Hi Juan,
You actually rose quite interesting topic of rather research character.
This is especially relevant to Web Services and Grid areas where the
major technology development is focused on providing dynamic
services. And the workflow is considered as an upper service
abstraction layer for such dynamic service provisioning.
Given the workflow is developing quite actively around OASIS BPEL,
two issues remains open/unsolved:
- adding security/policy control to the workflow, and
- having an access control infrastructure capable to accept
changing/dynamic security context.
We are trying to work out both. These two documents may be useful to
you:
Using Workflow for Dynamic Security Context Management in Complex
Resource Provisioning
http://www.uazone.org/demch/papers/hpdc2006-workflow-dynamic-security-context-03.pdf
Filling the Gap with GAAA-P: Gap Analysis of Authorisation
technologies and solutions for Optical Light Path Provisioning
http://www.uazone.org/demch/analytic/airg-gp6-ron-gap-aaa-12.pdf
We'll appreciate comments, ideas and cooperation. I will also be
ready to answer possible questions.
Regards,
Yuri
Juan C Calderon wrote:
Hello all
I'm making some research on authorization. I'm
describing RBAC to secure Web application, however,
sometimes web application have more granurar and
especial requierements. For example, in a Workflow,
authorization to perform an action is not only
dependant of user permissions but of worflow item
state (you cannot allow aproval on an item if it is
not complete even if the user is an approver).
So... my question is, do you know about a tool to
describe this in a document, something like a well
defined "workflow tree methodology" or similar.
Thank in advance,
Juan Carlos
__________________________________________________
Correo Yahoo!
Espacio para todos tus mensajes, antivirus y antispam ¡gratis!
Regístrate ya - http://correo.espanol.yahoo.com/
-------------------------------------------------------------------------
This List Sponsored by: SPI Dynamics
ALERT: "How A Hacker Launches A Web Application Attack!"
Step-by-Step - SPI Dynamics White Paper
Learn how to defend against Web Application Attacks with real-world
examples of recent hacking methods such as: SQL Injection, Cross Site
Scripting and Parameter Manipulation
https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003gRl
--------------------------------------------------------------------------
-------------------------------------------------------------------------
This List Sponsored by: SPI Dynamics
ALERT: "How A Hacker Launches A Web Application Attack!"
Step-by-Step - SPI Dynamics White Paper
Learn how to defend against Web Application Attacks with real-world
examples of recent hacking methods such as: SQL Injection, Cross Site
Scripting and Parameter Manipulation
https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003gRl
--------------------------------------------------------------------------
