Overview
Attribute-Based Access Control (ABAC) is a flexible authorization model that uses attributes (user, resource, action, environment) to make access control decisions. This implementation provides a comprehensive ABAC system in Java.
Core Concepts
ABAC Components
- Subject: User or system requesting access
- Resource: Object being accessed
- Action: Operation being performed
- Environment: Contextual information (time, location, etc.)
- Policy: Rules defining access conditions
Implementation
1. Dependencies
<dependencies> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-core</artifactId> <version>2.15.2</version> </dependency> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-databind</artifactId> <version>2.15.2</version> </dependency> <dependency> <groupId>org.mvel</groupId> <artifactId>mvel2</artifactId> <version>2.4.14.Final</version> </dependency> </dependencies>
2. Core Domain Models
import java.util.Map; import java.util.HashMap; import java.util.Set; import java.util.HashSet; // Subject (User) with attributes public class Subject { private String id; private String username; private String role; private String department; private String clearanceLevel; private Map<String, Object> attributes; public Subject(String id, String username) { this.id = id; this.username = username; this.attributes = new HashMap<>(); } // Getters and setters public String getId() { return id; } public String getUsername() { return username; } public String getRole() { return role; } public void setRole(String role) { this.role = role; } public String getDepartment() { return department; } public void setDepartment(String department) { this.department = department; } public String getClearanceLevel() { return clearanceLevel; } public void setClearanceLevel(String clearanceLevel) { this.clearanceLevel = clearanceLevel; } public Map<String, Object> getAttributes() { return attributes; } public void setAttribute(String key, Object value) { attributes.put(key, value); } public Object getAttribute(String key) { return attributes.get(key); } } // Resource with attributes public class Resource { private String id; private String name; private String type; private String owner; private String sensitivity; private Map<String, Object> attributes; public Resource(String id, String name, String type) { this.id = id; this.name = name; this.type = type; this.attributes = new HashMap<>(); } // Getters and setters public String getId() { return id; } public String getName() { return name; } public String getType() { return type; } public String getOwner() { return owner; } public void setOwner(String owner) { this.owner = owner; } public String getSensitivity() { return sensitivity; } public void setSensitivity(String sensitivity) { this.sensitivity = sensitivity; } public Map<String, Object> getAttributes() { return attributes; } public void setAttribute(String key, Object value) { attributes.put(key, value); } public Object getAttribute(String key) { return attributes.get(key); } } // Action being performed public class Action { private String name; private Map<String, Object> attributes; public Action(String name) { this.name = name; this.attributes = new HashMap<>(); } // Getters and setters public String getName() { return name; } public Map<String, Object> getAttributes() { return attributes; } public void setAttribute(String key, Object value) { attributes.put(key, value); } } // Environment context public class Environment { private long timestamp; private String ipAddress; private String location; private String deviceType; private Map<String, Object> attributes; public Environment() { this.timestamp = System.currentTimeMillis(); this.attributes = new HashMap<>(); } // Getters and setters public long getTimestamp() { return timestamp; } public String getIpAddress() { return ipAddress; } public void setIpAddress(String ipAddress) { this.ipAddress = ipAddress; } public String getLocation() { return location; } public void setLocation(String location) { this.location = location; } public String getDeviceType() { return deviceType; } public void setDeviceType(String deviceType) { this.deviceType = deviceType; } public Map<String, Object> getAttributes() { return attributes; } public void setAttribute(String key, Object value) { attributes.put(key, value); } } // Access Request public class AccessRequest { private Subject subject; private Resource resource; private Action action; private Environment environment; public AccessRequest(Subject subject, Resource resource, Action action, Environment environment) { this.subject = subject; this.resource = resource; this.action = action; this.environment = environment; } // Getters public Subject getSubject() { return subject; } public Resource getResource() { return resource; } public Action getAction() { return action; } public Environment getEnvironment() { return environment; } } 3. Policy Definition
import com.fasterxml.jackson.annotation.JsonCreator; import com.fasterxml.jackson.annotation.JsonProperty; import java.util.List; import java.util.ArrayList; public class Policy { public enum Effect { PERMIT, DENY } private String id; private String name; private String description; private Effect effect; private List<String> targets; private List<Rule> rules; private int priority; @JsonCreator public Policy(@JsonProperty("id") String id, @JsonProperty("name") String name, @JsonProperty("description") String description, @JsonProperty("effect") Effect effect, @JsonProperty("targets") List<String> targets, @JsonProperty("rules") List<Rule> rules, @JsonProperty("priority") int priority) { this.id = id; this.name = name; this.description = description; this.effect = effect; this.targets = targets != null ? targets : new ArrayList<>(); this.rules = rules != null ? rules : new ArrayList<>(); this.priority = priority; } // Getters public String getId() { return id; } public String getName() { return name; } public String getDescription() { return description; } public Effect getEffect() { return effect; } public List<String> getTargets() { return targets; } public List<Rule> getRules() { return rules; } public int getPriority() { return priority; } public boolean matchesTarget(AccessRequest request) { if (targets.isEmpty()) return true; for (String target : targets) { if (evaluateTargetExpression(target, request)) { return true; } } return false; } private boolean evaluateTargetExpression(String expression, AccessRequest request) { // Simple target matching - can be enhanced with expression evaluator return expression.contains(request.getAction().getName()) || expression.contains(request.getResource().getType()); } } public class Rule { private String id; private String condition; @JsonCreator public Rule(@JsonProperty("id") String id, @JsonProperty("condition") String condition) { this.id = id; this.condition = condition; } // Getters public String getId() { return id; } public String getCondition() { return condition; } } 4. Policy Decision Point (PDP)
import org.mvel2.MVEL; import java.io.Serializable; import java.util.*; public class PolicyDecisionPoint { private PolicyAdministrationPoint pap; private Map<String, Serializable> compiledExpressions; public PolicyDecisionPoint(PolicyAdministrationPoint pap) { this.pap = pap; this.compiledExpressions = new HashMap<>(); } public AuthorizationDecision decide(AccessRequest request) { List<Policy> applicablePolicies = pap.findApplicablePolicies(request); // Sort by priority (higher priority first) applicablePolicies.sort((p1, p2) -> Integer.compare(p2.getPriority(), p1.getPriority())); for (Policy policy : applicablePolicies) { if (evaluatePolicy(policy, request)) { return new AuthorizationDecision(policy.getEffect() == Policy.Effect.PERMIT, policy.getId(), "Policy " + policy.getName() + " applied"); } } // Default deny return new AuthorizationDecision(false, null, "No applicable policy found"); } private boolean evaluatePolicy(Policy policy, AccessRequest request) { if (!policy.matchesTarget(request)) { return false; } for (Rule rule : policy.getRules()) { if (!evaluateRule(rule, request)) { return false; } } return true; } private boolean evaluateRule(Rule rule, AccessRequest request) { try { // Compile expression for better performance String expressionKey = rule.getId() + "_" + rule.getCondition().hashCode(); Serializable compiledExpr = compiledExpressions.computeIfAbsent(expressionKey, k -> MVEL.compileExpression(rule.getCondition())); // Create evaluation context Map<String, Object> context = createEvaluationContext(request); // Evaluate condition Object result = MVEL.executeExpression(compiledExpr, context); return Boolean.TRUE.equals(result); } catch (Exception e) { System.err.println("Error evaluating rule " + rule.getId() + ": " + e.getMessage()); return false; } } private Map<String, Object> createEvaluationContext(AccessRequest request) { Map<String, Object> context = new HashMap<>(); // Add subject attributes context.put("subject", request.getSubject()); context.put("user", request.getSubject()); // alias context.put("userRole", request.getSubject().getRole()); context.put("userDepartment", request.getSubject().getDepartment()); context.put("userClearance", request.getSubject().getClearanceLevel()); // Add resource attributes context.put("resource", request.getResource()); context.put("resourceType", request.getResource().getType()); context.put("resourceOwner", request.getResource().getOwner()); context.put("resourceSensitivity", request.getResource().getSensitivity()); // Add action context.put("action", request.getAction()); context.put("actionName", request.getAction().getName()); // Add environment context.put("environment", request.getEnvironment()); context.put("currentTime", request.getEnvironment().getTimestamp()); context.put("location", request.getEnvironment().getLocation()); context.put("ipAddress", request.getEnvironment().getIpAddress()); // Add custom attributes context.putAll(request.getSubject().getAttributes()); context.putAll(request.getResource().getAttributes()); context.putAll(request.getAction().getAttributes()); context.putAll(request.getEnvironment().getAttributes()); return context; } } public class AuthorizationDecision { private final boolean permitted; private final String policyId; private final String reason; private final long timestamp; public AuthorizationDecision(boolean permitted, String policyId, String reason) { this.permitted = permitted; this.policyId = policyId; this.reason = reason; this.timestamp = System.currentTimeMillis(); } // Getters public boolean isPermitted() { return permitted; } public String getPolicyId() { return policyId; } public String getReason() { return reason; } public long getTimestamp() { return timestamp; } @Override public String toString() { return String.format("AuthorizationDecision{permitted=%s, policyId='%s', reason='%s'}", permitted, policyId, reason); } } 5. Policy Administration Point (PAP)
import com.fasterxml.jackson.databind.ObjectMapper; import java.io.File; import java.io.IOException; import java.util.*; import java.util.stream.Collectors; public class PolicyAdministrationPoint { private Map<String, Policy> policies; private ObjectMapper objectMapper; public PolicyAdministrationPoint() { this.policies = new HashMap<>(); this.objectMapper = new ObjectMapper(); } public void loadPoliciesFromFile(String filePath) throws IOException { Policy[] policyArray = objectMapper.readValue(new File(filePath), Policy[].class); for (Policy policy : policyArray) { addPolicy(policy); } System.out.println("Loaded " + policyArray.length + " policies from " + filePath); } public void addPolicy(Policy policy) { policies.put(policy.getId(), policy); } public void removePolicy(String policyId) { policies.remove(policyId); } public Policy getPolicy(String policyId) { return policies.get(policyId); } public List<Policy> getAllPolicies() { return new ArrayList<>(policies.values()); } public List<Policy> findApplicablePolicies(AccessRequest request) { return policies.values().stream() .filter(policy -> policy.matchesTarget(request)) .collect(Collectors.toList()); } } 6. Policy Enforcement Point (PEP)
public class PolicyEnforcementPoint { private PolicyDecisionPoint pdp; public PolicyEnforcementPoint(PolicyDecisionPoint pdp) { this.pdp = pdp; } public boolean checkAccess(Subject subject, Resource resource, Action action, Environment environment) { AccessRequest request = new AccessRequest(subject, resource, action, environment); AuthorizationDecision decision = pdp.decide(request); // Log access decision logAccessDecision(request, decision); return decision.isPermitted(); } public AuthorizationDecision checkAccessWithDetails(Subject subject, Resource resource, Action action, Environment environment) { AccessRequest request = new AccessRequest(subject, resource, action, environment); AuthorizationDecision decision = pdp.decide(request); logAccessDecision(request, decision); return decision; } private void logAccessDecision(AccessRequest request, AuthorizationDecision decision) { System.out.println("Access Decision: " + "User=" + request.getSubject().getUsername() + ", Resource=" + request.getResource().getName() + ", Action=" + request.getAction().getName() + ", Decision=" + (decision.isPermitted() ? "PERMIT" : "DENY") + ", Reason=" + decision.getReason()); } } 7. Sample Policy Configuration
Create policies.json:
[ { "id": "policy-001", "name": "HR Department Document Access", "description": "Allow HR department to access HR documents", "effect": "PERMIT", "targets": ["document", "read"], "rules": [ { "id": "rule-001", "condition": "userDepartment == 'HR' && resourceType == 'document' && actionName == 'read'" } ], "priority": 10 }, { "id": "policy-002", "name": "Manager Edit Access", "description": "Allow managers to edit documents in their department", "effect": "PERMIT", "targets": ["document", "edit"], "rules": [ { "id": "rule-002", "condition": "userRole == 'MANAGER' && userDepartment == resourceOwner && actionName == 'edit'" } ], "priority": 20 }, { "id": "policy-003", "name": "Confidential Document Access", "description": "Only allow access to confidential documents with proper clearance", "effect": "PERMIT", "targets": ["document"], "rules": [ { "id": "rule-003", "condition": "resourceSensitivity == 'CONFIDENTIAL' && userClearance == 'HIGH'" }, { "id": "rule-004", "condition": "resourceSensitivity != 'CONFIDENTIAL'" } ], "priority": 30 }, { "id": "policy-004", "name": "Business Hours Restriction", "description": "Only allow access during business hours", "effect": "PERMIT", "targets": [], "rules": [ { "id": "rule-005", "condition": "isBusinessHours(currentTime)" } ], "priority": 5 }, { "id": "policy-005", "name": "Deny Delete for Non-Admins", "description": "Only admins can delete resources", "effect": "DENY", "targets": ["delete"], "rules": [ { "id": "rule-006", "condition": "userRole != 'ADMIN' && actionName == 'delete'" } ], "priority": 100 } ] 8. Utility Functions
import java.time.Instant; import java.time.ZoneId; import java.time.ZonedDateTime; public class ABACUtils { public static boolean isBusinessHours(long timestamp) { ZonedDateTime dateTime = Instant.ofEpochMilli(timestamp) .atZone(ZoneId.systemDefault()); int hour = dateTime.getHour(); int dayOfWeek = dateTime.getDayOfWeek().getValue(); // Business hours: Monday-Friday, 9 AM - 5 PM return dayOfWeek >= 1 && dayOfWeek <= 5 && hour >= 9 && hour < 17; } public static Environment createDefaultEnvironment() { Environment env = new Environment(); env.setIpAddress("192.168.1.100"); env.setLocation("Office"); env.setDeviceType("Desktop"); env.setAttribute("isBusinessHours", isBusinessHours(System.currentTimeMillis())); return env; } } 9. Complete Example Usage
public class ABACExample { public static void main(String[] args) { try { // Initialize ABAC components PolicyAdministrationPoint pap = new PolicyAdministrationPoint(); PolicyDecisionPoint pdp = new PolicyDecisionPoint(pap); PolicyEnforcementPoint pep = new PolicyEnforcementPoint(pdp); // Load policies pap.loadPoliciesFromFile("policies.json"); // Create test subjects Subject hrUser = new Subject("user-001", "john.doe"); hrUser.setRole("EMPLOYEE"); hrUser.setDepartment("HR"); hrUser.setClearanceLevel("LOW"); Subject manager = new Subject("user-002", "jane.smith"); manager.setRole("MANAGER"); manager.setDepartment("Finance"); manager.setClearanceLevel("MEDIUM"); Subject admin = new Subject("user-003", "admin.user"); admin.setRole("ADMIN"); admin.setDepartment("IT"); admin.setClearanceLevel("HIGH"); // Create test resources Resource hrDocument = new Resource("doc-001", "HR Policy", "document"); hrDocument.setOwner("HR"); hrDocument.setSensitivity("PUBLIC"); Resource confidentialDoc = new Resource("doc-002", "Financial Report", "document"); confidentialDoc.setOwner("Finance"); confidentialDoc.setSensitivity("CONFIDENTIAL"); Resource budgetDoc = new Resource("doc-003", "Budget Plan", "document"); budgetDoc.setOwner("Finance"); budgetDoc.setSensitivity("INTERNAL"); // Test scenarios testScenario(pep, hrUser, hrDocument, new Action("read"), "HR reading HR document"); testScenario(pep, hrUser, confidentialDoc, new Action("read"), "HR reading confidential document"); testScenario(pep, manager, budgetDoc, new Action("edit"), "Manager editing budget"); testScenario(pep, manager, confidentialDoc, new Action("read"), "Manager reading confidential doc"); testScenario(pep, admin, confidentialDoc, new Action("delete"), "Admin deleting document"); testScenario(pep, manager, confidentialDoc, new Action("delete"), "Manager deleting document"); } catch (Exception e) { e.printStackTrace(); } } private static void testScenario(PolicyEnforcementPoint pep, Subject subject, Resource resource, Action action, String description) { Environment env = ABACUtils.createDefaultEnvironment(); System.out.println("\n=== Scenario: " + description + " ==="); AuthorizationDecision decision = pep.checkAccessWithDetails(subject, resource, action, env); System.out.println("User: " + subject.getUsername() + " (" + subject.getRole() + "/" + subject.getDepartment() + ")"); System.out.println("Resource: " + resource.getName() + " (" + resource.getSensitivity() + ")"); System.out.println("Action: " + action.getName()); System.out.println("Decision: " + (decision.isPermitted() ? "PERMIT" : "DENY")); System.out.println("Reason: " + decision.getReason()); } } Advanced Features
1. Policy Combining Algorithms
public enum PolicyCombiningAlgorithm { DENY_OVERRIDES, PERMIT_OVERRIDES, FIRST_APPLICABLE, ONLY_ONE_APPLICABLE } public class AdvancedPDP { private PolicyCombiningAlgorithm algorithm; public AuthorizationDecision decideWithAlgorithm(AccessRequest request, List<Policy> policies, PolicyCombiningAlgorithm algorithm) { switch (algorithm) { case DENY_OVERRIDES: return denyOverrides(request, policies); case PERMIT_OVERRIDES: return permitOverrides(request, policies); case FIRST_APPLICABLE: return firstApplicable(request, policies); default: return firstApplicable(request, policies); } } private AuthorizationDecision denyOverrides(AccessRequest request, List<Policy> policies) { boolean atLeastOnePermit = false; for (Policy policy : policies) { if (evaluatePolicy(policy, request)) { if (policy.getEffect() == Policy.Effect.DENY) { return new AuthorizationDecision(false, policy.getId(), "Deny policy applied"); } atLeastOnePermit = true; } } return new AuthorizationDecision(atLeastOnePermit, null, atLeastOnePermit ? "Permit granted" : "No policy applied"); } // Implement other algorithms similarly... } Security Considerations
- Policy Validation: Validate policies before loading
- Expression Security: Sanitize expression inputs to prevent code injection
- Audit Logging: Log all access decisions for compliance
- Performance: Cache compiled expressions and policy evaluations
- Policy Management: Secure policy administration interface
This ABAC implementation provides a flexible, attribute-based authorization system that can handle complex access control scenarios while maintaining performance and security.