FORTRESS is a standards-based authorization system, that provides role-based access control, delegated administration and password policy services using an LDAP backend.
Included are the following components:
It's released under terms of the Apache License 2.0.
It uses a directory server to store the information about users, roles, permissions, etc. Out-of-the-box it supports either ApacheDS or OpenLDAP servers but works with any LDAPv3 compliant system.
Probably the best place to start is the javadoc. To understand how RBAC works, look at the interfaces like AccessMgr, AdminMgr and ReviewMgr. For ARBAC add ‘Del’ to the name - for delegated. DelAdminMgr, DelAccessMgr, etc. For password policies, PwPolicyMgr.
Fortress products run on open system hardware and software platforms supporting LDAPv3, HTTP & Java.
The following standards are implemented...
There is more to RBAC than assigning users to groups and applying ACL policies within directories or databases. RBAC systems provide selective Role activation/deactivation, role hierarchies, and constraints over separation of duty. The RBAC component provides APIs to add, update, delete, and search the directory data
More info can be found on Intro to ANSI RBAC Page
Used for SSL, X.509 mutual authentication, form-based container authentication, authorization and SSO. Works within compliant Java Web apps like Fortress Rest and Web.
The ARBAC model explains how RBAC can be extended with organizational controls to govern policies regarding the security administration process. ARBAC helps by allowing administrative tasks be delegated to end users who fall outside typical datacenter operations.
Fortress fully supports password policies of both ApacheDS and OpenLDAP. It adds by integrating with its administrative and access control APIs. These APIs enable outside apps to participate and manipulate OpenLDAP password policies without understanding the specifics of how they work. Fortress provides services for setting up new policies and ensuring password policies are tracked and enforced across all avenues.
Fortress audits use OpenLDAP's slapd access log overlay.
The Fortress audits rely on slapd events to track its data exchanges performed within its own APIs. Change event tracking includes adds, updates, and deletes of Fortress entities. Read and search events tracked include user authentication, authorization, and policy interrogations. Full historical data change tracking is maintained and may be searched later with APIs to be used for monitoring, reporting, and undo. The log may be retrieved later to synch with outside database for long-term regulatory and compliance concerns.
The Fortress Temporal model allows Users and Roles to carry time and date Constraints which govern when activations may occur. Role constraints are checked on every call into Fortress. The user constraint applied only at session creation.
Not yet but does check attributes during the user-role activation phase as described in this LDAPCon presentation: Towards an Attribute-Based Role-Based Access Control System
Over one hundred services divided across the Manager components.
A description of these managers follow along with their associated javadoc links that describe the apis...
Source is managed by Apache's GIT repo: