How can I simplify the following Access Control system design?

Question

I couldn't find a better title for this...

I am trying to create an Access Control for my application and I am having serious trouble with building not an insane system, mainly for performance as this system will reside in an SQL database and will be used excessively throughout the app (every query will be using it for fetching data)

So here is my scenario and my current design:

My system has 3 modules and each has the general CRUD actions - list, view, update, create, delete; and sometimes has more specific actions like - user.view.creator, user.update.photo, user.update.metadata, storage.upload, storage.download etc.

I want my system to have "tasks" or "operations" and they will be hierarchical, for example storage.view will have a child storage.download.

This is for the operations. This part I have no problem implementing and designing. My biggest problem is designing the connection between a user and the tasks. Both RBAC and ACL doesn't fit my needs in this case, so I am trying to build my own. I cannot implement RBAC because in RBAC the roles are static but in my case the roles themselves are dependent of the resource and the group that this resource belongs to. For example, Group A's role photographer can only upload a photo from the storage, while the Group B's photographer can also delete the photo from the storage. Therefore, to keep things somewhat simple, I decided to add a new resource GROUP and every all the files, roles etc must BELONG to some group. On the other hand, the user just gets mapped to a group; they never BELONG to a group, they just access resources in groups. This makes perfect sense and works seamlessly and is not very complex - the queries are simpler, so I have space to cluster the databases etc.

However, now here comes the problem that just doesn't fit in my current design. I have another resource, CLIENT. The problem is, in the one organization, a user can have different access to different clients. So for example, lets say I have Group A, that has Clients 1 to 25. A specific user that belongs to that group, can have something like:

Client 1 - Manager
Client 2 - Assistant
Client 3 - SomeOtherRole

And when he fetches a list of clients, the user will only see 3 clients. I really don't know what I should do to achieve this in the most performant way possible. My question is, how should I proceed with designing this part of my system? And a better question, how can I simplify this system?

Answer 1

ACLs (also sometimes known as IBAC or Identity-based access control) and RBAC (role-based access control) are not enough as you found out through your use case. The reason is: you are using additional metadata or attributes. Attributes are simply key-value pairs for instance the ownership of a photo, the nature of the action (e.g. CRUD as in your example) or the type of object you are working on (picture, blog post, metadata, page...).

What you want to do is create simple authorization rules based on those attributes e.g.

A user with the role=editor can do the action=edit on an object of type=photo if and only if photo.owner==user.id

To do this, you need to turn to ABAC - attribute-based access control. ABAC extends RBAC as it brings additional attributes based on which you can make decisions and more importantly it gives you relationships (such as the ownership relationship in my example).

ABAC makes it extremely simple to implement your use cases. There is a standard called XACML (eXtensible Access Control Markup Language) which implements ABAC and it would solve your problem relatively easily. XACML gives you:

• an authorization architecture with the notion of a policy enforcement point (PEP) which protects your resource, a policy decision point (PDP) which makes decisions based on the previously defined authorization policies, and a policy information point (PIP) from which you can retrieve additional metadata (e.g. the object's owner).
• a policy language which you can use to implement your most advanced authZ scenarios
• a request/response scheme used to send a question such as "Can Alice edit doc #123?" and receive an answer e.g. "Permit".

The cool thing about XACML is that you can extend it to cater for device-based access control, time-sensitive access control or even authentication-sensitive access control.

Here are some more resources to help you get started:

• ABAC - a report by NIST
• OASIS XACML - the standard website
• ALFA the Axiomatics Language for Authorization - a free policy authoring tool for Eclipse