Building a Modular Authorization Infrastructure

Authorization infrastructures manage privileges and render access control decisions, allowing

applications to adjust their behavior according to the privileges allocated to users. This paper describes

the PERMIS role based authorization infrastructure along with its conceptual authorisation, access

control, and trust models. PERMIS has the novel concept of a credential validation service, which

verifies a user’s credentials prior to access control decision making and enables the distributed

management of credentials. Details of the design and the implementation of PERMIS are presented along

with details of its integration with Globus Toolkit, Shibboleth and GridShib. A comparison of PERMIS

with other authorization and access control implementations is given, along with our plans for the future.