Translating High-Level Authorization Constraints to XACML

XACML has become a standard access control policy language in web service environments. However, there is still no feasible solution for XACML policy administration and validation that overcomes the complexity and verbosity of XACML, in particular with regard to high-level access control principles such as history-based separation of duty. Hence, XACML policy management is still difficult and error-prone. In order to solve this problem, we present a translation approach from the high-level declarative access control policy language OPL to XACML. Thereby we can, on the one hand, handle the complexity of the administration of policies including advanced authorization constraints. On the other hand, we are able to keep an XACML based enforcement environment which may be already in place.