Towards a Reference Architecture for Access Control in Distributed Web Applications

Web services are independently written and managed, each with its own access control policy, thus it is challenging to control the access to the information they own. A particularly difficult case occurs when a service invokes another service to satisfy an initial request. We call this ”Transitive access problem”. To tackle this issue, we propose to use XACML for defining Attribute based Access Control (ABAC) policies for web services. We focus on the authorisation issue of access control and solve the transitive access problem by integrating in the XACML architecture a module for supporting multiple attribute domains.