I have been looking into various research on identity, PKI and access control trying to boil it down to a simplifies methodology for IAM.
One thing which pops up in lots of places is capability-based access control, as in: your current permissions are encoded in a ticket or certificate following the request. Lots of contemporary research is pointing to this as something to look in to, as it means giving temporary authorization to perform a certain transaction. Authorizing the transaction is often more important than establishing identity.
It seems to me that SAML is flexible enough to be handle such use-cases, encoding capabilities as SAML-attributes. I also believe capabilities is a better match in a federated scenario than roles, as trying to synchronize role-definitions (or even identity) across organizations seems futile.
However, I have found very little research, products or even prototypes on combining SAML and capabilities.
I have started looking at XPOLA, but I am wondering:
- is there any other research, papers, products or projects I should take a look at?
- does any of the off-the-shelf IAM or federation-products provide any capability-based functionality?