Re: Avoiding IBAC

Neal H. Walfield wrote:
> 
> Based on your description, it seems that the system needs ACLs to
> describe the desired policies.  When Alice grants Bob access to a
> file, the system needs to check whether Bob is authorized.  So, for
> HR-only documents, the administrator needs to add an ACL to the
> relevant files (or filter) that says HR can access these files.  Or,
> is there a way to do this using capabilities?
>
I believe that access control has four parts:

1. identification: knowing whom to hold responsible
2. authentication: proving the right to act as an identified party
3. authorization: granting a right to an authenticated party
4. access decision: deciding whether or not to honor a request

When we talk about capabilities on this list, we're usually referring to #4.  However, deciding to delegate typically uses #2 to influence #3.  In your scenario, I think it would be easier to assign roles to people and label the files, but you can use ACLs.  The key point is that you are using the roles or ACLs to  make authorization decisions, not access decisions.

________________________
Alan Karp
Principal Scientist
Enterprise Services, Office of the CTO
Hewlett-Packard Company
1501 Page Mill Road
Palo Alto, CA 94304
(650) 857-3967, fax (650) 857-7029
http://www.hpl.hp.com/personal/Alan_Karp