The attribute authority, also known as an attribute store, is a directory or database in which systems can create, read, update and delete (CRUD) consumer attributes. It is a trusted source of consumer attributes to support making attribute-based access control (ABAC) decisions. The attribute authority is considered an identity provider (IdP) that provides user attributes to an attribute consumer. Attributes are encoded into signed tokens, such as Security Assertion Markup Language (SAML) tokens, for consumers to submit to providers to support determination of access privileges.

An example of an attribute authority used by an attribute service to issue attribute tokens.

In the figure it is assumed that the attribute authority has been provisioned with an organization’s cloud consumer attributes. The attribute service provides consumer attributes to the authentication gateway as a result of successful authentication of a consumer’s certificate.

Related Patterns:

• Cloud Resource Access Control

This mechanism is covered in CCP Module 7: Fundamental Cloud Security and
in Module 8: Advanced Cloud Security.

For more information regarding the Cloud Certified Professional (CCP) curriculum, visit www.arcitura.com/ccp.

This cloud computing mechanism is also covered in:

Cloud Computing Design Patterns by Thomas Erl, Robert Cope, Amin Naserpour

(ISBN: 9780133858563, Hardcover, ~ 528 pages)

For more information about this book, visit www.arcitura.com/books.