ALFA (XACML)

ALFA, the Abbreviated Language For Authorization, is a pseudocode language used in the formulation of access-control policies.
History.
Origin.
XACML, the eXtensible Access Control Markup Language, uses XML as its main encoding language. Writing XACML policies directly in XACML leads to bloated, human-unfriendly text, therefore a new, more lightweight, notation was necessary. Axiomatics researcher, Pablo Giambiagi, therefore designed ALFA, the Axiomatics Language for Authorization.
ALFA maps directly into XACML. ALFA contains the same structural elements as XACML i.e. PolicySet, Policy, and Rule.
Axiomatics donates ALFA to OASIS.
In March 2014, Axiomatics announced it was donating ALFA to the OASIS XACML Technical Committee in order to advance its standardization.
ALFA was consequently renamed Abbreviated Language for Authorization and filed for standardization. Its current version can be accessed here.
Sample Use Cases.
The words doctor, view, medical record, Singapore... are all examples of attribute values. Attributes make up the building blocks of policies in ABAC and consequently in ALFA.
Structure.
Just like XACML, ALFA has three structural elements:
Like in XACML, a PolicySet can contain PolicySet and Policy elements. A Policy can contain Rule elements. A Rule contains a decision (either Permit or Deny). In addition, in ALFA, it's possible to add Rule elements to PolicySet and Policy elements. PolicySet, Policy, and Rule elements can be nested or referenced to.
In order to resolve conflicts between siblings, ALFA (as does XACML) uses combining algorithms. There are several combining algorithms that may be used. Their behavior is defined in this truth table
Data types.
ALFA supports all the data types that are defined in the OASIS XACML Core Specification. Some datatypes e.g. numerical (integer, double) and boolean map directly from ALFA to XACML. Others need to be converted such as date or time attributes. To convert an attribute into the relevant data type, use the "value":datatype notation. See below for examples
Native attribute values mapped directly from ALFA to XACML.
String, integer, double, and boolean all map directly from ALFA to XACML. They do not need a conversion
ALFA Policy using Boolean Attributes.
 namespace exampleBoolean{
 policy article{
 target clause userRole == "editor" and actionId == "edit" and itemType=="article"
 apply firstApplicable
 rule publishedArticles{
 target clause published == true
 permit
Attribute values which need an explicit conversion.
The following attribute datatypes need an explicit conversion:
Example: ALFA Policy using anyURI.
In this policy, we convert a String value to anyURI.
 attribute userDisallowedResources{
 category = subjectCat
 id = "userDisallowedResources"
 type = string
 rule allowProfileAccess{
 target clause url == "http://<host>:<port>/profile/":anyURI
 permit
Sample Policies.
A simple policy & rule with a condition.
The following ALFA example represents a XACML policy which contains a single rule. The policy and rule both have a target. The rule also has a condition which is used to compare 2 attributes together to implement a relationship check (user ID must be equal to owner). Whenever one needs to check 2 attributes together, they must use a condition.
 namespace example{
 policy article{
 target clause itemType=="article"
 apply firstApplicable
 rule editArticle{
 target clause actionId == "edit" and userRole == "editor"
 permit
 condition userId == owner
Using time in a XACML policy written in ALFA.
 namespace exampleTime{
 policy checkTimeAccess {
 apply firstApplicable
 rule checkNightAccess {
 target clause role == "supervisor" and document == "medicalrecord"
 condition timeInRange(timeOneAndOnly(currentTime), "22:00:00":time, "06:00:00":time)
 permit
Policy References in ALFA.
ALFA can use policy (set) references. They are in fact used implicitly when doing the following.
namespace com.axiomatics{
 namespace example{
 * A policy about what managers can do. It is linked to from the
 * documents policy set.
 policy managers{
 target clause role == "manager"
 apply firstApplicable
 rule allowSameDepartment{
 condition user.department == document.department
 permit
 
 * The main policy. It references the managers policy
 policyset documents{
 target clause resourceType == "document"
 apply firstApplicable
 // The following is a policy reference
 example.managers
Obligations & Advice in ALFA.
Obligations and advice are statements in XACML that can be returned from the PDP to the PEP alongside the decision (Permit, Deny...). Obligations and advice are triggered on either Permit or Deny.
namespace example{
 import Attributes.*
 advice notify = "example.notify"
 policy readDocuments{
 target clause actionId=="read" and objectType=="document"
 apply firstApplicable
 * This rule denies access if the time is not between 9 and 5
 rule denyOutsideHours{
 target clause currentTime<"09:00:00":time or currentTime>"17:00:00":time
 deny
 on deny{
 advice notify{
 acme.obligations.message = "You cannot access this service outside office hours"
 /**
 * This rule grants managers access
 rule allowManagers{
 target clause acme.user.role=="manager"
 permit
 /**
 * This rule catches anything else that might have fallen to this point
 rule failsafeDeny{
 deny
 on deny{
 advice notify{
 acme.obligations.message = "Your request did not match the policy. Please try again"
 } 
Break the Glass Authorization Scenario.
Let's start by defining the attributes and obligations we will use.
namespace com.axiomatics.examples{
 import Attributes.*
 obligation breakTheGlass = "com.axiomatics.examples.breakTheGlass"
 obligation auditLog = "com.axiomatics.examples.auditLog"
 namespace user{
 attribute role{
 category = subjectCat
 id = "com.axiomatics.examples.user.role"
 type = string
 attribute identifier{
 category = subjectCat
 id = "com.axiomatics.examples.user.identifier"
 type = string
 namespace patient{
 attribute assignedDoctor{
 category = resourceCat
 id = "com.axiomatics.examples.user.assignedDoctor"
 type = string
 namespace record{
 attribute identifier{
 category = resourceCat
 id = "com.axiomatics.examples.record.identifier"
 type = string
 attribute actionId{
 category = actionCat
 id = "com.axiomatics.examples.actionId"
 type = string
 attribute objectType{
 category = resourceCat
 id = "com.axiomatics.examples.objectType"
 type = string
 attribute isEmergency{
 category = environmentCat
 id = "com.axiomatics.examples.isEmergency"
 type = boolean
 attribute message{
 category = environmentCat
 id = "com.axiomatics.examples.message"
 type = string
We can now define the policy with 3 rules:
 * Control access to medical records
 policy accessMedicalRecord{
 target clause actionId == "view" and objectType == "medical record"
 apply firstApplicable
 * Doctors can view medical records of patients they are assigned to
 rule allowRegularAccess{
 target clause user.role == "doctor"
 condition patient.assignedDoctor == user.identifier
 permit
 /**
 * Doctors can view any medical reason in the case of an emergency
 rule allowBreakTheGlassAccess{
 target clause isEmergency == true
 permit
 on permit{
 obligation auditLog{
 message = "A doctor has gotten access to a medical record by breaking the glass"
 user.identifier = user.identifier
 record.identifier = record.identifier
 currentDateTime = currentDateTime
 
 * Deny other accesses. If access is normally denied, tell doctors how
 * they can get access by "breaking the glass".
 rule denyAccess{
 deny
 on deny{
 obligation breakTheGlass{
 message = "You do not have access to this medical record. To be granted access, set the isEmergency flag to true."
 record.identifier = record.identifier
 currentDateTime = currentDateTime
Time-based fine-grained authorization policy.
The following is an example of an ABAC policy implemented using ALFA. It uses time as attributes. It uses a XACML condition to compare the currentTime attribute to the value representing 5pm (expressed in 24-hour time). Note the use of :time to convert the String value to the right data type.
rule allowAfter5pm{ 
 permit
 condition currentTime > "17:00:00":time
HL7 Policies.
Use Cases.
HL7 defines a series of medical access control use cases which can be easily defined in ALFA.
The ALFA plugin for Eclipse.
The ALFA Plugin for Eclipse is a tool that converts your Eclipse programming IDE to a dedicated editor of authorization policies using ALFA syntax. ALFA policies can then easily be converted into real XACML 3.0 policies and loaded into your XACML policy management tool.
External References.
European analysts talk about ALFA
A Template-Based Policy Generation Interface for RESTful Web Services