Combining capability-based access control with SAML

Question

I have been looking into various research on identity, PKI and access control trying to boil it down to a simplifies methodology for IAM.

One thing which pops up in lots of places is capability-based access control, as in: your current permissions are encoded in a ticket or certificate following the request. Lots of contemporary research is pointing to this as something to look in to, as it means giving temporary authorization to perform a certain transaction. Authorizing the transaction is often more important than establishing identity.

It seems to me that SAML is flexible enough to be handle such use-cases, encoding capabilities as SAML-attributes. I also believe capabilities is a better match in a federated scenario than roles, as trying to synchronize role-definitions (or even identity) across organizations seems futile.

However, I have found very little research, products or even prototypes on combining SAML and capabilities.

I have started looking at XPOLA, but I am wondering:

• is there any other research, papers, products or projects I should take a look at?
• does any of the off-the-shelf IAM or federation-products provide any capability-based functionality?

Answer 1

I'm not familiar with XPOLA, but here are some resources on using capability-based authorization on the web that you should read:

• Alan Karp at HP Labs is doing work in exactly this area: capability-based security for web services, including using SAML and similar standards. Take a look at his work. See, e.g., the following papers of his:

  • From ABAC to ZBAC: The Evolution of Access Control Models.

  • Solving the Transitive Access Problem for the Services Oriented Architecture (discusses using SAML certificates for capability-based security)

  • Authorization-Based Access Control for the Services Oriented Architecture (more discussion of use of SAML certificates)

• Webkeys bring capability-based security to the web. It is a detailed, worked-out proposal for how a URL can serve as a capability, and how to build web services on this substrate.

• The Waterken server is a capability-based approach to web security, which allows deploying non-trivial computation and coordination between entities using object capabilities as the security model. See, e.g., some of the talks from Tyler Close.

• The cap-talk mailing list is the leading place where capability folks hang out and share information about the capability-based approach to security, including web security.

• For more background on capability-based systems, read Wikipedia's entry on object capabilities, Jonathan Shapiro's essay on What is a capability, anyway?. See also Kragen Sitaker's rant on capabilities and the web, or Doug Crockford's more recent talk on capability-based security and the web (it focuses more on fine-grained sharing, including on the web side, rather than web services design, which I think you are more focused on).