Re: Avoiding IBAC

On Sun, October 19, 2014 05:22, Karp, Alan H wrote:
> Rob Meijer wrote:
>>
>> Maybe we should make that seven:
>>
>> 5. attenuation : turning a right into a weaker version of that right
>> suitable for attenuated authorization (delegation).
>> 6. decomposition : turning a right to a composite into a right to a
>> component suitable for decomposed authorization (delegation)
>> 7. logging : keeping track of identities tied to authorizations and
>> honored requests for accountability purposes.
>>
> I can imagine adding a few more, too, but sometimes precision gets in the
> way of clarity.


I think at least 'logging' or maybe 'auditing' is essential for both
precision and clarity. The point of ABAC IMO is that there should truly be
no need to consult identity to make a request-time access decision. There
is however often a genuine need for postmortem 'auditing' when something
goes wrong that warrants the use of request-time identity related
information.

That is, at request time, the most essential difference between IBAC and
ZBAC should IMO be the type of attribute that 'identity' is considered to
be: An authority related or an auditing/logging related attribute.

Rob