Distributed Access Control System (DACS) is a light-weight single sign-on and attribute-based access control system for web servers and server-based software. DACS is primarily used with Apache web servers to provide enhanced access control for web pages, CGI programs and servlets, and other web-based assets, and to federate
Apache servers.

Released under an open-source license, DACS provides a modular authentication framework that supports an array of common authentication methods and a rule-based authorization engine that can grant or deny access to resources, named by URLs, based on the identity of the requestor and other contextual information. Administrators can configure DACS to identify users by employing authentication methods and user accounts already available within their organization. The resulting DACS identities are recognized at all DACS jurisdictions that have been federated.

In addition to simple web-based APIs, command-line interfaces are also provided to much of the functionality.
Most web-based APIs can return XML or JSON documents.

Development of DACS began in 2001, with the first open source release made available in 2005.

Authentication
DACS can use any of the following authentication methods and account types:
 X.509 client certificates via SSL
 self-issued or managed Information Cards (InfoCards) (deprecated)
 two-factor authentication
 Counter-based, time-based, or grid-based one-time passwords, including security tokens
 Unix-like systems' password-based accounts
 Apache authentication modules and their password files
 Windows NT LAN Manager (NTLM) accounts
 LDAP or Microsoft Active Directory (ADS) accounts
 RADIUS accounts
 Central Authentication Service (CAS)
 HTTP-requests (e.g., Google ClientLogin)
 PAM-based accounts
 private username/password databases with salted password hashing using SHA-1, SHA-2, or SHA-3 functions, PBKDF2, or scrypt
 imported identities
 computed identities

The extensible architecture allows new methods to be introduced.

The DACS distribution includes various cryptographic functionality,
such as message digests, HMACs,
symmetric and public key encryption,
ciphers (ChaCha20, OpenSSL),
digital signatures,
password-based key derivation functions (HKDF, PBKDF2),
and
memory-hard key derivation functions (scrypt, Argon2),
much of which is available from a simple scripting language.

DACS can also act as an Identity Provider for InfoCards and function as a Relying Party,
although this functionality is deprecated.

Authorization
DACS performs access control by evaluating access control rules that are specified by an administrator.
Expressed as a set of XML documents, the rules are consulted at run-time to determine
whether access to a given resource should be granted or denied.
As access control rules can be arbitrary computations, it
combines attribute-based access control, role-based access control,
policy-based access control, delegated access control, and other approaches.
The architecture provides many possibilities to administrators.

See also

 Access control
 Computer security

References

Notes

 R. Morrison, "Web 2.0 Access Control", 2007.
 J. Falkcrona, "Role-based access control and single sign-on for Web services", 2008.
 B. Brachman, "Rule-based access control: Improve security and make programming easier with an authorization framework", 2006.
 A. Peeke-Vout, B. Low, "Spatial Data Infrastructure (SDI)-In-A-Box, a Footprint to Deliver Geospatial Data through Open Source Applications", 2007.

External links
 
 

Cross-platform free software
Free security software
Free software programmed in C
Unix security software
Unix user management and support-related utilities
Computer access control