# SAML, OAUTH, XACML oh my (Authorization)!

Unfortunately, after using several SSO/IAM products at a 'lite touch' to 'deep integration' level, I'm still left unsatisfied, so going to ask the most basic question I can:

Given multiple applications (service providers, SP), each application/SP has its own list of 'roles' or 'resources' (admin, app_role_1, app/myurllink/two, app_role_2, purposefully mixing to support both).

What solution(s) best support the simple scenario of --

SP registers to the central security manager the list of roles/resources (i.e. the SP does this work, not someone independently copying into an xml/json config file locally to the IAM/IDM).

IAM/IDM tool has UI in place to select a user, select a service, then allow access to role/resource (from the list the SP has registered).

Application/SP delegates authentication to SSO and gets the tokens for authorization, gets approved roles(plural) for that service, service allows access and gets the subject/identity profile for visualization/auditing purposes.

Application/SP are primarily desktop web applications, mixing java and dotnet. <security-role><role-name>role1</role-name></security-role>, @DeclareRoles(...) standard role definitions.

It sounds too simple...yet impossible to find how to pull it off...

• Have a look at twobo. They aim to solve this – David Brossard May 9 '16 at 22:22
• Here's some background on how we at Twobo see all these standards fitting together: twobotechnologies.com/blog/2012/08/…. I will give the scenario above some thoughts and try to work up an answer. If you have any clarification or additional details in the meantime, that could help. – Travis Spencer May 10 '16 at 6:50