History
Origin
Axiomatics donates ALFA to OASIS
In March 2014, Axiomatics announced it was donating ALFA to theSample Use Cases
* Medical use case: doctors can view the medical records of patients they have a relationship with. * Financial use case: employees in Singapore can view the customer accounts of employees based in Singapore. * Insurance use case: an insurance agent can approve the claim of a user if the claim is in the same region as the agent and if the claim amount is less than the agent's approval amount. The words doctor, view, medical record, Singapore... are all examples of attribute values. Attributes make up the building blocks of policies in ABAC and consequently in ALFA.Structure
Just like XACML, ALFA has three structural elements: * PolicySet * Policy * Rule Like in XACML, a PolicySet can contain PolicySet and Policy elements. A Policy can contain Rule elements. A Rule contains a decision (either Permit or Deny). In addition, in ALFA, it's possible to add Rule elements to PolicySet and Policy elements. PolicySet, Policy, and Rule elements can be nested or referenced to. In order to resolve conflicts between siblings, ALFA (as does XACML) uses combining algorithms. There are several combining algorithms that may be used. Their behavior is defined in thiData types
ALFA supports all theNative attribute values mapped directly from ALFA to XACML
String, integer, double, and boolean all map directly from ALFA to XACML. They do not need a conversionALFA Policy using Boolean Attributes
Attribute values which need an explicit conversion
The following attribute datatypes need an explicit conversion: * http://www.w3.org/2001/XMLSchema#time * http://www.w3.org/2001/XMLSchema#date * http://www.w3.org/2001/XMLSchema#dateTime * http://www.w3.org/2001/XMLSchema#anyURI * http://www.w3.org/2001/XMLSchema#hexBinary * http://www.w3.org/2001/XMLSchema#base64Binary * http://www.w3.org/2001/XMLSchema#dayTimeDuration * http://www.w3.org/2001/XMLSchema#yearMonthDuration * urn:oasis:names:tc:xacml:1.0:data-type:x500Name * urn:oasis:names:tc:xacml:1.0:data-type:rfc822Name * urn:oasis:names:tc:xacml:2.0:data-type:ipAddress * urn:oasis:names:tc:xacml:2.0:data-type:dnsName * urn:oasis:names:tc:xacml:3.0:data-type:xpathExpressionExample: ALFA Policy using anyURI
In this policy, we convert a String value to anyURI.Sample Policies
A simple policy & rule with a condition
The following ALFA example represents a XACML policy which contains a single rule. The policy and rule both have a target. The rule also has a condition which is used to compare 2 attributes together to implement a relationship check (user ID must be equal to owner). Whenever one needs to check 2 attributes together, they must use a condition.Using time in a XACML policy written in ALFA
Policy References in ALFA
ALFA can use policy (set) references. They are in fact used implicitly when doing the following.Obligations & Advice in ALFA
Obligations and advice are statements in XACML that can be returned from the PDP to the PEP alongside the decision (Permit, Deny...). Obligations and advice are triggered on either Permit or Deny.Break the Glass Authorization Scenario
Let's start by defining the attributes and obligations we will use.Time-based fine-grained authorization policy
The following is an example of an ABAC policy implemented using ALFA. It uses time as attributes. It uses a XACML condition to compare the currentTime attribute to the value representing 5pm (expressed in 24-hour time). Note the use of :time to convert the String value to the right data type.HL7 Policies
Use Cases
Sample ALFA policies for HL7
= Access Control Based on Category of Action
=Implementations
VS Code Extension for ALFA
A free extension for the VS Code editor that supports code completion, syntax highlighting, refactoring, and go-to-definition navigation. It can also compile ALFA intoThe ALFA plugin for Eclipse
The ALFA Plugin for Eclipse is a tool that converts your Eclipse programming IDE to a dedicated editor of authorization policies using ALFA syntax. ALFA policies can then easily be converted intoReferences
{{reflistExternal References
European analysts talk about ALFA