Implementing Attribute-Based Access Control (ABAC)
1. Understanding ABAC Concepts
| Element | Definition |
|---|---|
| Subject attrs | User properties (role, department, clearance) |
| Resource attrs | Object properties (owner, classification, tenant) |
| Action attrs | Operation (read, write, delete) |
| Environment attrs | Context (time, IP, MFA strength) |
| Policy | Rule combining attributes → permit/deny |
2. Defining Subject Attributes
| Example | Source |
|---|---|
| role | RBAC store |
| department | HR system / IdP claim |
| clearance | Security DB |
| manager_of | Org graph |
| tenant_id | JWT claim |
3. Defining Resource Attributes
| Example | Detail |
|---|---|
| owner_id | FK to user |
| classification | public / confidential / secret |
| tenant_id | Multi-tenancy isolation |
| department | For department-scoped access |
| status | draft / published / archived |
4. Defining Environment Attributes
| Attribute | Use |
|---|---|
| request_time | Business-hours restrictions |
| client_ip / geo | Country / network restriction |
| mfa_level | Step-up requirement |
| device_compliant | Managed device check |
| risk_score | From risk engine |
5. Creating Access Policies
Example: OPA Rego policy
package authz
default allow = false
allow if {
input.action == "read"
input.resource.owner_id == input.user.id
}
allow if {
input.action == "read"
input.user.role == "manager"
input.user.department == input.resource.department
}
allow if {
input.user.role == "admin"
input.environment.mfa_level == "strong"
}6. Implementing Policy Decision Point
| Component | Detail |
|---|---|
| Input | {subject, resource, action, environment} |
| Output | permit / deny + obligations |
| Engine | OPA, Casbin, Cedar (AWS), AuthZForce (XACML) |
| Deployment | Sidecar, library, or central service |
7. Implementing Policy Enforcement Point
Example: PEP middleware
async function enforce(req, res, next) {
const decision = await opaClient.evaluate({
user: req.user,
resource: { type: "order", id: req.params.id, ...await loadOrder(req.params.id) },
action: req.method.toLowerCase(),
environment: { ip: req.ip, time: new Date(), mfa_level: req.user.amr }
});
if (!decision.allow) return res.status(403).end();
next();
}8. Using Policy Language
| Language | Tool |
|---|---|
| Rego | Open Policy Agent |
| Cedar | AWS Verified Permissions |
| XACML | Industry XML standard (verbose) |
| CEL | Google — embedded in gRPC, Kubernetes |
| Casbin DSL | Multi-language (Go, Node, Java, Python) |
9. Implementing Dynamic Authorization
| Trigger | Action |
|---|---|
| Resource attr change | Re-evaluate active sessions |
| Policy update | Push to all PDPs (bundles in OPA) |
| Risk signal | Adapt decision in real time |
| Time-based | Auto-allow/deny based on schedule |
10. Combining ABAC with RBAC
| Pattern | Use |
|---|---|
| RBAC for coarse | Role grants base capability |
| ABAC for fine | Attributes refine per-instance access |
| Example | Role "editor" + attribute "owner=self" |
| Hybrid models | ReBAC (Google Zanzibar) for relationships |