CBAC (claims-based access control) and ABAC (attribute-based access control) are essentially the same whereby a claim is an asserted "attribute". For instance, you take an attribute from Active Directory and turn it into a claim.
However, there are a few issues with CBAC:
- first of all, it is a Microsoft-specific term, not a model per se like ABAC or RBAC.
- secondly, Microsoft themselves use CBAC to mean different things. CBAC in .NET, CBAC in Windows Server 2012 (Windows Server 8), and CBAC in Sharepoint to name but a few
- CBAC doesn't define the authorization itself, rather just how you get claims or attributes. It leaves the whole box of "how do you make sense of claims" down to the implementation which is why CBAC doesn't necessarily mean the same in SharePoint as it would in a .NET app.
- In SharePoint, access is granted if a user has at least one claim the resource has
- in Windows Server, there is a policy language called SDDL that defines what is allowed based on claims (claims about the user coming from AD and claims about the file coming from the file's classification)
- in a .NET app, it is down to the developer to decide what they do with the claim.
ABAC on the other is a model that XACML, the eXtensible Access Control Markup Language implements. ABAC and XACML define how to use attributes to define authorization. Authorization are defined using attribute-based policies. The policies use the attributes to define what is permitted and what is denied.
In XACML, it is always clear what can be permitted or denied. The policies are defined and maintained centrally. XACML also defines a standard architecture (which by the way wasn't invented by XACML) with the notion of policy decision point and policy enforcement point.
I would recommend you read up on ABAC and XACML here: