An integrated approach for identity and access management in a SOA context

  • Authors:

  • Waldemar Hummer;Patrick Gaubatz;Mark Strembeck;Uwe Zdun;Schahram Dustdar

  • Affiliations:

  • Vienna University of Technology, Vienna, Austria;University of Vienna, Vienna, Austria;Vienna University of Economics and Business (WU Vienna), Vienna, Austria;University of Vienna, Vienna, Austria;Vienna University of Technology, Vienna, Austria

  • Venue:
  • Proceedings of the 16th ACM symposium on Access control models and technologies
  • Year:
  • 2011

Quantified Score

Hi-index 0.00

Visualization

Abstract

In this paper, we present an approach for identity and access management (IAM) in the context of (cross-organizational) service-oriented architectures (SOA). In particular, we defined a domain-specific language (DSL) for role-based access control (RBAC) that allows for the definition of IAM policies for SOAs. For the application in a SOA context, our DSL environment automatically produces WS-BPEL (Business Process Execution Language for Web services) specifications from the RBAC models defined in our DSL. We use the WS-BPEL extension mechanism to annotate parts of the process definition with directives concerning the IAM policies. At deployment time, the WS-BPEL process is instrumented with special activities which are executed at runtime to ensure its compliance to the IAM policies. The algorithm that produces extended WS-BPEL specifications from DSL models is described in detail. Thereby, policies defined via our DSL are automatically mapped to the implementation level of a SOA-based business process. This way, the DSL decouples domain experts' concerns from the technical details of IAM policy specification and enforcement. Our approach thus enables (non-technical) domain experts, such as physicians or hospital clerks, to participate in defining and maintaining IAM policies in a SOA context. Based on a prototype implementation we also discuss several performance aspects of our approach.