I need to implement a flexible Access Control system for a framework used by a couple of .NET applications.
I have looked into Attribute-Based Access Control (ABAC) and XACML and this seems to provide the necessary flexibility to make decisions not only based on the user identity, but also on information about the requested resource.
Typicial scenario where I need this:
Allow access to patient files only to doctors who are assigned to the patient.
However externalizing the authorization to a third party provider or another PDP server because would mean a network call every time the PEP (the application) performs an action that has to be authorized.
Does it make sense to use XACML with an embedded PDP? I.e. the application transforms authorization decisions to XACML requests, then calls an embedded PDP module with the request which resolves it, queries the DB for resource and policy information and generates a XACML response.
Or is XACML only useful in distributed Access Control scenarios? Is it generally more useful to implement a custom access control system if I don't plan to externalize the decision making point?