Attribute certificate to model subject-object-action for access control

Question

I am using Attribute Certificate (along with X509 PKC) for access control. What I really want to model is an access control semantic where a subject has a privilege to perform certain action on certain object. An example would be resource1 wants to fetch-profile of resource2. Here resource1 is the subject and fetch-profile is the action. Whereas resource2 is the object in this case on whom some action is to be performed by some other entity.

The subject and action parts are easily achievable with attribute certificates. Subject is the subject of the AC and I am modeling action using the Role attribute. However I am not sure how or if it's possible to achieve what I want with the object entity. I would really appreciate any help on this matter.

Note: A typical application where the subject assumes the identity of the object within certain scopes (e.g. with oAuth2) is not really applicable in my case. I want subject to maintain its own identity and do some action on some other entity. And I want to model this access criteria using attribute certs.

Answer 1

From what you describe, it sounds like you are looking for Role Based Access Control (RBAC).

The certificate can be used to identify (authenticate) the subject, while the RBAC model would handle the authorization. This would mean that you would have to enforce the RBAC rules within your software (which is not an uncommon thing).

Note that the rules for the RBAC models can, if so desired, be managed outside of your software. Only the hasAccess($subject, $action, $object); call needs to be implemented in your software.
The certificate provides the subject, the software should know which action on which object is requested.