I'm writing a fairly simple authentication/authorisation api for an intranet application we are developing.
It's my first roles based authorisation system and its a good opportunity for a first timer because it is located on a Windows VPS that is isolated to the internal corporate network with no internet access at all, so any mistakes I make won't have any huge consequences.
That said, I still want to do it right.
So I wanted to know if my method below is on the right track and welcome any suggestions for improvement you guys might have.
- I'm using the MEAN stack as it fits the business case nicely.
- I have bolded the points that I am concerned about or not so sure they are the best way of doing things.
- In case I am using the wrong terminology for some things I have included my definitions below so you know what I'm trying to say.
- Site-level permissions: The specific states/pages a user has access to
- Domain: in this context is the specific data collections the user has access to.
- This access is persistent across pages so there's nothing like User has access to Domains X and Y on Page A and Domains W and Z on Page B. If a User has access to Domains X and Y, then this is used for all site-level states.
Here's what I'm thinking:
- User account is created
- Using Active Directory (AD), we determine site-level permissions and domain-specific permissions
- Store User Identifier and site-level permissions in DB
- The authentication api verifies Identity and returns an JSON web token (JWT)
- The identity token is then used to get another token specifically for authorisation. The payload of the JWT contains the role specific site-level and domain-level permissions for that user.
- Auth Token is returned to the Client and checked in
- Angular then sets the appropriate state for the requested view based on the permissions.
Specific Questions for the programmers.stackexchange gurus:
- Does this look like an ok way to implement an Authorisation system?
- Given that I have access to Active Directory am I overcomplicating this by storing permissions in a Roles collection in Mongo?
- Are there any rookie flaws in this design that I should correct/ do more reading on?
Thanks for taking the time to read this and I really appreciate any feedback you might have.