Create sor-to-access-policy.adoc

sor-to-access-policy.adoc

@@ -0,0 +1,56 @@
+- - -
+_2022-07-27 11:11 data/process flow from SoR/LoB data model to allow/deny decision for access to a resource_
+
+==== Documenting the journey from System of Record data to access policy decisions
+*Systems of Record: SoR* +
+` native data that potentially plays a role in access decisions +
+` processes and technologies by which native data is made available outside the system boundary +
+
+*Basis groups to Reference groups*
+
+` See https://spaces.at.internet2.edu/display/Grouper/Folder+and+Group+Design[Grouper Deployment Guide section on folder and group design] +
+
+` Raw *SoR* data to *Basis* groups +
+` One or more *Basis* groups make up a *Reference* group
+
+*Examples of common Reference groups* +
+
+` Under the top level *App* stem: Applications (resources, services): Under this stem: access policies for the named App +
+` Under the top level *Org* stem: Organizations: Under this stem are organizational units to which subjects belong and that may bear on what they have access to
+
+*Access Policy groups*: Composites of Reference groups plus *Include* and *Exclude* groups to refine memberships to match originally intended definitions
+
+*Account Policy groups*: Typically contain one *Allow* group and one *Deny* group: Membership in an Account Policy group directly specifies whether a subject is allowed access to a service or not
+
+
+==== Policy rules
+
+https://spaces.at.internet2.edu/display/Grouper/Grouper+rules+use+cases[Useful rule primitives] from Grouper wiki
+
+https://spaces.at.internet2.edu/display/Grouper/Grouper+rules+use+case+-+Composite-ng+intersection[Example Policy Rule]: To be considered IT staff a person must be *IT Staff* AND an *[Active] Employee (including hospital employees)*
+
+
+gsh 0% grouperSession = GrouperSession.startRootSession();
+
+gsh 1% *itStaff_includes* = GroupFinder.findByName(grouperSession, "penn:community:employee:itStaff_includes");
+
+gsh 2% *employeeIncludingUphs* = GroupFinder.findByName(grouperSession, "penn:community:employeeIncludingUphs");
+
+gsh 3% subjectActAs = SubjectFinder.findByIdAndSource("GrouperSystem", "g:isa", true);
+
+gsh 4% *RuleApi.groupIntersection*(subjectActAs, *itStaff_includes*, *employeeIncludingUphs*);
+
+- - -
+
+https://spaces.at.internet2.edu/display/Grouper/Grouper+rules+use+case+-+Veto+if+not+eligible[*Another supported policy rule*]
+
+```
+RuleApi.vetoMembershipIfNotInGroupInFolder(
+
+SubjectFinder.findRootSubject(),
+
+ruleGroup, mustBeInStem, Stem.Scope.SUB,
+"rule.entity.must.be.in.IT.employee.to.be.in.group",
+"Entity cannot be a member of group if not in the IT department org"
+);
+```