Hot answers tagged

15

Disclaimer: I work for Axiomatics, the leading ABAC/XACML vendor. I am glad to hear you are sold on the philosophy of ABAC. If you haven't already done so, do check out the following resources (I'll spare you commercial links): NIST ABAC project page and report. OASIS' A brief introduction to XACML A quick intro to ABAC with XACML. Gerry Gebel's blog (...


5

Disclaimer: I work for Axiomatics, the leading fine-grained authorization vendor. Hi Prakharjain, What you are describing is the basis for Attribute-Based Access Control (abac). With ABAC you define access based on user attributes as you would in RBAC (e.g. user identity, role, group) but also other user attributes (department, date of birth, location...) ...


3

While role-based access control (RBAC) is a major model for managing the authorizations, implementing RBAC has some limitations and consequences. One of the consequences is role explosion, where multiple versions (duplicates) of one role are required to separately manage access to distinct sets of data of the same class. Role-Centric Attribute-Based Access ...


3

ABAC is a generic term and access control model much like RBAC is. Both are defined and formalized by NIST. In their latest publication, NIST consider ABAC as the next evolution in access control. CBAC on the other is not a model. It's vendor-specific, in this case Cisco. You can see CBAC as a specialization of ABAC. I've written most of the ABAC Wikipedia ...


2

Your data model looks like a graph. Contact --- assigned to --- File, and vice versa. So the assignments are links (edges) in the graph. I am assuming that there can also be multiple contacts assigned to a single file or multiple files assigned to a contact. How would you handle deleting a contact that is assigned to a file which is assigned to another ...


1

Background The other comments and answers as well as your post point you in the right direction. You need a framework that is flexible enough to address your current authorization needs as well as future ones. That framework (or model) is indeed Attribute Based Access Control (abac). It's also known as dynamic authorization management and policy-based ...


1

Yes there is at least one. Disclaimer - I work for the company, Axiomatics, that provides it. Axiomatics has a solution called ADAF MD (Axiomatics Data Access Filter MD) which currently supports Oracle, DB2, MS SQL, Terradata, and others will be added soon. The solution builds on top of XACML, the eXtensible Access Control Markup Language, which is the de ...


Only top voted, non community-wiki answers of a minimum length are eligible