Using attribute-based access control in OAuth 2.0

Abstract

This article is a research paper on the possibilities of applying role-based access control (RBAC) and attribute-based access control (ABAC) together using the OAuth 2.0 open authorization protocol. The article discusses the basic concepts associated with authorization models, attributes, and how existing solutions face a number of problems in the modern world, as well as possible methods for solving them. The article proposes a model for attribute-based access control for cross-domain origins using an API. The model includes basic architectural solutions and principles of ABAC and OAuth. The ABAC authorization service is considered as a microservice or a set of microservices. This will ensure architecture and deployment compatibility with microservice-based applications. Combining the capabilities of OAuth 2.0 and ABAC will enable an end-to-end security model that can protect customer and employee privacy, business-critical transactions, and most sensitive data across the API gateway. It is also possible to filter the response message. This is important if the API call is to retrieve a record of data from a student, bank, or medical card, as these may contain sensitive or private data elements that should be filtered based on the caller's credentials.