NIST SPECIAL PUBLICATION 1800-3

---

Attribute Based Access Control

---

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B), and How-To Guides (C)

Bill Fisher

Norm Brickman

Prescott Burden

Santos Jha

Brian Johnson

Andrew Keller

Ted Kolovos

Sudhi Umarji

Sarah Weeks

SECOND DRAFT

NIST SPECIAL PUBLICATION 1800-3

Attribute Based Access Control

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B), and How-To Guides (C)

Bill Fisher

National Cybersecurity Center of Excellence

National Institute of Standards and Technology

Norm Brickman

Prescott Burden

Santos Jha

Brian Johnson

Andrew Keller

Ted Kolovos

Sudhi Umarji

Sarah Weeks

The MITRE Corporation

McLean, VA

SECOND DRAFT

September 2017

U.S. Department of Commerce

Wilbur Ross, Secretary

National Institute of Standards and Technology

Kent Rochford, Acting Undersecretary of Commerce for Standards and Technology and Director

• Volume A
  • Executive Summary
    • Challenge
    • Solution
    • Risks
    • Benefits
    • Share Your Feedback
    • Technology Partners/Collaborators

• Volume B
  • 1. Summary
    • 1.1. Challenge
    • 1.2. Solution
    • 1.3. Risks
    • 1.4. Benefits
  • 2. How to Use This Guide
    • 2.1. Typographical Conventions
  • 3. Introduction
    • 3.1. Background
    • 3.2. ABAC and RBAC Considerations
    • 3.3. ABAC Leveraging Identity Federation
    • 3.4. Security Standards
  • 4. Approach
    • 4.1. Audience
    • 4.2. Scope
    • 4.3. Assumptions
      • 4.3.1. Modularity
      • 4.3.2. Business Policy Language
      • 4.3.3. Attribute Semantics and Syntax
      • 4.3.4. Attribute Provenance
      • 4.3.5. Trust Relationships for Identity Federation
      • 4.3.6. Human Resources Database/Identity Proofing
      • 4.3.7. Technical Implementation
      • 4.3.8. Limited Scalability Testing
    • 4.4. Risk Assessment
      • 4.4.1. Strategic Risks
      • 4.4.2. Tactical Risks
      • 4.4.3. Security Control Map
    • 4.5. Technologies
  • 5. Architecture
    • 5.1. Overview
      • 5.1.1. User Authentication and the Creation of an Authentication Context
      • 5.1.2. Federation of a User Identity and Attributes
      • 5.1.3. Fine-Grained Access Control through a PEP Closely Coupled with the Application
      • 5.1.4. The Creation of Attribute-Based Policy Definitions
      • 5.1.5. Secondary Attribute Requests
      • 5.1.6. Allow RP Access Decisions on External Identities without the Need for Pre‑Provisioning
    • 5.2. ABAC Architecture Considerations
      • 5.2.1. Industry Standards
      • 5.2.2. PEP Placement
      • 5.2.3. PDP Distribution
      • 5.2.4. Multi-Vendor
      • 5.2.5. Caching
      • 5.2.6. Data Tagging
      • 5.2.7. Policy Authoring
      • 5.2.8. Attribute Retrieval
    • 5.3. Technology and Architecture of the NCCoE Build
      • 5.3.1. Architecture Diagram and Components
      • 5.3.2. UML Diagram
      • 5.3.3. NCCoE Design Considerations
    • 5.4. Security Characteristics
    • 5.5. Features and Benefits
      • 5.5.1. Support Organizations with a Diverse Set of Users and Access Needs
      • 5.5.2. Reduce the Number of Identities Managed by the Enterprise
      • 5.5.3. Enable a Wider Range of Risk Decisions
      • 5.5.4. Support Business Collaboration
      • 5.5.5. Centralize Auditing and Access Policy Management

• Volume C
  • 1. Introduction
    • 1.1. Practice Guide Structure
    • 1.2. Build Overview
    • 1.3. Typographical Conventions
  • 2. Setting Up the Identity Provider
    • 2.1. Components
      • 2.1.1. Cisco Switch and Cisco Identity Services Engine
      • 2.1.2. Microsoft AD
      • 2.1.3. Nginx Web Server
      • 2.1.4. PingFederate-IdP
      • 2.1.5. PingFederate-RP
      • 2.1.6. RSA Adaptive Authentication
      • 2.1.7. SCE Plug-in
      • 2.1.8. Situational Context Connector
      • 2.1.9. Required or Recommended Files, Hardware, and Software
    • 2.2. Configuring l PC for 802.1x Auth
      • 2.2.1. Configure MS Native Supplicant for Wired 802.1x
    • 2.3. Install Nginx Web Server
    • 2.4. Install Microsoft AD
      • 2.4.1. Create a User in Microsoft AD
      • 2.4.2. Create the Lightweight Directory Access Protocol User for Federated Authentication
      • 2.4.3. Create the LDAP User for Cisco ISE Administration
    • 2.5. Configure the Cisco Switch
    • 2.6. Install and Configure Cisco Identity Services Engine
      • 2.6.1. Configure Cisco ISE with Microsoft AD
      • 2.6.2. Add Network Device to ISE
      • 2.6.3. Configure ISE for pxGrid
      • 2.6.4. Enable ISE Policy Sets
      • 2.6.5. Configure Authentication Policy
      • 2.6.6. Configure Authorization Policy
      • 2.6.7. Add Rule for Authorization Policy
    • 2.7. Install RSA AA
    • 2.8. Configure RSA AA Rules
      • 2.8.1. Create Rule for Non-Persistent User Enrollment
      • 2.8.2. Create Rule for Persistent User Enrollment
      • 2.8.3. Create Rule for User Updates
      • 2.8.4. Create Rule for Challenge SMS
      • 2.8.5. Increase SMS Token Length
      • 2.8.6. Create Policy for Session Sign-In
      • 2.8.7. Create Lists for Session Sign-In
      • 2.8.8. Create Rules for Session Sign-In
      • 2.8.9. Create Rule to Allow Forced Sign-In for Payment
      • 2.8.10. Create Custom Fact
    • 2.9. Install and Configure PingFederate-RP
    • 2.10. Install PingFederate-IdP
    • 2.11. Install the SCE Plug-in for the PingFederate-IdP
    • 2.12. Install the Situational Context Connector for the PingFederate-IdP
      • 2.12.1. Install Situational Context Connector
      • 2.12.2. Install Situational Session Validator
    • 2.13. Configure PingFederate-IdP
      • 2.13.1. Configure SAML Protocol
      • 2.13.2. Create Data Store for Microsoft AD
      • 2.13.3. Create Credential Validator for Microsoft AD
      • 2.13.4. Create IdP Adapter for Authentication with Microsoft AD via Web Browser Form
      • 2.13.5. Create IdP Adapter for Two-Factor Authentication with RSA AA
      • 2.13.6. Create Composite IdP Adapter Integrating Microsoft AD and RSA AA
      • 2.13.7. Create IdP Adapter for the Situational Context Connector and ISE Authentication
      • 2.13.8. Configure the Federation Connection to the Relying Party
      • 2.13.9. Configure ISE Composite Adapter
      • 2.13.10. Applying the Composite Adapter
    • 2.14. Certificates
      • 2.14.1. Certificate Configuration PingFederate
    • 2.15. Functional Test of All Configurations for Section 2
  • 3. Setting up Federated Authentication Between the Relying Party and the Identity Provider
    • 3.1. Introduction
    • 3.2. Components
      • 3.2.1. PingFederate-IdP
      • 3.2.2. PingFederate-RP
    • 3.3. Export Metadata from the Identity Provider
    • 3.4. Configure PingFederate-RP Connection to the PingFederate-IdP
    • 3.5. Functional Test of All Configurations for Section 3
  • 4. Installing and Configuring Microsoft SharePoint Server and Related Components
    • 4.1. Introduction
      • 4.1.1. Components Used in this How-To Guide
      • 4.1.2. Required or Recommended Files, Hardware, and Software
    • 4.2. Installation of Required Components
      • 4.2.1. Installing SQL Server 2012
      • 4.2.2. Installing IIS 8.0 on the SharePoint Server
      • 4.2.3. Installing Microsoft SharePoint Server 2013
    • 4.3. Creating the Web Application (IIS site) in SharePoint
    • 4.4. Creating and Installing SSL Certificate
      • 4.4.1. Self-Signed Certificates
      • 4.4.2. Certificates Signed by Local or Online Certificate Authority
    • 4.5. Creating a Site Collection
    • 4.6. Creating New Sub-Sites
  • 5. Set Up Federated Authentication at the Relying Party’s SharePoint
    • 5.1. Introduction
    • 5.2. Usage Notes on PingFederate
    • 5.3. Configure a SharePoint Federated Logon Provider
      • 5.3.1. Setting up the Certificate
      • 5.3.2. Configuring the Trusted Identity Token Issuer
      • 5.3.3. Configuring the Token Issuer as a Sign On Option
      • 5.3.4. Configuring the Access Control Rule on SharePoint
      • 5.3.5. Functional Test of the Federated Logon at the Resource Provider
    • 5.4. Configure the PingFederate-RP Connection to SharePoint
    • 5.5. Functional Test of All Configurations for Section 5
    • 5.6. Troubleshooting SharePoint Federated Authentication Problems
  • 6. Attribute Exchange between the Identity Provider and Relying Party
    • 6.1. Introduction
    • 6.2. Create Custom User Attributes in Microsoft AD
      • 6.2.1. Preparing the AD Schema for Creating New Custom Attributes
      • 6.2.2. Set Values for Custom User Attributes in Microsoft AD
    • 6.3. Configure PingFederate Servers to Pull User Attributes
      • 6.3.1. Configure PingFederate-IdP to Pull User Attributes During Authentication
      • 6.3.2. Configure PingFederate-IdP to Pull Environmental Attributes During Authentication
      • 6.3.3. Configure PingFederate-RP to Pull Attributes from the Identity Provider’s SAML Exchange
    • 6.4. Configure PingFederate-RP and SharePoint to Pass and Read Attributes
      • 6.4.1. Configure PingFederate-RP to Pass Attributes to SharePoint
      • 6.4.2. Configure SharePoint to Read Custom Attributes from PingFederate-RP
    • 6.5. Configure the Claims Viewer Web Part at the SharePoint Site
      • 6.5.1. Configure SharePoint Claims Viewer
    • 6.6. Functional Test of All Configurations for Section 6
      • 6.6.1. Temporarily Disable SAML Encryption for Testing and Troubleshooting Message Exchanges
  • 7. Setting Up NextLabs to Protect SharePoint
    • 7.1. Introduction
    • 7.2. Components
      • 7.2.1. NextLabs Control Center (release 7.5)
      • 7.2.2. NextLabs Policy Studio: Enterprise Edition
      • 7.2.3. NextLabs Policy Controller
      • 7.2.4. NextLabs Entitlement Manager for Microsoft SharePoint Server
      • 7.2.5. Required or Recommended Files, Hardware, and Software
    • 7.3. Installation and Configuration of NextLabs Control Center (on the SQL Server)
      • 7.3.1. Installation and Configuration
    • 7.4. Installation and Configuration of NextLabs Policy Studio: Enterprise Edition (PAP)
      • 7.4.1. Installation
    • 7.5. Installation and Configuration of Policy Controller (PDP)
      • 7.5.1. Installation
    • 7.6. Installation and Configuration of NextLabs Entitlement Manager for SharePoint Server
      • 7.6.1. Installation and Configuration
    • 7.7. Functional Tests
      • 7.7.1. Verify that the NextLabs Webpart for Policy Enforcement Has Been Successfully Enabled on the Site Collection in SharePoint
      • 7.7.2. Test to Verify the NextLabs Service is Running
  • 8. Defining Policies and Enforcing Access Decisions with NextLabs
    • 8.1. Introduction
      • 8.1.1. Components and Sub-Components Used in this How-To Guide
      • 8.1.2. Pre-requisites to Complete Prior to this How-To Guide
    • 8.2. Policy Strategy
      • 8.2.1. Top-Level Blacklisting Deny Policy, Whitelisting Allow Sub-Policies
      • 8.2.2. Global Policies
    • 8.3. Translation of Business Logic into Policy
      • 8.3.1. ABAC Build Scenario – Runabout Air Business Rules
      • 8.3.2. Translation of Runabout Air Business Rules into ABAC Policies
    • 8.4. Using the NextLabs Policy Studio GUI for Policy Definition and Deployment
      • 8.4.1. Login and Initial Screen in Policy Studio
      • 8.4.2. Policy Studio Menu Commands
      • 8.4.3. Defining and Deploying Components
      • 8.4.4. Defining Policy
      • 8.4.5. Deploying Policy
      • 8.4.6. Modifying and Re-Deploying Policies and Components
      • 8.4.7. Deactivating Policies and Components
      • 8.4.8. Deleting Policies and Components
    • 8.5. Configuring Attributes in NextLabs
      • 8.5.1. Stopping the NextLabs Policy Controller Service
      • 8.5.2. Editing the Configuration File
      • 8.5.3. Restarting IIS via Windows PowerShell
      • 8.5.4. Restarting the NextLabs Policy Controller Service
    • 8.6. Functional Test
      • 8.6.1. Updated Bin File After Policy Creation/Modification
      • 8.6.2. Reviewing NextLabs AgentLog to Illustrate History of Access Control Evaluations during SharePoint Access
  • 9. Leveraging NextLabs Control Center Reporter for Reporting and Auditing Purposes
    • 9.1. Introduction
      • 9.1.1. Components Used in this How-To Guide
      • 9.1.2. Pre-requisites to Complete Prior to this How-To Guide
    • 9.2. Introduction to NextLabs Control Center Reporter
      • 9.2.1. Opening Reporter
    • 9.3. Introduction to Reporter Dashboard
      • 9.3.1. Exploring the Dashboard
    • 9.4. Introduction to Defining and Running Custom Reports in Reporter
      • 9.4.1. Defining a Custom Report
      • 9.4.2. Running a Custom Report
    • 9.5. Example Custom Report and Available Formats
      • 9.5.1. Defining the Example Custom Report
      • 9.5.2. Format: Table of Event Data
      • 9.5.3. Format: Bar Chart Grouped by Policy Chart
      • 9.5.4. Format: Bar Chart Grouped by User Chart
      • 9.5.5. Format: Pie Chart Grouped by Resource
    • 9.6. Further Example Custom Reports from Our Build
      • 9.6.1. Custom Report Illustrating All Access for One User During a Two-Month Period
      • 9.6.2. Viewing Access Attempts on Individual Resources
  • 10. Configuring a Secondary Attribute Provider
    • 10.1. Introduction
      • 10.1.1. Pre-Requisites
      • 10.1.2. Criteria for Secondary Attribute Collection
      • 10.1.3. Components
    • 10.2. Component Software and Hardware Requirements
    • 10.3. Ping Custom Data Store
      • 10.3.1. Functionality and Architecture
      • 10.3.2. Deploying the Ping Custom Data Store
      • 10.3.3. Compilation
      • 10.3.4. Configuration within PingFederate Administrative Console
    • 10.4. NextLabs PIP Plugin
      • 10.4.1. Architecture
      • 10.4.2. Understanding How the NextLabs PIP Plugin Interacts with Build Components
      • 10.4.3. Compilation and Deployment
    • 10.5. Protocol Broker
      • 10.5.1. Architecture
      • 10.5.2. Deployment
      • 10.5.3. Example SAML Request and Response Output
    • 10.6. Apache Directory Service (ApacheDS)
      • 10.6.1. Layout
      • 10.6.2. Download
      • 10.6.3. Installation
      • 10.6.4. Starting and Stopping the Server
      • 10.6.5. ApacheDS Configuration
    • 10.7. PingFederate - Apache Integration
      • 10.7.1. Provisioning of Server Credential
    • 10.8. Configuration of PingFederate to Query the JIT Cache when Responding to Secondary Attribute Requests
      • 10.8.1. Introduction
      • 10.8.2. Prerequisites
    • 10.9. ApacheDS Schema Extension
      • 10.9.1. Pre-Requisites
      • 10.9.2. Procedure
    • 10.10. Functional Tests
      • 10.10.1. Testing the Ready State of the NextLabs Policy Controller Service
      • 10.10.2. Test the Successful Loading of the Custom Plugin Within the NextLabs Policy Controller Software Architecture
      • 10.10.3. Testing That the Protocol Broker .war File Loads Correctly in Tomcat Server