[Ticket] Management Endpoint for ABAC

[FriedJannik]

User Story

As a System Administrator, I need a management Endpoint, so that i can change ABAC rules at runtime.

---

Rules

• What: We need endpoints to manage ABAC rules:

  • GET /rules - GETs all available rules
  • GET /rules/{ruleID} - GETs a rule by its specific ruleID
  • POST /rules - Bulk creation of ABAC Rules
  • POST /rule/{ruleID} - POSTs a new rule - 409 on conflict
  • PUT /rule/{ruleID} - Creates/Replaces a rule by ID - Creates rule if not exists!
  • PATCH /rule/{ruleID} - Updates (also partially) a rule - 404 if not found
  • DELETE /rule/{ruleID} - DELETEs a rule by ID

• These Endpoints should be implemented in internal/common and must only be imported by the individual components

• They should be dependency injected

• Authorization: Attribute "management_role: superuser"

• For MVP: All access or no access - no ABAC for now.

• Token: Must be the same as for the standardized endpoints.

• The Feature should be disableable -> Enabled with ABAC by default.

• When: The Endpoints are "present" if ABAC is enabled and a authorized request is sent - otherwise the Endpoints must return 404 Not Found.

Examples:

• ABAC is disabled and a user tries to access the /rules* endpoints:

  • 404 Not Found

• ABAC is enabled and a unauthorized user tries to access the /rules* endpoints:

  • 404 Not Found

• No ORM -> Model Classes will likely be put into an SDK

---

Entry Points

• ABAC Rules
• ABAC Engine
• ABAC Model
• Martin
• For importing Endpoints from common see HealthEndpoint (see main.go of submodelrepository, aasregistry)

---

Acceptance Criteria

• At least one Component that has security, showcases the use of those endpoints
• Integration Tests are present
• Feature and Endpoints are well documented (User and Developer Documentation)
  • How to set up
  • How to set up keycloak
  • How to create a valid user for the management endpoints
  • How to obtain access token
• Example Setup

The goal is that the user can set-up a complete secured and managed [1] Component, so that he doesn't need help from a third-party source.

---

Risks and Assumptions

• Assumption: The Token can be easily reused
• Assumption: The endpoints and rules are abstract enough to put them into common

---

[1] - "Managed" -> Management Endpoints enabled

[Martin187187]

Do not support materialization (e.g. DEFOBJECTS) in management endpoints for simplicity.

[Martin187187]

Add Endpoint that returns entire access rule file.

[Martin187187]

Please discuss if we want to add trustlist endpoints aswell in the management endoint. It is a part of the security (#136). This trustlist endpoint should manage which IDPs are allowed.
I would suggest:

GET /idps - GETs all trusted idps
GET /idp/{id} GET trusted idp
POST /idp POST new trusted idp
PUT /idp/{id} replace trusted idp with new idp
DELETE /idp/{id} delete idp

Here is an example of such trustlist (is not a final version). Such xml will be part of the specification in the future:

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<TrustServiceStatusList
    xmlns="http://uri.etsi.org/02231/v2#"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    Id="TrustServiceStatusList-1"
    TSLTag="http://uri.etsi.org/TrstSvc/TrustedList/TSLTag"
    xsi:schemaLocation="http://uri.etsi.org/02231/v2#
        https://forge.etsi.org/rep/esi/x19_612_trusted_lists/-/raw/v2.4.1/19612_xsd.xsd">

  <SchemeInformation>
    <TSLVersionIdentifier>5</TSLVersionIdentifier>
    <TSLSequenceNumber>148</TSLSequenceNumber>
    <TSLType>http://MxLeo/TrstSvc/TrustedList/TSLType/EUgeneric</TSLType>

    <SchemeOperatorName>
      <Name xml:lang="en">FX Operating Company</Name>
    </SchemeOperatorName>

    <SchemeOperatorAddress>
      <PostalAddresses>
        <PostalAddress xml:lang="en">
          <StreetAddress>Leo Str</StreetAddress>
          <Locality>Leoland</Locality>
          <PostalCode>12345</PostalCode>
          <CountryName>DE</CountryName>
        </PostalAddress>
      </PostalAddresses>

      <ElectronicAddress>
        <URI xml:lang="en">mailto:MxLeo@fx.de</URI>
        <URI xml:lang="en">https://MxLeo/TL-Links/repository.html</URI>
      </ElectronicAddress>
    </SchemeOperatorAddress>

    <SchemeName>
      <Name xml:lang="en">
        Trusted list for MX Port Leo including information related to the trust service providers and trust services
      </Name>
    </SchemeName>

    <SchemeInformationURI>
      <URI xml:lang="en">https://MxLeo/TL-Links/tsl_e.html</URI>
    </SchemeInformationURI>

    <StatusDeterminationApproach>
      http://MxLeo/TrstSvc/TrustedList/StatusDetn/EUcommon
    </StatusDeterminationApproach>

    <SchemeTypeCommunityRules>
      <URI xml:lang="en">
        http://MxLeo/TrstSvc/TrustedList/schemerules/EUcommon
      </URI>
    </SchemeTypeCommunityRules>

    <SchemeTerritory>EU</SchemeTerritory>

    <PolicyOrLegalNotice>
      <TSLLegalNotice xml:lang="en">
        The applicable legal framework for the present trusted list is Regulation (EU) No 910/2014...
      </TSLLegalNotice>
    </PolicyOrLegalNotice>

    <HistoricalInformationPeriod>65535</HistoricalInformationPeriod>
    <ListIssueDateTime>2025-09-16T12:30:00Z</ListIssueDateTime>

    <NextUpdate>
      <dateTime>2026-03-16T13:30:00Z</dateTime>
    </NextUpdate>

    <DistributionPoints>
      <URI>https://MxLeo/TL-MxPort.xml</URI>
    </DistributionPoints>
  </SchemeInformation>

  <TrustServiceProviderList>

    <TrustServiceProvider>
      <TSPInformation>
        <TSPName>
          <Name xml:lang="de">Factory-X TP Demo</Name>
        </TSPName>

        <TSPTradeName>
          <Name xml:lang="en">VAT-xyz</Name>
        </TSPTradeName>

        <TSPAddress>
          <PostalAddresses>
            <PostalAddress xml:lang="en">
              <StreetAddress>Factory-X Str 1</StreetAddress>
              <Locality>Frankfurt</Locality>
              <PostalCode>60549</PostalCode>
              <CountryName>DE</CountryName>
            </PostalAddress>
          </PostalAddresses>

          <ElectronicAddress>
            <URI xml:lang="en">https://www.demo.factory-x.org</URI>
          </ElectronicAddress>
        </TSPAddress>

        <TSPInformationURI>
          <URI xml:lang="en">https://www.demo.factory-x.org/info</URI>
        </TSPInformationURI>

        <TSPInformationExtensions>
          <Extension Critical="true">
            <TSPDomainName>siemens.com</TSPDomainName>
          </Extension>
        </TSPInformationExtensions>
      </TSPInformation>

      <TSPServices>
        <TSPService>
          <ServiceInformation>
            <ServiceTypeIdentifier>
              http://uri.etsi.org/TrstSvc/Svctype/RA/nothavingPKIid
            </ServiceTypeIdentifier>

            <ServiceName>
              <Name xml:lang="en">Factory-X Central STS</Name>
            </ServiceName>

            <ServiceDigitalIdentity>
              <DigitalId>
                <Other>
                  <URI>https://iam-security-training.com/sts</URI>
                </Other>
              </DigitalId>
            </ServiceDigitalIdentity>

            <ServiceStatus>
              http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/granted
            </ServiceStatus>

            <StatusStartingTime>2025-09-16T12:30:00Z</StatusStartingTime>

            <ServiceSupplyPoints>
              <ServiceSupplyPoint>
                https://iam-security-training.com/sts
              </ServiceSupplyPoint>
            </ServiceSupplyPoints>
          </ServiceInformation>
        </TSPService>
      </TSPServices>
    </TrustServiceProvider>

    <TrustServiceProvider>
      <TSPInformation>
        <TSPName>
          <Name xml:lang="de">Local STS Demo</Name>
        </TSPName>

        <TSPTradeName>
          <Name xml:lang="en">VAT-xyz</Name>
        </TSPTradeName>

        <TSPAddress>
          <PostalAddresses>
            <PostalAddress xml:lang="en">
              <StreetAddress>Factory-X Str 1</StreetAddress>
              <Locality>Frankfurt</Locality>
              <PostalCode>60549</PostalCode>
              <CountryName>DE</CountryName>
            </PostalAddress>
          </PostalAddresses>

          <ElectronicAddress>
            <URI xml:lang="en">https://www.demo.factory-x.org</URI>
          </ElectronicAddress>
        </TSPAddress>

        <TSPInformationURI>
          <URI xml:lang="en">https://www.demo.factory-x.org/info</URI>
        </TSPInformationURI>

        <TSPInformationExtensions>
          <Extension Critical="true">
            <TSPDomainName>local.com</TSPDomainName>
          </Extension>
        </TSPInformationExtensions>
      </TSPInformation>

      <TSPServices>
        <TSPService>
          <ServiceInformation>
            <ServiceTypeIdentifier>
              http://uri.etsi.org/TrstSvc/Svctype/RA/nothavingPKIid
            </ServiceTypeIdentifier>

            <ServiceName>
              <Name xml:lang="en">Factory-X Central STS</Name>
            </ServiceName>

            <ServiceDigitalIdentity>
              <DigitalId>
                <Other>
                  <URI>http://tokenservice.consumer/sts</URI>
                </Other>
              </DigitalId>
            </ServiceDigitalIdentity>

            <ServiceStatus>
              http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/granted
            </ServiceStatus>

            <StatusStartingTime>2025-09-16T12:30:00Z</StatusStartingTime>

            <ServiceSupplyPoints>
              <ServiceSupplyPoint>
                http://tokenservice.consumer/sts
              </ServiceSupplyPoint>
            </ServiceSupplyPoints>
          </ServiceInformation>
        </TSPService>
      </TSPServices>
    </TrustServiceProvider>

  </TrustServiceProviderList>

  <!-- Signature intentionally unchanged, only indented -->

</TrustServiceStatusList>