...
Internal PDP (within ModeShape JVM) | External PDP (remote XACML service) |
---|---|
Minimal administrative overhead through dependency injection, etc.. | Flexible, can be any XACML implementation |
ModeShape cache will keep frequently used ACL metadata in memory. Removes the need for any additional cache. | Decent performance may require custom metadata caches. |
No network overhead making connections or marshaling data. | Network latency, etc.. |
Decision and policy cache invalidation may be based on events. | Cache invalidation requires wiring JCR or Fedora JMS specifics into the chosen XACML service. Cache invalidation would be asynchronous. |
Adds complexity to the core code base – moving closer to a monolithic, coupled application. |