Mapping between XACML and Identity-Server security Model

Hi Vincent, WSO2 Identity Server (and all carbon platform) has its own permission model. We can assign permission for the all the resources that are defined in the WSO2 Identity Server. Resources can be browsed using registry browser UI in the management console and you can assign read, write, delete permissions for each resource. Actually here we are using a role base access control (RBAC) Apart from that there are some permission set called management console permissions. They are also same as the registry permission but they are used for special task. The management console permissions can be seen under "role" in user and role UI. There are defined to grant permission for management console UI and admin services. If you want to use the authorization mechanism with WSO2 Identity Server. You can use RBAC by defining your users and role with WSO2 Identity Server. And your resources can be kept as the registry resources. Then you can easily configure read, write, delete permissions for that resource. But better way is to use the XACML engine in WSO2 Identity Server. It is separate authorization frame work. Then any application that you used in your organization, can use the XACML engine as your authorization system. But here also you can use the users, roles and attributes defined in the WSO2 identity Server. Because in XACML there is a concept call Policy Information Point(PIP), where you can plug any number of user stores in to XACML engine for evaluating policies. By default, WSO2 Identity server's XACML engine is shipped with a PIP that calls to its own user store. you can find more in for about XACML and PIP from this [1] blog post [1] http://xacmlinfo.com/ Thanks, Asela