4.1.7 - Real time access control decision making

[EnigmaRosa]

Note: this is referenced as 4.1.10 in #2033, but I updating the numbering to account for the skipped requirements.

I propose the addition of a new requirement that addresses the need for access decisions to be made on the most current permissions information. For example, let's say a user's access permissions are modified while that user has an active session (i.e. admin revokes access to edit files) - if the system does not check the user's permissions in real time (i.e. instead relying on cached access information), the user would be able to edit a file, which they should no longer be able to do.

#	Description	L1	L2	L3	CWE
4.1.7	[ADDED] Verify that the access control system makes real-time access control decisions based on current permissions values.	✓	✓	✓

[elarlang]

We have a requirement

#	Description	L1	L2	L3	CWE	NIST §
3.5.7	[ADDED] Verify that all active stateless tokens, which are being relied upon for access control decisions, are revoked when admins change the entitlements or roles of the user.	✓	✓	✓	613

I have proposed to move it to access control in #1917

We don't have a matching requirement for the same situation in the "classical session management" - if the permissions for the user are changed, it must have immediate effect. Such as in case those are buffered to session data, those also must be "revoked".

So maybe we need to make this requirement to cover both situations and to be more abstract. Or do we need to have another requirement for "classical session management".

It may make sense to read the issue, as there are other related comments, but let's continue the discussion in this issue.

[jmanico]

Note: revoking the token is pretty dramatic. I'd rather set up a rule with the new access control policy for that user (using some caching method) so the user experience is not effected. If you can revoke an active token, then having a "access control over-ride" list is just as easy.

[randomstuff]

Verify that all active stateless tokens

Apparently (today I learned), the blessed lingo for that would be/become "self-encoded tokens"?