Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been looking into various research on identity, PKI and access control trying to boil it down to a simplified methodology for IAM (Identity & Access Management).

One thing which pops up in lots of places is capability-based access control, as in: your current permissions are encoded in a ticket or certificate following the request. Lots of contemporary research is pointing to this as something to look in to, as it means giving temporary authorization to perform a certain transaction. Authorizing the transaction is often more important than establishing identity.

It seems to me that SAML is flexible enough to be handle such use-cases, encoding capabilities as SAML-attributes. I also believe capabilities is a better match in a federated scenario than roles, as trying to synchronize role-definitions (or even identity) across organizations seems futile.

However, I have found very little research, products or even prototypes on combining SAML and capabilities.

I have started looking at XPOLA, but I am wondering:

  • is there any other research, papers, products or projects I should take a look at?
  • does any of the off-the-shelf IAM or federation-products provide any capability-based functionality?
share|improve this question
Hi Rolf, welcome to Information Security - and thanks for this question! I look forward to seeing answers to this. – AviD Mar 13 '12 at 11:04
Btw (and this is not really an answer), I have seen capabilities called by several different terms, so you might have better luck searching with one of the other terms. I would suggest including also entitlements, ABAC (attribute based AC), PBAC (policy based AC), and fine-grained authorization. No, these are not exactly the same thing, but often vendors (even of these products) and researchers are confused by these terms, and tend to blur the lines, especially in marketing materials. – AviD Mar 13 '12 at 11:05
up vote 2 down vote accepted

I'm not familiar with XPOLA, but here are some resources on using capability-based authorization on the web that you should read:

share|improve this answer
Any comments regarding the relation to "Trust Management" systems? They appear to be capability-systems where the granted permission is expressed in a generic grammar, making the system a bit more flexible/interoperable. – pepe Mar 13 '12 at 23:42
As far as I am aware, trust management does not use capabilities. (See Wikipedia for some defining attributes of a capability-based system.) However, as trust management schemes is intended to support expressing authorization policies, they seem to be in roughly the same space. – D.W. Mar 14 '12 at 0:58

There is one standard in this space that implements attribute-based access control (ABAC). That standard is XACML (eXtensible Access Control Markup Language). It's also part of OASIS exactly like SAML and has been designed in part to work with SAML in many IAM scenarios.

It's definitely not research anymore. There are lots of companies using XACML such as Boeing, Documentum, governments, Bank of America... There are several vendors in this space such as the one I work for - Axiomatics - or IBM, Oracle... Lastly, there is a pretty lively open source community (SunXACML in the old days - ForgeRock and OpenAM, and WSO2 today...)

Lastly, NIST have been working on attribute-based access control. Their work can be found here. It's a great place to start looking around.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.