Demo: Attribute-Stream-Based Access Control (ASBAC) with the Streaming Attribute Policy Language (SAPL)

Traditional Attribute-Based Access Control (ABAC) implementations are based on a request-response protocol resulting in one decision for one authorization request. In stateful, session-based applications this may lead to polling the policy decision point (PDP) and policy information points (PIPs) referenced by policies. This leads to the well-known trade-offs between polling frequency and latency of updates becoming known to the client. Attribute-Stream-based Access Control (ASBAC) is an authorization model employing a publish-subscribe pattern protocol where a single subscription results in a stream of decisions dynamically updating based on the streams of changing attribute values, streams of changing policies, and PDP configuration. This demonstration will show the basic architecture of ASBAC based systems, show how the model is implemented by the Streaming Attribute Policy Language (SAPL) and its engine. The SAPL engine is available as Open Source for security researchers and practitioners. First, the overall architecture of the engine will be introduced, followed by a short demo of the publish-subscribe protocol. Afterwards, several key features of SAPL are demonstrated in an authoring and administration environment. Next, a full-stack web application employing SAPL is demonstrated, showing how Policy Enforcement Points (PEPs) are established. The demonstration concludes with a demo of the SAPL tools for testing policies and calculating test metrics on policies.