WebApp Sec: Re: Authorization in workflows

[Yuri Demchenko <demch () chello nl>]

Hi Juan,

You actually rose quite interesting topic of rather research character.

This is especially relevant to Web Services and Grid areas where the 
major technology development is focused on providing dynamic 
services. And the workflow is considered as an upper service 
abstraction layer for such dynamic service provisioning.
Given the workflow is developing quite actively around OASIS BPEL, 
two issues remains open/unsolved:
- adding security/policy control to the workflow, and

- having an access control infrastructure capable to accept 
changing/dynamic security context.
We are trying to work out both. These two documents may be useful to 
you:
Using Workflow for Dynamic Security Context Management in Complex 
Resource Provisioning
http://www.uazone.org/demch/papers/hpdc2006-workflow-dynamic-security-context-03.pdf

Filling the Gap with GAAA-P: Gap Analysis of Authorisation 
technologies and solutions for Optical Light Path Provisioning
http://www.uazone.org/demch/analytic/airg-gp6-ron-gap-aaa-12.pdf

We'll appreciate comments, ideas and cooperation. I will also be 
ready to answer possible questions.
Regards,

Yuri


Juan C Calderon wrote:

> Hello all
>
> I'm making some research on authorization. I'm
> describing RBAC to secure Web application, however,
> sometimes web application have more granurar and
> especial requierements. For example, in a Workflow,
> authorization to perform an action is not only
> dependant of user permissions but of worflow item
> state (you cannot allow aproval on an item if it is
> not complete even if the user is an approver).
>
> So... my question is, do you know about a tool to
> describe this in a document, something like a well
> defined "workflow tree methodology" or similar.
>
> Thank in advance,
> Juan Carlos
>
> __________________________________________________
> Correo Yahoo!
> Espacio para todos tus mensajes, antivirus y antispam ¡gratis! 
> Regístrate ya - http://correo.espanol.yahoo.com/ 
>
> -------------------------------------------------------------------------
> This List Sponsored by: SPI Dynamics
>
> ALERT: "How A Hacker Launches A Web Application Attack!" 
> Step-by-Step - SPI Dynamics White Paper
> Learn how to defend against Web Application Attacks with real-world 
> examples of recent hacking methods such as: SQL Injection, Cross Site 
> Scripting and Parameter Manipulation
> https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003gRl
> --------------------------------------------------------------------------

-------------------------------------------------------------------------
This List Sponsored by: SPI Dynamics

ALERT: "How A Hacker Launches A Web Application Attack!" 
Step-by-Step - SPI Dynamics White Paper
Learn how to defend against Web Application Attacks with real-world 
examples of recent hacking methods such as: SQL Injection, Cross Site 
Scripting and Parameter Manipulation
https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003gRl
--------------------------------------------------------------------------