| 141 | | |
| 142 | | === ABAC Encoding (simple delegation) === |
| 143 | | |
| 144 | | For the purposes of the example, we assume that there is a GENI principal that has allocated an empty slice for the contest. That slice will be expanded and configured by principals with the GENI.adminCTF attribute and accessible by players with the GENI.accessCTF attribute. We now lay out the attribute policies for allocating these two attributes. |
| 145 | | |
| 146 | | Because the set of officials is small, the ACM chooses to administer them directly. To support this the GENI principal delegates the adminCTF attribute to the ACM principal: |
| 147 | | |
| 148 | | [[Image(example1.png)]] |
| 149 | | |
| 150 | | And the ACM principal authorizes principals by making them officials. |
| 151 | | |
| 152 | | [[Image(example2.png)]] |
| 153 | | |
| 154 | | The ACM principal can add or delete officials independently, and those officials have admin rights to the slice automatically. |
| 155 | | |
| 156 | | Of course, both the ACM and GENI will be assigning other attributes unrelated to this project, so their attribute space may be large enough that we provide a tool to maintain these spaces and their ramifications. Most of the images in this section are screenshots from that application. The image below is the result of a query for all users with the GENI.CTFadmin attributes from a set of attributes that includes those above. The two above are only the local attribute spaces of the two principals, below is a summary of both. (Principals who have the attribute are flagged by the bold red border, though all principals in this case have the rights). |
| 157 | | |
| 158 | | [[Image(example3.png)]] |
| 159 | | |
| 160 | | === ABAC Encoding (linked roles) === |
| 161 | | |
| 162 | | Because there are many more contestants than officials and the qualifying requirements are locally decided, the access rights to the contest slice are administered more loosely. This time GENI delegates access to the principals that ACM's CTFreps designate as contestants. |
| 163 | | |
| 164 | | [[Image(example4.png)]] |
| 165 | | |
| 166 | | ACM now selects principals at each participating university that can authorize contestants (CTFreps). |
| 167 | | |
| 168 | | [[Image(example5.png)]] |
| 169 | | |
| 170 | | The USC principal selects students individually: |
| 171 | | |
| 172 | | [[Image(example6.png)]] |
| 173 | | |
| 174 | | The MIT principal opens the contest to all MIT students: |
| 175 | | |
| 176 | | [[Image(example7.png)]] |
| 177 | | |
| 178 | | And the UCLA principal further delegates the authority to its local ACM officers: |
| 179 | | |
| 180 | | [[Image(example8.png)]] |
| 181 | | |
| 182 | | Those officers then select individual students: |
| 183 | | |
| 184 | | [[Image(example9.png)]] |
| 185 | | |
| 186 | | These local decisions make for a rich global attribute derivation graph. As before determining which principals can access the graph is done by a depth first search through the graph. |
| 187 | | |
| 188 | | [[Image(example10.png)]] |
| 189 | | |
