I have a C# .net application which servers both company's internal users and external customers. I need to do fine-grained authorization like who accesses what resource. So I need something like re...

We have a medium sized business app and we use Spring Security roles and permissions (RBAC) heavily with a big kludge to turn roles on and off for certain instances plus rules hidden in SpEL within...

I have a project that requires ABAC for access control for my projects resources. I've been looking at OPA and authzforce as options to implement ABAC and OPA looks like it might be less complicate...

I am novice to XACML policies. Can you specify me how to implement XACML policies. I have tried different API's. But for my project I need to implement XACML evaluation engine. So, can you help me ...

I am studying about various types of access control models and came across to know that abac and rbac are the popular ones. I've a basic scenario for one of my project and I couldn't understand sh...

I'm novice with the XACML world. I've read some documentation regarding JSON and REST profiles of the v3.0 standard but everything I can find is related to XACML requests and responses and not poli...

Has anyone written XACML Implementations other than the Sun XACML Implementation and XEngine? Who uses them in their products? Which vendors provide a PDP? I read something about a WebLogic XACML...

How have folks used an abac approach when running reports or even just selecting multiple records from a DB? For instance, if you have a policy that states: Doctors can only view patients in t...

Our web application is based on spring security. We already handle authentication via SSO provider (CAS) We are trying to find a convenient solution of handling authorization for our app (Roles a...

for a proof of concept i want to store rights. I know there are different ways of access control (DAC, MAC, RBAC,..). My first idea was using a database, but I'm looking for some more etablished st...

How do we use obligations in XACML? Any reference will be helpful The scenario is that the obligations should refer the PIP and retrun the result to PEP Thanks Example from the author's comment: &l...

I'm considering migrating my client application from using a XACML 2.0 authorization service to using a newer XACML 3.0 service. What changes or issues will I run into in migrating my client app f...

Are there any open source centralized authorization services available? There are lots of solutions for centralizing the authentication information (eg: CAS and JOSSO), but what about the authoriza...