Repeatable NGAC policy class structure
In implementations of a repeatable NGAC policy class structure, a computing device implements a next generation access control (NGAC) graph that includes user elements representing users, object elements representing resources, and multiple policy classes modeled with a composable policy class structure that is repeatable to instantiate each of the multiple policy classes in the graph. The composable policy class structure includes a policy class as enforceable access criteria by which the user elements are allowed or denied access to the object elements that represent the resources, an exclusion default object node and an exclusion default user node of the policy class, and an association that indicates object elements contained as members of the exclusion default object node granting all policy permissions to user elements contained as members of the exclusion default user node. The NGAC graph can be utilized to compute an access control decision across the multiple policy classes.
1 . A computing device, comprising:
a memory to maintain a next generation access control (NGAC) graph having a bifurcated structure with a user section and an object section, the user section including users modeled as user elements of the NGAC graph and the object section including resources modeled as object elements of the NGAC graph;
a graph module implemented at least partially in computer hardware and configured to configure multiple policy classes utilizing a composable policy class structure that is repeatable to instantiate each of the multiple policy classes in the NGAC graph, the composable policy class structure including a policy class as enforceable access criteria by which the users are allowed or denied access to the resources, an exclusion default object node of the policy class instantiated in the object section of the NGAC graph, an exclusion default user node of the policy class instantiated in the user section of the NGAC graph, and an association that indicates the exclusion default object node granting all policy permissions of the policy class to the exclusion default user node, and wherein the NGAC graph includes a policy node modeled in the user section of the NGAC graph, wherein one or more of the user elements that each represent a respective user in the user section of the NGAC graph are assigned as a member of the policy node;
a policy decision module implemented at least partially in computer hardware to evaluate the NGAC graph to determine graph information relative to one or more of a user element based at least in part on the exclusion default user node or an object element based at least in part on the exclusion default object node, the policy decision module configured to:
receive a request for a user element to access an object element of a resource within the policy class;
compute a single access control decision across different types of the multiple policy classes utilizing the NGAC graph; and
output an access control decision that indicates to allow or deny the user element access to the object element of the resource based at least in part on whether the user element is a member of the policy class as designated by the exclusion default user node of the policy class.
2 . The computing device of claim 1 , wherein the association indicates that the object elements contained as members of the exclusion default object node grant all of the policy permissions to the user elements that are members of the exclusion default user node.
3 . The computing device of claim 2 , wherein the policy permissions granted by the object elements allow the users to perform operations on contents of the object elements that represent the resources.
4 . The computing device of claim 1 , wherein:
one or more the user elements that represent the users in the user section of the NGAC graph are each contained as a member of the policy class via the exclusion default user node of the policy class; and
one or more the object elements that represent the resources in the object section of the NGAC graph are each contained as a member of the policy class via the exclusion default object node of the policy class.
5 . The computing device of claim 1 , wherein the composable policy class structure is repeatable, from which the multiple policy classes are instantiated in the NGAC graph, including the multiple, different types of policy classes.
6 . The computing device of claim 5 , wherein the single access control decision is based on a strict evaluation mode configured as an intersection of the policy permissions granted by the object elements to access the resources for the user elements.
7 . The computing device of claim 5 , wherein the multiple, different types of policy classes include at least a location policy class and a role-based access control (RBAC) policy class.
8 . The computing device of claim 1 , wherein the NGAC graph includes separable policy bindings modeled in the user section of the NGAC graph, each separable policy binding corresponding to one of the multiple policy classes, and wherein a separable policy binding is assigned to the corresponding one of the multiple policy classes.
9 . The computing device of claim 8 , wherein the policy node is assigned to the separable policy bindings in the user section of the NGAC graph.
10 . A computing device comprising:
a memory to maintain a next generation access control (NGAC) graph that includes user elements representing users, object elements representing resources, and multiple policy classes modeled with a composable policy class structure that is repeatable to in stantiate each of the multiple policy classes in the NGAC graph, the composable policy class structure including a policy class as enforceable access criteria by which the users are allowed or denied access to the resources, an exclusion default object node of the policy class instantiated in an object section of the NGAC graph, and an exclusion default user node of the policy class instantiated in a user section of the NGAC graph, and wherein the NGAC graph includes a policy node modeled in the user section of the NGAC graph, wherein one or more of the user elements that each represent a respective user in the user section of the NGAC graph are assigned as a member of the policy node;
a policy decision module implemented at least partially in computer hardware to evaluate the NGAC graph for an access control decision, the policy decision module configured to:
execute an instantiation of the NGAC graph;
receive a request for a user element to access an object element of a resource within the policy class in conformance with a granted access permission implemented in the NGAC graph;
compute the access control decision across the multiple policy classes utilizing the NGAC graph as a basis to evaluate whether the user element is authorized to access the object element of the resource; and
return, in response to the request, the access control decision that indicates to allow or deny the user element access to the object element of the resource based at least in part on whether the user clement is a member of the policy class as designated by the exclusion default user node of the policy class.
11 . The computing device of claim 10 , wherein the composable policy class structure comprises an association that indicates the object elements contained as members of the exclusion default object node grant all policy permissions of the policy class to the user elements that are members of the exclusion default user node.
12 . The computing device of claim 11 , wherein the policy permissions granted by the object elements allow the user elements to perform operations on contents of the object elements that represent the resources.
13 . The computing device of claim 11 , wherein:
one or more of the user elements are each contained as a member of the policy class via the exclusion default user node of the policy class; and
one or more of the object elements are each contained as a member of the policy class via the exclusion default object node of the policy class.
14 . The computing device of claim 10 , wherein:
the access control decision is computed as a single access control decision across different types of the multiple policy classes in the NGAC graph; and
the single access control decision is based on a strict evaluation mode configured as an intersection of the policy permissions granted by the object elements to access the resources for the user elements.
15 . The computing device of claim 14 , wherein the different types of the multiple policy classes in the NGAC graph include two or more of a location policy class, a role-based access control (RBAC) policy class, or a time policy class.
16 . The computing device of claim 10 , wherein:
the NGAC graph includes separable policy bindings that each correspond to one of the multiple policy classes; and
the separable policy bindings are each assigned to the corresponding one of the multiple policy classes.
17 . The computing device of claim 16 , wherein:
the NGAC graph includes the policy node assigned to the separable policy bindings; and
one or more of the user elements that each represent a respective user are assigned as a member of the policy node.
18 . A computing device implemented for graph-based access control in a digital medium environment, the computing device comprising:
a memory to maintain a next generation access control (NGAC) graph that includes user elements representing users, object elements representing resources, and multiple policy classes modeled with a composable policy class structure that is repeatable to instantiate each of the multiple policy classes in the NGAC graph, the composable policy class structure including a policy class as enforceable access criteria by which the users are allowed or denied access to the resources, an exclusion default object node of the policy class instantiated in an object section of the NGAC graph, and an exclusion default user node of the policy class instantiated in a user section of the NGAC graph, and wherein the NGAC graph includes a policy node modeled in the user section of the NGAC graph, wherein one or more of the user elements that each represent a respective user in the user section of the NGAC graph are assigned as a member of the policy node;
a policy decision module implemented at least partially in computer hardware to:
receive a request for a user element to access an object element of a resource in conformance with an access permission granted to the user element implemented in the NGAC graph;
compute an access control decision across the multiple policy classes utilizing the NGAC graph as a basis to evaluate whether the user element is authorized to access the object element of the resource; and
initiate a response to the request as the access control decision that indicates to allow or deny the user element access to the object element of the resource based at least in part on whether the user element is a member of the policy class as designated by the exclusion default user node of the policy class.
19 . The computing device of claim 18 , wherein the policy decision module is configured to model the multiple policy classes utilizing the composable policy class structure, which comprises an association that indicates the object elements contained as members of the exclusion default object node grant all policy permissions of the policy class to the user elements that are members of the exclusion default user node.