Centralized authorization with distributed service providers

Question

I'm thinking about implementing a single sign on service with a centralized permissions management for a distributed network of service providers (so authentication as well as authorization).

The part about authentication is mostly solved (probably going to use SAML). The more difficult part is implementing a centralized authorization, if even possible.

The only possibility I see to make this work would be that the resource providers ask the authorization server about the permissions of a specific user. The resource provider would then have to map those permissions into local rules for the user. The problem with this is that it is still up to the resource provider to respect and implement the policy provided by the authorization server.

Is there a solution to have the central server enforce user permissions/policies?

Answer 1

Yes, there is a solution out there and it is even a standard. It is called XACML, the eXtensible Access Control Markup Language. Much like SAML, it is defined by OASIS. Where SAML focuses on authentication, federation, and coarse-grained authorization, XACML focuses on fine-grained authorization based on attributes and policies.

For instance, you can define policies such as:

A user with role == manager can do the action == view on a resource of type == medical record.

XACML defines the policy language, the request / response scheme, and the architecture. The following diagram shows the architecture. It has a notion of a Policy Decision Point (PDP) which is the authorization server which can be queried from multiple locations in your architecture e.g. a service layer, an API, or even a data tier.

Most XACML implementations give you a binary Permit / Deny API - also part of the XACML standard. The implementation I work on, Axiomatics, also gives you an open-ended API e.g. "What can Alice do?" which returns a list of permissions back rather than just a Permit / Deny answer.