Barracuda Networks SSL VPN, Руководство администратора

Страница: 55 / 124

Access Control 55
Access Control Architecture
The access control framework has been designed to tackle the following main issues.
• Users and Groups : Each organization’s view on users and groups is almost always different.
They do though share common behavior, i.e. ‘Add User/Group’ or ‘Delete User/Group’. It is
also likely that the organization’s user/group directory already existed prior to the introduction
of this appliance, for example an existing Active Directory domain or LDAP directory. The
variety offered by such choice invariably gives rise to a number of different approaches and
implementations.
• Resource Access : The intended outcome when implementing an SSL VPN solution is to allow
remote access to network-based resources. The number of different types of network resource is
relatively varied and new methods are likely to appear.
• Resource Distribution : A resource created within the system must be easily made accessible to
those users that require it. Assigning resources on a per-user basis should be avoided wherever
possible.
• Resource Permissions : Resources can have a range of permissions to limit how they may be
assigned. When a resource is assigned to a user the user must be restricted to the access rights
given. For example, a super user may create a resource to administer creation and assignment of
application shortcuts only. This resource is assigned to a user who then attempts to delete an
existing application shortcut; this operation will be declined.
In order to resolve the aforementioned issues the access control architecture relies on three key
entities:
• Principal : The intended ‘consumer’ of the resources, i.e. a user or a group.
• Resource : The networked resource, internal function or property item that the principal wishes
to utilize, i.e. a Web Forward or the right to manage accounts.
• Policy : The relationship defined between the principal and resource. It is the component that
ensures that only the right people can perform the right action.
Utilizing this methodology, the Barracuda SSL VPN is able to maintain robust, secure, and flexible
access control architecture.
Principals
As already mentioned, the ‘principal’ simply refers to a user or group of users. The principal entity
sits at one end of the access control chain. The process flow begins with this entity and ends with the
resource entity.