I recently came across Attribute Certificates (RFC 5755), which can be used as a means for authorisation.
I like the idea but I have spent a lot of time searching for information how this works in a real life. I understand the purpose of attribute certificates but I don't see how this can be used.
For example, I have a web application. How can I use attribute certificates for access management in web application? There must be something in the authorisation layer of a web application that can work with attribute certificates. How is this achieved? I am not able to find any examples in real web applications.
Also, are there any access management tools that supports attribute certificates, that can provide attribute certificates together with attribute authority? I can find PERMIS project but it seems to be obsolete and not useful anymore.
I would like to see real application of attribute certificates for access management not theory or possible use cases.