Attribute-Based Access Control is an approach to managing user access in systems and applications. Unlike the traditional role-based models, where users are assigned specific roles with predefined permissions, ABAC leverages attributes associated with the users, actions, resources, and the environment. A decision to grant access or deny it is based on an evaluation of policies against these attributes.
Core Components
- Attributes: these are key-value pair that describes characteristics.
- Policies: Conditions to grant access or deny access based on the attributes.
- Policy decision points: components that decide to grant access or deny it.
- Policy enforcement Points: once the PDP makes the decision, the PEP either allows the action to take place or blocks it.
Benefits of using ABAC
- Granularity: allows detailed and specific access control compared to traditional methods.
- Flexibility: easier to adjust or implement changes as organizational requirements change.
- Scalability: can accommodate a large user base and resources without complexity
- Context-aware decisions: it considers dynamic factors such as time, location, and such in its decisions.
