restrbacabacrole-base-authorization

Record level access control for REST API GET Collection call

So, I am working on the next project that requires more detailed access control functionality (i.e. Sally can only view products in her department).

I get how either a role based access control model or an attribute access control model can 'wrap' an API call to determine if a given user can perform said action on a given object.

Where I keep getting stuck is when you are dealing with a GET call that returns a collection of records. If I ask the API for a page of 20 records from this endpoint, I can't get 20 records, then run a code based authorization check on those records before returning them as I most likely won't be returning 20 records.

It seems like the authorization check either has to be down in the database and/or happen prior to the database query by adding additional filters to the query call (i.e. also filter where product department = clothing).

Anybody have any more concrete implementation examples or ideas how how this could be implemented in a performant manner?

Solution

  • As David mentioned, XACML can be used at the database level for filtering.

    Implementing XACML For The Database

    The diagram below is for SQL, but can be used as a general example for any database technology.

    Example diagram for SQL database dynamic authorization

    Let's see how this works:

    1. SQL statement is intercepted.
    2. A query is sent to the external authorization service that implements XACML
    3. The authorization engine (PDP) evaluates the relevant policies, written in XACML or ALFA (an implementation of XACML).
    4. It may query external attribute sources (PIPs) for more info.
    5. The result: SQL statement is dynamically modified to retrieve only authorized data for the user.

    How This Would Be Used In An Application

    The implementation of XACML you choose to go with would ideally have an SDK in your language of choice or support the XACML REST profile. Either would work for integration into your application.

    Given that you are using REST calls, I don't think you would have to add much code to integrate your application with an implementation of XACML.

    Implementing XACML for an API Gateway

    The principle used in this integration is the ability of an API gateway to make a callout to a third party service.

    In this case the third party service is your XACML implementation's Policy Decision Point (PDP). The implementation must support REST/JSON.

    The API Gateway is configured to send fine-grained authorization requests to the PDP.

    Requests are made using the REST/JSON interface exposed by the PDP. The PDP then returns a response.

    The JSON profile of XACML extends the Request/Response schema allowing both the Request and the Response to be encoded in JSON instead of the traditional XML encoding. This makes the Request and the Response much easier to read and also much smaller in size thus transferring less data.

    Implementations of XACML

    For an entire list of XACML implementations, you can check this list on Wikipedia.

    Full disclosure - I work for Axiomatics with David Brossard, who designed the JSON profile for XACML to be used in conjunction with the REST profile.

    Axiomatics provides Axiomatics Data Access Filter for relational databases and SmartGuard for HADOOP. Axiomatics Policy Server natively supports both JSON and REST profiles.