title: Centralized Authorization Service?
body: <p>Are there any open source centralized <strong>authorization</strong> services available?  There are lots of solutions for centralizing the authentication information (eg: <a href="http://www.jasig.org/cas" rel="nofollow noreferrer">CAS</a> and <a href="http://www.josso.org/confluence/display/JOSSO1/JOSSO+-+Java+Open+Single+Sign-On+Project+Home" rel="nofollow noreferrer">JOSSO</a>), but what about the authorization information?</p>
  
  <p>There are some really good authorization frameworks (eg: <a href="http://static.springsource.org/spring-security/site/reference/html/springsecurity.html" rel="nofollow noreferrer">Spring Security</a> (formerly Acegi) and <a href="http://docs.jboss.com/seam/latest-2.1/reference/en-US/html/security.html" rel="nofollow noreferrer">Seam Security</a>), but it seems that I have to composite these into individual tiers or services.  In other words, I can't run them standalone very easily.  With a SOA, it seems like it would be very valuable to centralize not just the authentication but the authorization information as well (ie: roles, permissions, rules, etc.).</p>
  
  <p>Any suggestions?</p>