4

I'm trying to find any open-source or commercial implementation of Attribute-Based Access Control(ABAC) paradigm that will work together with Spring Security or Apache Shiro frameworks. Right now I can't find any of them. I don't think I'm a first one who needs such kind of functionality - so could you please recommend frameworks that will support this ?

Also, can Permissions in Apache Shiro be considered as a particular case of ABAC paradigm implementation ?

alexanoid
  • 24,051
  • 54
  • 210
  • 410

4 Answers4

7

jCasbin is a powerful and efficient open-source access control library for Java projects. It provides support for enforcing authorization based on various access control models. ABAC is one of the models that is supported by jCasbin.
ABAC: syntax sugar like a resource. The owner can be used to get the attribute for the resource.
In jCasbin, an access control model is abstracted into a CONF file based on the PERM metamodel (Policy, Effect, Request, Matches). So switching or upgrading the authorization mechanism for a project is just as simple as modifying a configuration. You can customize your own access control model by combining the available models. For example, you can get RBAC roles and ABAC attributes together inside one model and share one set of policy rules.
It supports Spring boot via plugin: jcasbinspring-boott-plugin

Also, there is another opensource project called EasyAback. (The original project documents are written in Russian and I translated them and moreover added some other documents and diagram link)

M-Razavi
  • 3,327
  • 2
  • 34
  • 46
4

This github sample shows how ABAC can be implemented on top of spring-security framework using Spring Expression Language (SPEL). An excellent blog describes the sample code using a simple web app. Having come from an XACML background I found this project to be very familiar to XACML. It essentially maps XACML concepts to define policy's in JSON (instead of XACML / XML) and using a familiar spring-security API and framework.

Farrukh Najmi
  • 5,055
  • 3
  • 35
  • 54
3

Disclaimer: I work for Axiomatics

Axiomatics provides an Attribute Based Access Control (ABAC) implementation that integrates with different environments:

  • Native Spring Security integration
  • integration with other Java apps via our SDK and API
  • integration with API gateways e.g. Apigee
  • database security

We have had customers integrate with Apache Shiro . Apache Shiro are a simplified form of ABAC. They can be integrated with ABAC.

Axiomatics' implementation relies on XACML.

David Brossard
  • 13,584
  • 6
  • 55
  • 88
3

For an open source Java alternative, you can find several on the XACML Wikipedia page: AuthzForce, Apache OpenAZ, WSO2 Balana. For AuthzForce, you can find Java code samples of ABAC/XACML authorization filters using either an embedded Java PDP or a (remote) RESTful PDP.

cdan
  • 3,470
  • 13
  • 27