity.admin.model.TimezoneCondition
      conditions=com.sun.identity.admin.model.OrViewCondition
      conditions=com.sun.identity.admin.model.AndViewCondition
      conditions=com.sun.identity.admin.model.NotViewCondition
      entitlementCombiner=com.sun.identity.entitlement.DenyOverride
      $ ssoadm
       create-appl
       --realm /
       --applicationtype iPlanetAMWebAgentService
       --name myApp
       --adminid amadmin
       --password-file /tmp/pwd.txt
       --datafile application.txt

      myApp was created.

Prev |  | Next
Chapter 3. Defining Authorization Policies | Home | Chapter 5. Configuring Realms