A Heterogeneous Network Access Service Based on PERMIS and SAML

  • Gabriel López
  • Óscar Cánovas
  • Antonio F. Gómez-Skarmeta
  • Sassa Otenko
  • David W. Chadwick
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 3545)


The expansion of inter-organizational scenarios based on different authorization schemes involves the development of integration solutions allowing different authorization domains to share, in some way, protected resources. This paper analyzes different emerging technologies. On the one hand, we have two XML-based standards, the SAML standard, which is being widely accepted as a language to express and exchange authorization data, and the XACML standard, which constitutes a promising framework for access control policies. On the other hand, PERMIS is a trust management system for X.509 attribute certificates and includes a powerful authorization decision engine governed by the PERMIS XML policy. This paper presents a sample scenario where domains using these technologies can be integrated allowing, for example, the use of attribute certificates in a SAML environment and the utilization of the PERMIS authorization engine to decide about the disclosure or concealment of attributes. In order to design this scenario we have based our work on a Credential Conversion Service (CCS) which is able to convert ACs into SAML attributes, and a User Attribute Manager (UAM) which controls the disclosure of credentials. These modules are governed by policies defining the conversion process (the Conversion Policy) and the disclosure of attributes (the Disclosure Policy).


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Globus Toolkit (February 2005),
  2. 2.
    Anderson, H., Josefson, S., Zorn, G., Simon, D., Palekar, A.: Protected EAP Protocol (PEAP). IETF Draft (2004)Google Scholar
  3. 3.
    Ashley, P., Hada, S., Karjoth, G., Schunter, M.: E-P3P privacy policies and privacy authorization. In: WPES 2002: Proceedings of the 2002 ACM workshop on Privacy in the Electronic Society, pp. 103–109. ACM Press, New York (2002)CrossRefGoogle Scholar
  4. 4.
    Cantor, S.: Shibboleth Architecture. Protocols and Profiles (February 2005),
  5. 5.
    Chadwick, D.W., Otenko, S., Welch, V.: Using SAML to link the GLOBUS toolkit to the PERMIS authorisation infrastructure. In: Proceedings of Eighth Annual IFIP TC-6 TC-11 Conference on Communications and Multimedia Security (2004)Google Scholar
  6. 6.
    Chadwick, D.W., Otenko, A., Ball, E.: Role-based access control with x.509 attribute certificates. IEEE Internet Computing 7(2), 62–69 (2003)CrossRefGoogle Scholar
  7. 7.
    Cánovas, O., López, G., Gómez, A.F.: A Credential Conversion Service for SAML-based scenarios. In: Proceedings of 1st European PKI Workshop, pp. 297–305 (June 2004)Google Scholar
  8. 8.
    de Laat, C., Gross, G., Gommans, L., Vollbrecht, J., Spence, D.: Generic AAA Architecture. Internet Engineering Task Force (August 2000), Request for Comments (RFC) 2903Google Scholar
  9. 9.
    Godik, S., Moses, T.: OASIS eXtensible Access Control Markup Language (XACML) Version 2.0, OASIS Standard (February 2005)Google Scholar
  10. 10.
    The Open Group. Authorization (AZN) API (January 2000)Google Scholar
  11. 11.
    Bertino, E., Joshi, J.B.D., Bhatti, R., Ghafoor, A.: Access-Control Language for Multidomain Environments. IEEE Internet Computing 8(6), 40–50 (2004)CrossRefGoogle Scholar
  12. 12.
    López, G., Cánovas, O., Gómez, A.F., Marín, R.: A Network Access Control Approach based on the AAA Architecture and Authorization Attributes. In: Proceedings of International Workshop on Systems and Security Networks (SSN 2005) (April 2005) (to be published)Google Scholar
  13. 13.
    Maler, E., Mishra, P., Philpott, R.: Assertions and Protocol for the OASIS Security Assertion Markup Language (SAML) V1.1, OASIS Standard (September 2003)Google Scholar
  14. 14.
    LAN MAN Standards Committee of the IEEE Computer Society. IEEE Draft P802.1X/D11: Standard for Port based Network Access Control. IEEE (March 2001)Google Scholar
  15. 15.
    Seamons, K., Winslett, M., Yu, T.: Limiting the Disclosure of Access Control Policies during Automated Trust Negotiation. In: Proceedings of Network and Distributed System Security Symposium (April 2001)Google Scholar
  16. 16.
    SIPS. Seamlessly Integrating PERMIS and Shibboleth (February 2005),
  17. 17.
    Welch, V., Ananthakrishnan, R., Siebenlist, F., Chadwick, D., Meder, S., Pearlman, L.: Use of SAML for OGSA Authorization, GGF Draft (OGSA-Authz WG) (February 2005)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2005

Authors and Affiliations

  • Gabriel López
    • 1
  • Óscar Cánovas
    • 1
  • Antonio F. Gómez-Skarmeta
    • 1
  • Sassa Otenko
    • 2
  • David W. Chadwick
    • 2
  1. 1.University of MurciaSpain
  2. 2.University of KentUnited Kingdom

Personalised recommendations