Anyone who knows something about identity and authorisation will know that they are often best separated from each other and where an identity can be for the membership of a group or with a given role. This can often simply be the design of our infrastructure. An analogy of this is where we use our passport to provide identity but then have a visa to show that we have the rights to enter a country.
Well, OpenSSL 3.4.0 has just been released, and one of the things it supports is Attribute Certificates (ACs):
These certificates are defined in RFC 5755. So, while our X.509 certificates link identities to a public key, ACs do not contain a public key. Instead they have a linkage to a group, role, security clearance or other related authorisation information. An analogy is where a digital certificate would provide us with definitive proof of our identity, whereas the AC provides a way to authorise one or more services. We could, of course, add extra information with the X.509 certificate, but it is normally best to separate identity checking from authorisation.
With an AC, we thus do not need a strong check on the identity of a person, but just their group or role. For example, we might be…
