What Is XACML & How Does It Work?

What is XACML?

eXtensible Access Control Markup Language is an XML-based language that creates secure access control policies, used primarily for attribute-based access control (ABAC) authorization solutions. 

XACML is standardized by the technical committee of the Organization for the Advancement of Structured Information Standards (OASIS) consortium. XACML is designed to work with another OASIS standard known as the Security Assertion Markup Language (SAML). 

The cornerstone of SAML is sharing security information revolving around authentication and authorization across systems. 

XACML Use Cases

Enterprises must enforce security access or risk compromising their intellectual property, proprietary information, and vital company secrets. Here are a couple of other pivotal XACML use cases:

• Trusted Security: The primary use of XACML is to enforce security access policies on anyone who wants to use or otherwise take action on a digital resource.
• Interoperability: To foster the objective of trusted security, XACML promotes interoperability between authorization implementations using common terminology.
• Consistent implementation: XACML’s standardization is a unifying factor that allows organizations to deploy across-the-board security policies instead of splintered policy implementation for various access points like email and internet gateways.
• Flexibility: XACML can be used where organizations prefer a more flexible approach than the static permission model of role-based access control (RBAC) systems.
• A wide array of implementation options: XACML is deployed in various online and cybersecurity components such as enterprise security applications, enterprise digital rights management (EDRM), and assorted web services.

How Does XACML Work?

Unlike RBAC solutions, XACML is attribute-based, which provides security teams more latitude in defining access permissions. 

However, it isn’t constrained to only using attributes but also incorporates policies. XACML is implemented as an access control framework through a fine-grained architecture comprising a distinct set of components:

Policy Enforcement Point (PEP):

To access a resource, a user makes a request to an asset that contains or protects the resource, like a web server, database, or file system. This asset is known as the Policy Enforcement Point (PEP) in XACML jargon. 

Upon receipt of the user request, the PEP will subsequently form its own request. The PEP request consists of the resource requested, the requester’s attributes, the action to be undertaken on the resource, and other relevant information. 

After this, the PEP sends the request it has formed to a Policy Decision Point (PDP).

Policy Decision Point (PDP):

The role of the PDP is to evaluate the request sent from the PEP against the policy that applies to it. To do so, the PDP retrieves descriptive attributes such as the user’s role, security clearance, and the requested document’s data classification. The PDP loads the XACML policies and gauges them against the request attributes to arrive at a decision. 

As a result of this evaluation, the PDP decides whether to grant or deny the request. The PDP’s answer is, in turn, returned to the PEP, which enacts the decision to grant or deny the resource to the requester.

Policy Information Point (PIP):

To arrive at a decision, the PDP often queries the PIP to gather the descriptive attributes of the user or to obtain any missing data snapshot of the request from the attribute store.

Policy Administration Point (PAP):

The role of the PAP is to manage the PDP, PIP, and all relevant policies so their functionality works effectively.

XACML Policy Elements, Language Structure, and Syntax

While XACML is attribute-based, it hinges on a combination of several high-level components:

• Rules
• Policies
• Policy sets
• Attributes
• Target

Rules

A rule serves as the basic component of a policy. A rule is written with Boolean logic to enhance its delivery of a desired policy outcome. The boolean expression allows the rule's target to be evaluated on its own merits. 

A rule engine is a program that examines established rules and subsequently proposes a set of behaviors — defined by policies expressed in XACML —  and how to adequately comply with them. 

Policy

A policy consists of a rule or a set of rules and a specified algorithm. In addition, a policy could feature optional obligations or advice expressions.  

Policy set

A policy set is a group of policies that can be distributed to several locations.

Attribute

These are named values of various types considered in the authorization decisions. 

Target

A target is a boolean statement that identifies the request or set of requests the XACML rule, policy, or policy applies to.

Benefits of Using XACML

As an access control standard, XACML provides many advantages, such as the following:

• Industry-wide standard: As a standard language, XACML-implemented policies can easily be used on various attributes, platforms, and applications.
• No vendor lock-in: Since XACML is vendor-neutral, any organization can implement it in a platform-agnostic manner. This means you don’t have to incur extra costs migrating platforms, purchasing licenses, or equipment.
• Powerful: XACML is a powerful language that offers much flexibility with conditional logic through boolean statements and various rules, functions, and data types.
• Distributed: XACML permits the implementation of authorization policies that can span various locations and access control points.
• Centrally managed system: XACML provides policy decision points and policy access points within a central access control architecture.

XACML Common Challenges and Solutions

Policy sets in XACML are complicated and difficult to write. One of the reasons for this is that several possible points of failure must be accounted for. 

Creating XACML policies requires converting every possible access request into syntax-sensitive XML. That’s why making further changes, whether to attributes, rules, policies, or policy sets, represents an arduous task. If that wasn’t challenging enough, the code has to contain a surefire way to resolve every likely contradiction in rules or policies. 

Moreover, the cascading impact of changes made to an XACML environment is hard to predict and doesn’t provide much visibility to users. 

Difference Between XACML and OPA+OPAL

While XACML is still widely adopted, the migration to cloud-native structures, the increasing complexity of applications, and the use of deployment vehicles like microservices necessitated more advanced authorization. 

Enterprises can adopt the alternative OPAL + OPA for a workaround to XACML challenges.  Open Policy Administration Layer (OPAL) and Open Policy Agent (OPA) are open-source replacement solutions for XACML. 

Unlike XACML, which mainly covers API-centric authorization, OPA deals with infrastructure authorization. Furthermore, OPAL enhances OPA by keeping its authorization layer up-to-date in real-time. 

Instead of using Policy Retrieval Points (PRPs) like XACML as its policy store, OPAL + OPA uses the GIT version control system. 

How Fortra Provides Secure Access Control

Fortra’s Secure Collaboration functionality has the tools to support the privileged access control and secure collaboration that XACML solutions require. Our competencies include enterprise digital rights management, cloud-based access control, data loss prevention, and other techniques to protect sensitive data wherever it travels.

Click here to learn more about secure file sharing and compliance.