[Cloud Computing]Mechanisms: Attribute Authority

Attribute Authority

The attribute authority, also known as an attribute store, is a directory or database in which systems can create, read, update and delete (CRUD) consumer attributes. It is a trusted source of consumer attributes to support making attribute-based access control (ABAC) decisions. The attribute authority is considered an identity provider (IdP) that provides user attributes to an attribute consumer. Attributes are encoded into signed tokens, such as Security Assertion Markup Language (SAML) tokens, for consumers to submit to providers to support determination of access privileges.

Figure 1 - An example of an attribute authority used by an attribute service to issue attribute tokens.

In Figure 1, the diagram assumes that the attribute authority has been provisioned with an organization’s cloud consumer attributes. The attribute service provides consumer attributes to the authentication gateway as a result of successful authentication of a consumer’s certificate.

Related Patterns:

• Cloud Resource Access Control