page_title: XACML
section_title: XACML and SAML
hierarchical_section_title: XACML / XACML and other standards / XACML and SAML
caption_attribution_description: English: Example of cross-enterprise federation where 2 enterprises federate using SAML and 2 Security Token Services (STS) between a circle of trust has been established. The SAML in this picture is used for identity exchange / virtualization. The XACML is used serverside to determine whether access should be granted to the application functionality (functional access control) and the data behind it (data access control).
context_page_description: XACML stands for "eXtensible Access Control Markup Language". The standard defines a declarative fine-grained, attribute-based access control policy language, an architecture, and a processing model describing how to evaluate access requests according to the rules defined in policies.
  As a published standard specification, one of the goals of XACML is to promote common terminology and interoperability between access control implementations by multiple vendors. XACML is primarily an attribute-based access control system, also known as a policy-based access control system, where attributes associated with a user or action or resource are inputs into the decision of whether a given user may access a given resource in a particular way. Role-based access control can also be implemented in XACML as a specialization of ABAC.
  The XACML model supports and encourages the separation of enforcement from decision making from management / definition of the authorization. When access decisions are hard-coded within applications, it is very difficult to update the decision criteria when the governing policy changes and it is hard to achieve visibility or audits of the authorization in place.
context_section_description: SAML is an identity SSO and federation standard used for authentication. SAML is used as a common identity token format between different applications. SAML and XACML are both defined by OASIS. SAML and XACML were designed to interoperate where SAML is used to carry identity information / virtual identities and XACML is used to drive the access control logic through policies.
caption: Example of cross-enterprise federation where two enterprises federate using SAML and two Security Token Services (STS), establishing a circle of trust. The SAML in this picture is used for identity exchange / virtualization. The XACML is used server-side to determine whether access should be granted to the application functionality (functional access control) and the data behind it (data access control).
exif: {}