Is there a difference between Attribute Based Access Control which is usually associated with XACML and Claim Based Authorization which seems to be a term coined by Microsoft?

Is the latter simply Microsoft's name/implementation for ABAC? Or are the two completely different concepts?

I came across both terms during my research and they seem like similar if not identical things to me, but maybe I am missing something? Are claims and attributes just different names for the same idea?

Attributes:

Attribute-based access control defines a new access control paradigm whereby access rights are granted to users through the use of policies which combine attributes together. (Wikipedia)

Claims:

Claims-based authorization is an approach where the authorization decision to grant or deny access is based on arbitrary logic that uses data available in claims to make the decision. (MSDN)

ABAC and CBAC are practically the same thing. Microsoft doesn't call things attributes, but refers to them as claims because attributes tend to be associated with SAML whereas claims are mostly protocol agnostic.

XACML is a model/implementation that exposes ABAC, whereas there isn't any concrete CBAC model or implementation -- not from Microsoft anyway. This is mostly because generic authorization models are a pain in the butt and overly complicated, and the gist of the guidance was that each application is different permissions-wise so you should figure it out on your own.

CBAC (claims-based access control) and ABAC (attribute-based access control) are essentially the same whereby a claim is an asserted "attribute". For instance, you take an attribute from Active Directory and turn it into a claim.

However, there are a few issues with CBAC:

  • first of all, it is a Microsoft-specific term, not a model per se like ABAC or RBAC.
  • secondly, Microsoft themselves use CBAC to mean different things. CBAC in .NET, CBAC in Windows Server 2012 (Windows Server 8), and CBAC in Sharepoint to name but a few
  • CBAC doesn't define the authorization itself, rather just how you get claims or attributes. It leaves the whole box of "how do you make sense of claims" down to the implementation which is why CBAC doesn't necessarily mean the same in SharePoint as it would in a .NET app.
    • In SharePoint, access is granted if a user has at least one claim the resource has
    • in Windows Server, there is a policy language called SDDL that defines what is allowed based on claims (claims about the user coming from AD and claims about the file coming from the file's classification)
    • in a .NET app, it is down to the developer to decide what they do with the claim.

ABAC on the other is a model that XACML, the eXtensible Access Control Markup Language implements. ABAC and XACML define how to use attributes to define authorization. Authorization are defined using attribute-based policies. The policies use the attributes to define what is permitted and what is denied.

In XACML, it is always clear what can be permitted or denied. The policies are defined and maintained centrally. XACML also defines a standard architecture (which by the way wasn't invented by XACML) with the notion of policy decision point and policy enforcement point.

I would recommend you read up on ABAC and XACML here:

Cheers, David.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.