PlainID

Identity and Access Management (IAM) spans identity vetting, assurance, credential issuance, authentication, authorization, reconciliation, governance, and lifecycle management, all of which are required for strong cybersecurity. While modern authentication (multi-factor, risk-adaptive methods, biometrics) receives significant attention, authorization remains the decisive step after a user, device, or application is authenticated. Authorization determines whether an operation should be allowed based on user, resource, environmental, and action attributes. Two prominent standards are XACML, which defines a policy architecture and decision protocol (now also via REST/JSON profiles), and OAuth, which enables decentralized bearer-token authorization and underpins OpenID Connect and User Managed Access.

PlainID, founded in 2014 and headquartered in Israel, targets fine-grained authorization at enterprise scale, arguing that policies often span many applications and should be externalized for better security and economies of scale. The Linux-based engine can run on-premises or in IaaS environments such as AWS and Azure. It implements Policy Based Access Control (PBAC) by combining RBAC compatibility with ABAC-style attribute richness, separating business policy (identities, roles, attributes, conditions, entitlements) from implementation policy (applications and resources such as documents, devices, and other apps).

PlainID aligns with the XACML reference architecture (PAP/PIP/PDP/PEP) via a Management Console, Dynamic Information Provider, Dynamic Authorization Server, and Dynamic Authorization Provider. Policies can be authored graphically, tested in a sandbox, and evaluated using attributes pulled from multiple repositories with normalization via “Virtual Identity Type.” For performance, the PDP is XACML 2.0–conformant but stores and evaluates policies in-process using a graph database and proprietary mechanisms, with optional JSON export for conversion to XACML/XML. The platform integrates with major IAM/WAM/IGA vendors, supports OAuth 2.0 profiles, provides full entitlement enumeration for audits, and logs to syslog/Kafka. Strengths include centralized policy tooling and distributed deployment; challenges include incomplete XACML 3.0 support, lack of JWT support, and the need for more SDKs and stronger default console authentication.

• IAM includes identity vetting, assurance, credential issuance, authentication, authorization, reconciliation, governance, and lifecycle management.
• Username/password authentication has been the norm for decades and is increasingly being phased out where possible.
• Access control decisions can consider user, resource, environmental, and action attributes.
• XACML defines an access control architecture, policy language, and a request/decision/response protocol, originally based on XML.
• OAuth uses a bearer-token approach for decentralized, federated authorization, and OAuth 2.0 is widely used across the web.
• PlainID was founded in 2014 and is headquartered in Israel.
• PlainID is Linux-based and can be deployed on-premises or on IaaS platforms such as Amazon AWS and Microsoft Azure.
• PlainID supports XACML 2.0 and some elements of 3.0, including Obligations.
• PlainID can send requests and responses to Kafka for analysis by tools such as HBase and Splunk.
• PlainID can function as an OAuth 2.0 authorization server and currently supports the Assertions Framework and Token Introspection profiles.

• “Authentication is a necessary first step, but fine-grained authorization in accordance with specific policies is an increasingly common business requirement.”
• “Authorization is the process of determining whether a user, device, or application should be allowed to perform an operation.”
• “Most access decisions in enterprises today are governed by static policies.”
• “Given that most applications do not share or integrate security models, these access control policies must be built on a per-application basis.”
• “All large organizations have written security policies, are subject to a variety of regulations, and need to enforce Segregation of Duties.”
• “These adaptive authentication solutions help solve real business problems… however, they do not address all complex access control scenarios that businesses commonly encounter.”
• “PlainID implements what they term Policy Based Access Control (PBAC), which is a union of the older Role Based Access Control (RBAC) and the newer Attribute Based Access Control (ABAC) models.”
• “By storing the policies in an optimized but non-standard way, and by running the graph database in the main executable process, PlainID is able to evaluate policies and relevant attributes more expeditiously.”
• “With PSD2 coming into effect in the EU, complex authorization capabilities will be needed by both banks and Third-Party Providers (TPPs).”
• “With authorization and access control, the ‘Last Mile’ is usually the hardest to cross.”