Securing Web Services with WS-Security: Demystifying WS-Security, WS-Policy, SAML, XML Signature, and XML Encryption

2017-07-07 02:10:07

< Day Day Up >

The eXtensible Rights Markup Language specifies rights to control access to digital content and services. XrML is part of the effort to create an infrastructure to manage digital rights on copyright and for-fee content that is moved across the public networks.

XrML is a rights language that supports a wide variety of business models from free content that still must control who accesses it (for example, real estate home listings) to valuable content that must be purchased by the end user (for example, digital music). It can specify simple and complex rights. It is designed to handle any type of digital content or service. It gives precise meaning to all components of the system. A couple of its critical early design goals were that it be interoperable with other standards and specifications and that it be platform neutral.

The XrML Data Model

The data model for XrML consists of four entities and the relationship between those entities. The most important relationship is the XrML assertion Grant. A Grant is structured as follows :

The Principal to whom the Grant is issued

The Right that the Grant specifies

The Resource that is the direct object of the "rights" verb

The Condition that must be met for the right to be exercised

A Principal is an individual who must present identification credentials such as an X.509 certificate or a digital signature. If the authentication of this individual is successful, that person may be granted some Rights to the digital content. The Right is a verb that a Principal can be granted to exercise agaist some content. For example, the Right might be to read, view, print, forward, or even grant rights to others. The Resource is the object to which a Principal can be granted a Right. It might be an e-book, an audio or video file, or an image. It can also be a service such as email or a Web service. A Condition specifies the terms, conditions, and obligations under which the Rights can be exercised. This might be a time interval, or it might require that someone else has also granted some Rights first, such as a trusted third party. The relationships of the four key XrML constructs are shown in Figure 9.10.

Figure 9.10. Core XrML constructs and their interrelationships.

XrML Use Case Example

The following use case illustrates how to use XrML in a service-centric business model, which focuses on specifying Rights, Conditions, and metadata for services, such as Web services. In this use case, Alice pays $2 each time she uses a Web service to receive stock quotes. Figure 9.11 illustrates this use case.

Figure 9.11. Alice may use the content from a Stock Quote Web service if she pays $2 for such use.

To specify this information in XrML, you need to

Identify Alice as the person to whom the Rights are granted.

Specify the Right that Alice is granted ”the right to use the stock service.

Identify the Resource (the Web service) to which Alice is being granted rights.

Specify the Condition (the fee) that applies when Alice exercises her right to use the stock service.

Figure 9.12 illustrates the structure of Alice's license.

Figure 9.12. The XrML license for Alice's use case.

The license in Listing 9.12 illustrates how Alice's right to use a stock quote service subject to a fee could be expressed in XrML. In this example, the prefix sx: identifies elements from the standard extension. The prefix service: identifies elements from the sample service extension. The prefix stocks: refers to the WSDL definition namespace. The prefix dsig: refers to the namespace that defines XML signatures. All other elements are defined in the XrML core.

Listing 9.12. XrML Specifying Alice's Rights to Use a Fee-Based Stock Quote Service

<license> <grant> <!- - Alice is represented as the holder of a particular key - -> <keyHolder licensePartId="Alice"> <info> <dsig:KeyValue> <dsig:RSAKeyValue> <dsig:Modulus>4hre4NP7R...</dsig:Modulus> <dsig:Exponent>AQABAA==</dsig:Exponent> </dsig:RSAKeyValue> </dsig:KeyValue> </info> </keyHolder> <!- - Alice is granted the right to use the stock quote service - -> <service:use/> <!- - The stock quote service is represented with a service reference that contains a WSDL file - -> <serviceReference> <wsdl> <xml> <wsdl:definitions name="StockQuote" targetNamespace="http:// www.xrml.org/examples/2001/11/wsdl-stocks/stockquote.wsdl"> <wsdl:types> <xsd:schema targetNamespace="http://www.xrml.org/examples/2001/ 11/wsdl-stocks/stockquote.xsd"> <xsd:element name="TradePriceRequest"> <xsd:complexType> <xsd:all> <xsd:element name="tickerSymbol" type="xsd:string"/> </xsd:all> </xsd:complexType> </xsd:element> <xsd:element name="TradePrice"> <xsd:complexType> <xsd:all> <xsd:element name="price" type="xsd:float"/> </xsd:all> </xsd:complexType> </xsd:element> </xsd:schema> </wsdl:types> <wsdl:message name="GetLastTradePriceInput"> <wsdl:part name="body" element="stocks-xsd:TradePriceRequest"/> </wsdl:message> <wsdl:message name="GetLastTradePriceOutput"> <wsdl:part name="body" element="stocks-xsd:TradePrice"/> </wsdl:message> <wsdl:portType name="StockQuotePortType"> <wsdl:operation name="GetLastTradePrice"> <wsdl:input message="stocks:GetLastTradePriceInput"/> <wsdl:output message="stocks:GetLastTradePriceOutput"/> </wsdl:operation> </wsdl:portType> <wsdl:binding name="StockQuoteSoapBinding" type="stocks: StockQuotePortType"> <soap:binding transport="http:// schemas.xmlsoap.org/soap/http"/> <wsdl:operation name="GetLastTradePrice"> <soap:operation soapAction="http://example.com/ GetLastTradePrice"/> <wsdl:input> <soap:body use="literal"/> </wsdl:input> <wsdl:output> <soap:body use="literal"/> </wsdl:output> </wsdl:operation> </wsdl:binding> <wsdl:service name="StockQuoteService"> <wsdl:documentation>My first service</wsdl:documentation> <wsdl:port name="StockQuotePort" binding= "stocks:StockQuoteSoapBinding"> <soap:address location="http://example.com/stockquote"/> </wsdl:port> </wsdl:service> </wsdl:definitions> </xml> </wsdl> <service>stocks:StockQuoteService</service> <portType>stocks:StockQuotePortType</portType> </serviceReference> <!- - Alice pays .00 each time she exercises her right to use the stock quote service - -> <sx:fee> <sx:paymentPerUse> <sx:rate> <sx:amount>2.00</sx:amount> <sx:currency>US</sx:currency> </sx:rate> </sx:paymentPerUse> <sx:to> <sx:aba> <sx:institution>13937151</sx:institution> <sx:account>4281938823</sx:account> </sx:aba> </sx:to> </sx:fee> </grant> </license>

The following are some XrML resources:

http://www.oasis- open .org/ committees /tc_home.php?wg_abbrev=rights

http://www.xrml.org/

http://xml.coverpages.org/xrml.html

http://www.giantstepsmts.com/DRM%20Watch/xrml20.htm

SAML, XACML, XrML: Overlapping Standards?

XACML and XrML both deal with authorization. They share requirements from many of the same application domains. Both share the same concepts but use different terms. Both are based on XML Schema.

Both SAML and XrML have the concept of attribute assertion. In SAML it's just an Attribute, whereas in XrML it's based on the PossessProperty construct.

Both XACML and XrML deal with an authorization policy. In XACML it's just Policy, whereas in XrML its part of the License construct.

XrML operates in terms of licenses and rights. XACML operates in terms of policies. But attributes can seem like rights.

XACML is consistent with and builds on SAML. XrML may be focused more tightly on the specific issues of Digital Rights Management. In the meantime, however, the overlap is confusing; OASIS knows this and claims to be trying to make sense of it.

Because it is trivial to write an XSLT transform for an SAML:Request into XACML:Context, it follows that the two are closely related .

It is also interesting to note that SAML's PDP is implemented with XACML. Figure 9.13 shows how SAML depends on XACML.

Figure 9.13. How SAML PDPs communicate policy using XACML.

What does all of this overlap portend? It's hard to say, but OASIS is trying to simplify matters. There are always the politics of standards with territories that need to be protected, so expect this situation to take quite some time to settle .