The information model for requests and responses include the following entities: Subject, Action, Resource, Context, and Decision. These are all defined below.
A Subject is the user or robotic principal about whom the Authorization API is being invoked. The Subject may be requesting access at the time the Authorization API is invoked.
A Subject is a JSON ([RFC8259]) object that contains two REQUIRED keys, type and id, which have a value typed string, and an OPTIONAL key, properties, with a value of a JSON object.
type:
REQUIRED. A string value that specifies the type of the Subject.
id:
REQUIRED. A string value containing the unique identifier of the Subject, scoped to the type.
properties:
OPTIONAL. A JSON object containing any number of key-value pairs, which can be used to express additional properties of a Subject.
The following is a non-normative example of a Subject:
5.1.主体
サブジェクトとは、Authorization API が呼び出されるユーザーまたはロボット プリンシパルです。サブジェクトは、Authorization API が呼び出された時点でアクセスを要求している可能性があります
Many authorization systems are stateless, and expect the client (PEP) to pass in any properties or attributes that are expected to be used in the evaluation of the authorization policy. To satisfy this requirement, Subjects MAY include zero or more additional attributes as key-value pairs, under the properties object.
An attribute can be single-valued or multi-valued. It can be a primitive type (string, boolean, number) or a complex type such as a JSON object or JSON array.
The following is a non-normative example of a Subject which adds a string-valued department property:
The IP Address of the Subject, identified by an ip_address field, whose value is a textual representation of an IP Address, as defined in Textual Conventions for Internet Network Addresses [RFC4001].
The following is a non-normative example of a subject which adds the ip_address property:
A Resource is the target of an access request. It is a JSON ([RFC8259]) object that is constructed similar to a Subject entity. It has the follow keys:
type:
REQUIRED. A string value that specifies the type of the Resource.
id:
REQUIRED. A string value containing the unique identifier of the Resource, scoped to the type.
properties:
OPTIONAL. A JSON object containing any number of key-value pairs, which can be used to express additional properties of a Resource.
Since many services follow a Create-Read-Update-Delete convention, a set of common Actions are defined. That said, an Action may be specific to the application being accessed or shared across applications but not listed in the common Actions below.
The following common Actions are defined:
can_access: A generic Action that could mean any type of access. This is useful if the policy or application is not interested in different decisions for different types of Actions.
can_create: The Action to create a new entity, which MAY be defined by the resource field in the request.
can_read: The Action to read the content. Based on the Resource being accessed, this could mean a list functionality or reading an individual Resource's contents.
can_update: The Action to update the content of an existing Resource. This represents a partial update or an entire replacement of an entity that MAY be identified by the Resource in the request.
can_delete: The Action to delete a Resource. The specific entity MAY be identified by the Resource in the request.
PDP Policies MAY incorporate common Action names to provide different decisions based on the Action.
The Context object is a set of attributes that represent environmental or contextual data about the request such as time of day. It is a JSON ([RFC8259]) object.
The following is a non-normative example of a Context:
0 件のコメント:
コメントを投稿