What you are looking for is called externalized authorization. There are different ways of doing it and like some of the commenters point out, Apache Shiro, Spring Security, Microsoft Claims are all ways of externalizing authorization.
If you look at the broader access control picture, you will see there are different acccess control models:
- access control lists (ACL),
- role-based access control (RBAC), and
- attribute-based access control (ABAC)
All of these can be used to externalize authorization though typically ACLs are not.
Apache Shiro and Spring Security achieve role-based access control i.e. you define users, roles, and permissions. You assign users to roles and roles to permissions. The information is stored centrally e.g. in an LDAP and the applications consume those. This will let you achieve coarse-grained access control. How the apps consume the roles and permissions and what the apps do with these is all up to the app developer. So in a way it is not fully externalized.
ABAC goes further. ABAC defines:
- an architecture
- a policy-based approach
- a request/response scheme to query for authorization
ABAC is typically implemented using a standard called XACML, the eXtensible Access Control Markup Language.
In ABAC's architecture you will find the following components:
- the policy enforcement point (PEP): this is the piece inside your app or in front of your app that you will use to query for authorization. This is the piece that externalizes your authorization. In your app for instance, you will use the PEP to create a request of the type Can Alice view document #123? The PEP will send that to the central authorization engine
- the policy decision point (PDP): this is the central authorization engine. It is configured with policies. Those policies are built using attributes. For instance doctors can view the medical record of a patient if they have a care relationship with that patient. Attributes can be retrieved from databases, web services, and LDAPs. The PDP receives the request from the PEP and evaluates it. It eventually reaches a decision e.g. Permit or Deny which it returns to the PEP.
- the policy information point (PIP): the PIP is the source of additional attributes the PDP might need e.g. a user's role or department, a document's status...
- the policy administration point (PAP)
The diagram below summarizes the architecture.
Have a look at either: