Embedding XACML PDP?

Question

I need to implement a flexible Access Control system for a framework used by a couple of .NET applications.

I have looked into Attribute-Based Access Control (ABAC) and XACML and this seems to provide the necessary flexibility to make decisions not only based on the user identity, but also on information about the requested resource.

Typicial scenario where I need this:

Allow access to patient files only to doctors who are assigned to the patient.

However externalizing the authorization to a third party provider or another PDP server because would mean a network call every time the PEP (the application) performs an action that has to be authorized.

Does it make sense to use XACML with an embedded PDP? I.e. the application transforms authorization decisions to XACML requests, then calls an embedded PDP module with the request which resolves it, queries the DB for resource and policy information and generates a XACML response.

Or is XACML only useful in distributed Access Control scenarios? Is it generally more useful to implement a custom access control system if I don't plan to externalize the decision making point?

Answer 1

Yes, it makes sense to embed the PDP.

XACML is more about:

• a standardized policy language
• a standardized request / response scheme
• and a standardized conceptual architecture with the notion of PEP or PDP.

It doesn't mean the PDP cannot be embedded. What matters is that you define and manage your policies centrally but you can always distribute them to embedded PDPs or service PDPs. You could even have a mix of embedded / service PDPs.

I work for Axiomatics - a XACML vendor - and we see many customers using embedded PDPs either for performance reasons but usually more for a lifecycle reason (i.e. the customer doesn't want to have to set up and maintain a separate server).

There are 2 possible drawbacks to embedding a PDP:

• if you want to update the PDP library, you'll have to to do that everywhere it's been embedded.
• if you want to use policy information points (PIP), you have to configure each PIP individually at each embedded PDP if at all possible.