Summary of “ABAC vs. ReBAC: The Authorization Policy Showdown”

564 VIEWS

I should be reading NIST SP800-63-4 2pd, but for some reason I avoided it and have just finished watching a YouTube video titled “ABAC vs. ReBAC: The Authorization Policy Showdown.” Since I watched it, I will record Notta’s summary of the video below.

Table of Contents

Summary of the YouTube Video

In this video, Gabriel, Alex, and David discuss attribute-based access control (ABAC) and relationship-based access control (ReBAC), also known as policy as graph. They explore the main differences between these 2 approaches to fine-grained authorization, their respective benefits, and potential use cases. The discussion also addresses delivering a good developer experience, integrating authorization into the software development lifecycle, and the possibility that SaaS and COTS vendors will adopt these approaches in response to customer demand. They also discuss the future of policy languages such as ALFA and possible standardization efforts.

Key Points

Introduction and Background

The video begins with Gabriel introducing Alex and David as experts on ABAC and ReBAC. They discuss fine-grained authorization and how it differs from traditional role-based access control (RBAC) by considering additional dimensions such as resource attributes, context, and relationships. In an interesting exercise, each begins by advocating the benefits of the approach opposite to the one he favors.

00:07:06 Benefits of ReBAC (Policy as Graph)

First, David, who favors ABAC, defends ReBAC and highlights the benefits of using a graph-based approach to authorization. These include the availability of existing tools and frameworks, the ability to perform open-ended queries such as searches and reverse-query evaluation, and visual representations of policies that aid understanding. Alex adds that graphs are well suited to analysis and can leverage existing graph algorithms.

00:11:50 Benefits of ABAC (Policy as Code)

Next, Alex, who favors ReBAC, discusses the benefits of ABAC, also known as policy as code. He suggests that it may have a gentler learning curve for developers accustomed to coding and is based on the mature XACML standard. David adds that ABAC policies can closely reflect requirements expressed in plain English, making them easier to understand and maintain.

00:17:20 Managing Complexity and Adoption

The discussion turns to managing the complexity of fine-grained authorization and its potential adoption by SaaS and COTS vendors. Gabriel proposes placing users and resources into coarse-grained roles or groups, then applying fine-grained policies on top. David mentions the OpenID Foundation’s AuthZen Working Group, which could standardize authorization APIs and encourage vendor adoption.

00:51:00 Developer Experience and Integration

The panelists emphasize the importance of delivering a good developer experience and seamless integration into the software development lifecycle. They discuss the potential for new policy languages and tools to improve the experience, as well as a trend toward no-code solutions. David mentions ongoing work to develop and potentially standardize the ALFA policy language.

00:55:46 Distinguishing Authorization from Application Logic

In response to an audience question, David offers guidance on distinguishing authorization policies from application logic. He suggests that authorization policies should be free of side effects and focus on reporting requirements, while application logic can handle business rules without strict reporting needs.

Impressions

The AuthZEN WG’s work at the OpenID Foundation is one initiative now beginning to attract attention. The 3 people in this discussion are involved in it. Even PDPs (Policy Decision Points) using different approaches should be able to communicate their decisions to PEPs (Policy Enforcement Points), and AuthZEN is developing such standards. Anyone interested is warmly encouraged to participate.

The Video

Watch this video on YouTube.
Playing the video connects to YouTube.