| Version 64 (modified by , 18 years ago) ( diff ) |
|---|
LDAP and RBAC
At the user level, Orbit security involves making sure that each person using Orbit is allowed to do so at that time, and when he or she uses Orbit that he or she only uses those parts of it that he or she is allowed to use. That is, there are two parts to Orbit security: authenticating users and controlling their access to Orbit resources.
The Lightweight Directory Access Protocol (LDAP) is used by Orbit to authenticate each user's password when he or she logs into an Orbit controller or server. LDAP authentication and the proper use of Orbit user id's and passwords allows each user id to be related to a single human user. A single person may have one or more Orbit user id's. Each Orbit user id may be logged into one or more sessions, and during each session there may be multiple computer processes initiated by the user. A process is an instance of a user running an application program like a spreadsheet, editor or browser.
Role-Based Access Control (RBAC) will be used by Orbit to control each user's access to Orbit resources based on his or her role. To explain this use of roles, first some terminology. When a user runs an application program that process acts on behalf of the user and is referred to as a subject. An object is any resource accessible on a computer system, including peripherals, files, databases, and fields in a database. An operation is an active part of a process invoked by the subject process much like a function call or a method invocation. In general, a permission or privilege is the authorization to perform some action on the system. In RBAC, a permission is the authorization to perform a given operation on a given object. The use of roles to control access is based on the observation that there may be thousands of users in a given organization, but there are perhaps only a hundred different roles they act in at any given time to access resources. Users are assigned to one or more roles. Each role has a defined set of permissions, each for an operation invoked by a process run by a user acting in that role to access a given object.
As with any access control mechanism, role-based access control will have some performance penalties. Role-based access control should provide sufficiently flexible control with acceptable performance for reasonable administrative cost. In ORBIT, role-based access control will be implemented using mechanisms provided by LDAP. It is expected that this implementation will have acceptable performance while providing the desired security.
for Solaris RBAC stuff see SolarisRbac
References
LDAP Version 2 documents in Adobe Acrobat (.pdf) format
ftp://ftp.rfc-editor.org/in-notes/pdfrfc/rfc1959.txt.pdf RFC1959 An LDAP URL format
ftp://ftp.rfc-editor.org/in-notes/pdfrfc/rfc2596.txt.pdf RFC2596 Use of Language Codes in LDAP
LDAP Version 3 Documents
ftp://ftp.rfc-editor.org/in-notes/pdfrfc/rfc4511.txt.pdf RFC4511 LDAP: The Protocol
ftp://ftp.rfc-editor.org/in-notes/pdfrfc/rfc4512.txt.pdf RFC4512 LDAP: Directory Information Models
ftp://ftp.rfc-editor.org/in-notes/pdfrfc/rfc4516.txt.pdf RFC4516 LDAP: Uniform Resource Locator
ftp://ftp.rfc-editor.org/in-notes/pdfrfc/rfc4517.txt.pdf RFC4517 LDAP: Syntaxes and Matching Rules
ftp://ftp.rfc-editor.org/in-notes/pdfrfc/rfc4519.txt.pdf RFC4519 LDAP: Schema for User Applications
LDAP Data Interchange Format (LDIF)
Role-Based Access Control (RBAC) Documents
Attachments (2)
- rfc4510.txt.pdf (9.7 KB ) - added by 18 years ago.
- ANSI+INCITS+359-2004.pdf (356.3 KB ) - added by 18 years ago.
Download all attachments as: .zip
