XACML interceptor for WCF Data Services

Question

Can anyone point me to information on how a XACML interceptor could be defined for WCF Data Services?

Answer 1

Interceptors for WCF Data Services are essentially lambda expressions of type Expression<Func<T, bool>> for each entity you have in your data source(more about interceptors), this limits you to quite simple and almost static authorization rules. On the other hand XACML is very flexible and dynamic authorization solution. I cannot think of possible generic way of integration. At the same time non generic integrations are quite simple:

[QueryInterceptor ("Customers")]
public Expression<Func<Customer, bool>> FilterCustomers() 
{

    // First of all you need to get all request attributes
    // information could come from session, from cookies
    // from request, in this example I will only use subjectId
    // In XACML subjectId could be user name  
    var subjectId = GetSubjectId();

    // After you have all data, build XACML request
    // this code is specific to our XACML implementation
    var xacmlRequest = new XacmlDecisionRequestContext()
        .AddRequest(r => r
            .AddResource(a => a.Add(XacmlConstants.ResourceAttributes.ResourceId, new Uri("Customer", UriKind.RelativeOrAbsolute)))               
            .AddSubject(a => a.Add(XacmlConstants.SubjectAttributes.SubjectId, subjectId ))
        );

    // Evaluate request
    var result = PolicyDecisionPoint.Evaluate(xacmlRequest);

    // Based on XACML decision result you can construct expression
    // this example is simple true or false, but based on 
    // XACML Advices or XACML Attributes you can build much more
    // sophisticated expression

    if (result.Decisions.Single().Decision == XacmlDecision.Permit)
    {
        return () => true;
    }
    return () => false;
}

This example assumes that you intercept access to Customer entity. And it works only for query. You should place this method to you DataService class.

Example is based on Axiomatics PEP SDK for .NET (I am working on this product) , but idea will apply to any XACML implementation.