title: Spring Security and ABAC (Attribute Based Access Control)
body: <p>We have a medium sized business app and we use Spring Security roles and permissions (<em>RBAC</em>) heavily with a big kludge to turn roles on and off for certain instances plus rules hidden in <em>SpEL</em> within <code>@PreAuthorize</code> tags.</p>
  <p>I think what we have actually implemented (without knowing it is <em>ABAC</em>). <em>XACML</em> looks very complicated and bloated so I'm not keen on the answer here:</p>
  <p><a href="https://stackoverflow.com/questions/20269553/how-to-change-spring-security-roles-by-context">How to change Spring Security roles by context?</a></p>
  <p>Has anybody done a light weight <em>ABAC</em> implementation without <em>XACML</em>? I have hopes that would give us separation of concerns as the domain objects just do <code>@PreAuthorize(WRITE)</code> etc and our authorisation policy would be decoupled from it.</p>
  <p>From what I've read the basic principal of <em>ABAC</em> is very simple. You have an Action (very like a Permission) and a mechanism to resolve if the current Principal has that permission on a given Subject.</p>
  <p>I'm aware of <code>AccessDecisionVoter</code> which is roughly the right sort of interface but I don't think it was intended for voting on permissions. However implementing our authorisation policy with instances of something like those seems very attractive.</p>
  <p>Sorry for the rambling question! Basically I'm interesting in <em>ABAC</em> but would like to avoid home brew but worried what <em>XACML</em> is a jumbo jet when we need a Cessna.</p>