GB2640111A - Authorization policy validation - Google Patents

Abstract

A system and method for authorization policy validation. A validator takes as input an authorization policy to be analyzed and a schema that specifies entity types and their attributes, types of entity parents in an entity hierarchy, and which entity types can be used with which actions. The validator checks that the policy conforms to the schema. If the check passes, then the policy is guaranteed to be free of both type errors and attribute access errors for any input that conforms to the schema.

Claims (1)

1. CLAIMS What is claimed is: 1. A computer-implemented method comprising: obtaining an authorization policy schema; determining whether there are any inconsistencies between an authorization policy in an authorization policy language and the authorization policy schema such that if there are no determined inconsistencies between the authorization policy and the authorization policy schema, then the authorization policy is guaranteed to be free of runtime type errors and free of runtime attribute access errors for any input that conforms to the authorization policy schema; determining one or more inconsistencies between the authorization policy and the authorization policy schema; and causing display of information indicating that the authorization policy is invalid with respect to the authorization policy schema. 2. The method of claim 4, further comprising: storing a set of entities arranged in an entity hierarchy; and wherein the authorization policy further comprises at least one expression in terms of one or more entities in the entity hierarchy. 3. The computer-implemented method of claim 1, wherein the authorization policy schema and the authorization policy are identified to a policy validator by parameters in a command line invocation of the policy validator. 4. The computer-implemented method of claim 1, wherein the authorization policy language is a dynamically typed language. 5. The computer-implemented method of claim 1, wherein the authorization policy comprises: (a) an effect;

   1. Atty. Docket No.: 1030P80219WO 82 (b) an authorization policy head that selects one or more principals, one or more actions, or one or more resources to which the authorization policy applies; and (c) one or more optional conditional clauses that further refine the circumstances under which the authorization policy applies; 6. The computer-implemented method of any one of claims 1-5, further comprising: detecting a Boolean expression in the authorization policy that dereferences an optional attribute of an entity without checking for existence of the optional attribute of the entity as a condition precedent; and wherein the information displayed indicates that the Boolean expression lacks a check for existence of the optional attribute of the entity as a condition precedent. 7. The computer-implemented method of any one of claims 1-5, further comprising: detecting an entity type in the authorization policy that is not an entity type listed in the entity types specification; and wherein the information displayed indicates the entity type in the authorization policy. 8. The computer-implemented method of any one of claims 1-5, further comprising: detecting an action in the authorization policy that is not an action listed in the actions specification; and wherein the information displayed indicates the action in the authorization policy. 9. The computer-implemented method of any one of claims 1-5, further comprising: detecting an action in the authorization policy that is applied to an unsupported principal or resource in the authorization policy; and wherein the information displayed indicates the action in the authorization policy and indicates the unsupported principal or resource in the authorization policy to which the action is applied. 10. The computer-implemented method of any one of claims 1-5, further comprising: detecting an improper use of a hierarchy containment operator in the authorization policy; and wherein the information displayed comprises a hint about proper use of the hierarchy containment operator in an authorization policy. Atty. Docket No.: 1030P80219WO 83

   11. The computer-implemented method of any one of claims 1-5, further comprising: detecting an improper use of an equality operator in the authorization policy; and wherein the information displayed comprises a hint about proper use of the hierarchy containment operator

   12. The computer-implemented method of any one of claims 1-5, further comprising: detecting an unrecognized attribute of an entity in the authorization policy that is not specified as an attribute of the entity in the authorization policy schema; and wherein the information displayed indicates the unrecognized attribute

   13. The computer-implemented method of any one of claims 1-5, further comprising: detecting a type mismatch in an operator expression in the authorization policy, the operator expression comprising an operator having valid semantics on only certain data types, the operator expression applying the operator to a value of a data type for which the operator does not have valid semantics; and wherein the information displayed indicates the type mismatch

   14. The computer-implemented method of any one of claims 1-5, further comprising: detecting that the authorization policy always evaluates to false; and wherein the information displayed indicates that the authorization policy always evaluates to false .

   15. A system comprising: a first set of one or more electronic devices to implement an authorization policy validation service in a provider network, the authorization policy validation service comprising instructions which when executed cause the authorization policy validation service to perform a method as recited in any one of claims 1-14. Atty. Docket No.: 1030P80219WO 84