summaryrefslogtreecommitdiff
path: root/doc/share/authz/README.md
diff options
context:
space:
mode:
Diffstat (limited to 'doc/share/authz/README.md')
-rw-r--r--doc/share/authz/README.md69
1 files changed, 0 insertions, 69 deletions
diff --git a/doc/share/authz/README.md b/doc/share/authz/README.md
deleted file mode 100644
index 5b7da3fb..00000000
--- a/doc/share/authz/README.md
+++ /dev/null
@@ -1,69 +0,0 @@
-# Authz
-
-## Access Control Models
-
-Access Controls provide a means of restricting access to objects based on the
-identity of subjects and/or groups to which they belong.
-
-* Role-Based Access Control ([RBAC](./RBAC.md))
-* Relationship-Based Access Control ([ReBAC](./ReBAC.md))
-* Attribute-Based Access Control ([ABAC](./ABAC.md))
-
-Authentication (Authn) is used to determine that users or systems are who they
-claim to be and provide proof in the form of identity principals and attributes.
-
-Authorization (Authz) is used to decide what privileges an actor has within a
-system.
-
-## Policy
-
-* [What is a policy?](./POLICY.md)
-* Policy Language Evaluation
- * Casbin
- * Cedar
- * [Dafny](https://dafny.org/)
- * Rego
-
-Criteria for evaluating policy languages:
-
-* Must be able to model different types of access control models (RBAC, ReBAC, ABAC)
-* Must be able to perform static analysis
-* Must be actively supported
-* Must have concise documentation
-* Must provide ability to extend language using Ruby/Golang for describing complex policies.
-* Must have a compatible license that permits the way that we can use it.
-
-Ideally, we must be able to model the following relationships:
-
-| type | required |
-| ---- | -------- |
-| `user-to-resource` | required |
-| `resource-to-resource` | required |
-| `user-to-user` | not required |
-
-Note: `user-to-user` relationships are not in the current access control model.
-
-## Architecture
-
-```plaintext
- ------------------ ------- -------------
- | Users/Services |--->| PEP |--->| Resources |
- ------------------ ------- -------------
- | A
- V |
- ------- ------------ -------
- | PDP |-->| Policies |<---| PAP |
- ------- ------------ -------
- | A A
- V | |
- ------- -----------------
- | PIP | | Administrator |
- ------- -----------------
-
-PAP: Policy Administration Point
-PDP: Policy Decision Point
-PEP: Policy Enforcement Point
-PIP: Policy Information Point
-```
-
-* [Kubernetes Policy Management](https://github.com/kubernetes/sig-security/blob/main/sig-security-docs/papers/policy/kubernetes-policy-management.pdf)