XACML

The eXtensible Access Control Markup Language (XACML) is an XML-based standard markup language for specifying access control policies. The standard, published by OASIS, defines a declarative, fine-grained, attribute-based access control policy language, an architecture, and a processing model describing how to evaluate access requests according to the rules defined in policies.

XACML is primarily an attribute-based access control policy language, but it also defines syntaxes for the requests sent by the Policy Enforcement Point to the Policy Decision Point, also called authorization decision requests. The response process follows the aforementioned request flow in reverse. In XACML, attributes—information about the subject accessing a resource, the resource to be addressed, the action to be performed on the resource, and the environment—act as inputs deciding whether access is granted or not. XACML can also be used to implement role-based access control.

In XACML, Rules specify the conditions under which an access request is approved (Permit) or rejected (Deny). If a Rule is applicable to a request but the conditions within the Rule fail to evaluate, the result is Indeterminate. Rules are grouped together in Policies and combined according to a combining algorithm defined by the parent Policy (e.g., deny-unless-permit, permit-unless-deny). Then, Policies may be grouped together in a larger Policy (or PolicySet in XACML 3.0) and combined according to its combining algorithm similarly.

Policies include a Target, which is a condition that determines whether that Policy should be evaluated for a given request. Policies and Rules also include obligations and advice expressions. Obligations specify actions that must be executed during the processing of a request (e.g., for logging). Advice expressions are similar but may be ignored.

XACML separates access control functionality into several components. Each operating environment in which access control is used has a Policy Enforcement Point (PEP), which implements the functionality to demand authorization and to grant or deny access to resources. These refer to an environment-independent and central Policy Decision Point (PDP), which is responsible for making the final access decision. The PDP refers to policies stored in the Policy Retrieval Point (PRP). Policies are managed through a Policy Administration Point (PAP).

XACML 4.0 now has an equivalent representation in JSON: JACAL.