- David Chadwick, GansenZhao, Sassa Otenko, Romain
Laborde, Linying Su and Tuan Anh Nguyen. “PERMIS: a modular authorization
infrastructure”. Concurrency And Computation: Practice And Experience. Volume
20, Issue 11, Pages 1341-1357, 10 August 2008. Online ISSN: 1532-0634. Print
ISSN: 1532-0626. DOI: 10.1002/cpe.1313. Download here.
- David W Chadwick, Sassa Otenko and
Tuan Anh Nguyen. “Adding Support to XACML for Multi-Domain User to User Dynamic
Delegation of Authority”. International
Journal of Information Security. Volume 8, Number 2 / April, 2009 pp
137-152. DOI 10.1007/s10207-008-0073-y. Download here
W Chadwick, George Inman. “Attribute Aggregation in Federated Identity
Management”. IEEE Computer, May 2009, pp 46-53. Download here
- David Chadwick. “The X.509 Privilege Management
Standard”. Upgrade - The European Journal for the Informatics Professional,
Vol. VI, No. 4, Aug 2005 pp41-46. Available from http://www.upgrade-cepis.org/issues/2005/4/up6-4Chadwick.pdf
- D.W.Chadwick, A. Novikov, A.
Otenko.“GridShib and PERMIS Integration“. Campus-Wide Information Systems. Vol
23, No 4. 2006. pp297-308 ISSN 1065-0741. Download here
A. Otenko, E.Ball. “Role-based access control with X.509 attribute
certificates”, IEEE Internet Computing, March-April 2003, Vol 7, Issue 2, pp.
A. Otenko “The PERMIS X.509 Role Based Privilege Management Infrastructure”.
Future Generation Computer Systems, Vol 19, Issue 2, Feb 2003. pp 277-289. Download here
- D.W.Chadwick, A. Otenko. “RBAC Policies in XML for
X.509 Based Privilege Management” in Security in the Information Society:
Visions and Perspectives: IFIP TC11 17th Int. Conf. On Information
Security (SEC2002), May 7-9, 2002, Cairo, Egypt. Ed. by M. A. Ghonaimy, M. T.
El-Hadidi, H.K.Aslan, Kluwer Academic Publishers, pp 39-53. Download here
The PERMIS X.509 Based Privilege
Latest PERMIS Policy Schema
The latest policy schema can be found here:
PERMIS Policy Schema Version
5.6. All software packages that start with a version number of 5 expect
this schema. Consequently they will not work when using a policy
that doesn't obey this schema. In particular policies created with the
Policy Editor with a version number less than 5 don't follow this schema.
The older version of the PERMIS schema, now deprecated, can be downloaded from here.
Version 5.6 added a new policy parameter "EnableNotApplicable" which allows the PDP to choose between a mode of operation where results which are neither Permit nor Indeterminate will return NotApplicable (EnableNotApplicable set to true) or a mode where Deny is returned instead (EnableNotApplicabke set to false - default behaviour).
PERMIS Policy DTD Version
42 - the DTD for the PERMIS Policy and Sub-Policies. The DTD contains
inline comments about the meaning of the elements.
PERMIS Policy Schema Version
42 - the schema for the PERMIS Policy and Sub-Policies.
All ISSRG classes - the documentation
for all packages we produced, including Privilege Allocator and PBA API.
Decision Making In PERMIS - this document discusses how the core PERMIS API should make its decisions and how the returned
responses and exceptions should be translated into one of the four possible XACML decisions (Grant,
Deny, Indeterminate, NotApplicable).
Programmers Guide - Programming with the PERMIS API.
Here are the examples (and libraries) to supplement the Programmers Guide.
documentation contains a short description of the Access Control model
we use. However, it is a C API, so that is where the similarities end.
Note that the model corresponds to the ISO10181-3
Access Control Framework, which describes the model under which PERMIS
was conceived and built