I'm currently researching on some access control models for SaaS-based GIS, and in the future would like to implement one. The common use cases would be like: some of the services, resources, layers, features, areas on map, etc. will be accessible only by authorized users.
I have searched for a while and find the OGC GeoXACML implementation specification meet our needs quite well and looks promising. And also there's quite a few paper discussing about Geoxacml that I can refer to. But then I find another article which propose to use oracle VPD (we are using oracle spatial), and it points out that the GeoXACML has some inefficient consequences. There is another tool that might solve the problem is the GeoShield (https://sites.google.com/site/geoshieldproject/), but it seems to be in the early work and don't have to much documentation. So which option would you suggest? Is there other options available? If geoxacml is the right way to go, how long do you estimate it will take to implement it? Any response would be appreciated.