Applying authorization to our sample information system
XACML was explained previously but is quite a complex mechanism to put in place. Also, there is not a reference implementation of the protocol, although several products exist such as WSO², Balana, Axiomatics, or products from AT&T. Although these all have their place in big information systems such as banks or insurance, they would be oversized for the small information system that we have decided to simulate in our example, so we are going to use something lighter and closer to the main internet protocols.
The Open Policy Agent alternative
Open Policy Agent is a project that is supported by the Cloud Native Computing Foundation and that proposes a nice decoupling between grammar to describe policies. In short, OPA is to XACML what REST is to SOAP – a lightweight alternative that takes on 80% of the job with 20% of the complexity. Instead of installing a full-blown XACML server to show an example of externalizing...
