Questions tagged [authorization]
The authorization tag has no usage guidance.
162
questions
1
vote
0answers
49 views
What is the benefit of performing authn/authz at the API gateway instead of at the service?
I want to know is if we should perform authentication at the API gateway, at the individual service, or both.
Let's frame this question and descussion in the context of new development. Specifically, ...
2
votes
1answer
78 views
Should user and service-to-service authentications be separate?
Say I have a system with 5 microservices behind a gateway, and a user signs in through an IDP (OAuth)
A user U passes the access token in a request, and the call first reaches the gateway before it ...
0
votes
0answers
87 views
Authorization and Cross-Cutting Concerns in DDD (CQRS) - Filtering Data
We are currently in the early phases of developing several applications that differ significantly in their functionality. As part of building these applications, we have also developed a few generic ...
0
votes
1answer
95 views
Can I store a refresh token in a queue?
We have a standard microservices setup (Identity Server, API Gateway, services, etc).
Some of the services schedule events to be dispatched in the future (future = anything from mins to months ahead) -...
0
votes
1answer
48 views
Enriching JWT after OpenID Connect flow
I am struggling to find a good solution for authorization of users after they were properly authenticated through an oidc flow. Let's assume the following setup:
An angular SPA is interacting with ...
1
vote
0answers
27 views
Auth strategy for local Docker services
I'm trying to choose an authentication/authorization strategy for some Docker services that all run on a single Linux IoT device. There are N number of 1st party services, and a single 3rd party ...
0
votes
0answers
46 views
Is it a bad practice to have one API route that can serve both private and public resources conditionally with an optional authorization?
Let's say I'm making a platform like Linkedin. The platform let you upload your business detail.
All public visitors can go to your business page and view public information such as name and ...
0
votes
0answers
18 views
OIDC Should I authenticate as the resource owner or machine when accessing an centralised authorization service?
We have an existing user authentication service based on casbin (https://github.com/casbin/casbin) which implements RBAC and holds fine grained user permissions. We are looking to expose this user ...
1
vote
0answers
36 views
Automatic interaction between API and secured 3rd party API
I would like to create GUI + API that calls third party API as follows:
third party API is consumed once a day by my API,
GUI user doesn’t have to log in every day (eg. can log in only once every 30 ...
0
votes
0answers
37 views
Auth-protecting video streaming using tokens but not directly on the server
I am the developer of a video streaming website and we need to secure our videos using tokens.
The issue is that videos are hosted on 100 different servers and each uses a lot of bandwidth every month....
0
votes
2answers
132 views
How to implement authorization in a microservices architecture?
I'm looking for a way to avoid centralized management of authorization rules. I'd like every microservice to be responsible for the authorization logic of its actions, but I'm having some trouble ...
1
vote
2answers
78 views
Where to store credentials for a tird-party API in my API?
So my current app process works like this:
Client communicates with my API to get certain information
My API needs information from a third-party API and uses these to create a response for the ...
0
votes
2answers
88 views
How to implement authorization that needs to be done in the same transaction as aggregate method runs in (DDD)?
Generally most of the authorization in the system is done in authorization layer which then calls commands/queries from application layer, which call methods on domain aggregates. However there are ...
2
votes
1answer
645 views
Refresh tokens by example using Angular and Spring Boot
I am designing out an app that would have an Angular frontend and Spring Boot (Java) backend.
I was considering (but not married to) the prospect of JWT-based authentication:
User logs in with ...
0
votes
0answers
32 views
Design time based job scheduler
Currently, I have a script
install_crontab.py -u <user> -c <config>
This script takes care of installing cron job that runs as a given user. In my install_crontab script, I check (using ...
2
votes
2answers
118 views
Authenticate users (REST-API)
What I'm trying to build
REST-API using Express and SQLite
5 to 10 authors should be able to post articles to /articles
except them, no one is allowed to post anything
My approach to build it
...
2
votes
2answers
191 views
What are the best practices to authorize every REST request?
My question may sound very naïve to someone, but it is what it is.
I have below scenario:
Relational MySQL Database with BIGINT primary keys and foreign keys
Spring boot as a backend (technology ...
1
vote
1answer
55 views
Authentication-as-a-Service (Auth0) and retrieving user profiles for many different users
For my recent project I decided to leverage Authentication-as-a-Service, in particular I am using Auth0 but I do not think this particularly matters. I've got my React client set up correctly and I am ...
1
vote
1answer
150 views
API AuthN/AuthZ and API Gateway
I have implemented authentication on an API Gateway level using NGINX+ and now I have concern if APIs behind it should still to authenticate using API Keys or JWT? What are best practices?
My point is ...
1
vote
1answer
92 views
What identity and/or access data are JWT claims intended for?
I am an application developer and am building a token-based auth mechanism for my application. Essentially, the user will log in with username+password, if the credentials are valid, my code will ...
0
votes
1answer
69 views
OWASP Broken Access Control by example: preventing user's from reading/writing data that isn't theirs
I have experience building RBAC-based authorization mechanisms, and understand the theory behind ACLs (DAC?) though I've never had the need to implement them.
A situation was just presented to me that ...
1
vote
1answer
89 views
API pagination with external or centralised authorization
I am building a REST API which would power a front end as well as other 3rd party apps and hence I want it to be as "standard" as possible. Right now, I am trying to stick to HATEOAS. The ...
0
votes
0answers
19 views
How can we apply in the same time role based access to a service used by internal application, external application and others internal services?
I'm trying to figure out how to make sure that our services which are both used by internal and external applications must be secure to only allow calls from clients who are authorized and have the ...
1
vote
1answer
130 views
Token based authentication to multiple API servers
We have a Web server (which also does authentication and authorization) that manages, via an API, one or more servers that contain highly sensitive data. In the below architecture diagram, we manage ...
0
votes
1answer
43 views
How to secure messaging-based communication with microservices
I'm comfortable with a lot of OpenID Connect and OAuth2 concepts in the context of HTTP-based communication between microservices. I'm currently leveraging Azure AD.
In the HTTP-based scenario I would ...
1
vote
1answer
167 views
Securing API with JWT and elevated access using MFA
At my company we have a central auth server running IdentityServer. There are a number of applications providing some API to client applications. API requests are authenticated with JWT tokens issued ...
1
vote
1answer
134 views
API / System Design [Flexible Authentication / Authorization]?
Background:
We're a smaller shop that puts out a number of products that require
authentication and authorization. We're currently using a 3rd party
service to "spin up new auth APIs" for ...
0
votes
1answer
136 views
How to handle authentication & authorization inside microservices
Example Application
I will try to explain my problem by using a familiar application.
Lets'say I'm building a Discord / Slack / Microsoft Teams clone; and for simplicity’s sake, it will contain 2 ...
1
vote
1answer
267 views
HTTP(S) API authentication: why not many services require signing (HMAC)?
I am currently researching existing authentication/authorization solution that are used for REST APIs. More specifically I'm interested in backend-to-backend interactions but client-to-backend is ...
0
votes
1answer
62 views
Mimic a leadership metrics for management users
I have role based access control to my applications. I have team leader application where team leader with valid role can view their teams performance metrics. Now my top management wants to get a ...
0
votes
1answer
74 views
Checking validity of users and tenants in each request
I am designing a centralized IDP to use for a database-per-tenant application that uses a "tid" (Tenant Id) claim in the access token that is used by the WebAPI to create a connection string ...
0
votes
3answers
646 views
Many different user types in a microservice architecture
I'm trying to design a new microservice architecture that will eventually replace our current two monolithic APIs (we develop a desktop payroll software that uses our API to send payroll documents to ...
1
vote
0answers
19 views
Defining custom OIDC provider with delegating authentication to another OIDC provider and using own authorization database
I wanted to ask about your ideas on how to solve the problem that I have to solve in my application (App1). This is the classic Fronted + Backend (Angular + Java EE) application to which I am ...
2
votes
0answers
406 views
Identity and access management in Clean Architecture and MVC design
The application user has a lot of standard functionality we see in most applications. At a high-level, this includes some form of authentication, authorization, and session management. At a low-level, ...
-3
votes
1answer
963 views
Database design user user roles applications and features
We have multiple applications with different features. We want to create a central security system, where each user is assigned a role. Role has access to certain applications and features with in ...
2
votes
1answer
63 views
Proper way to put a fixed hash as Authorization
I am implementing a system for a customer where they are asking me to use a fixed hash to protect the API as authorization. So this fixed value will be sent in the HEADER of the HTTP call as "...
2
votes
3answers
199 views
Securing REST API with authenticated user
I want to build a REST API but I have some holes when it comes to the security part. I would like to get my head around how to authenticate the calls to the API.
Therefore, this is my first draft for ...
2
votes
1answer
223 views
Delegating authorization across multiple API's
I'm building a multi-tenant system that consists of one (SPA) client, calling multiple API's, all under my control.
User authentication is done with OpenID Connect, I'm sending an ID and access token ...
3
votes
3answers
226 views
Auth in microservices applications with service mesh
Premise:
- Two services A and B
- Resource X has owner U, and is managed by service B
Now, I need to handle these auth scenarios:
1- End-user needs to directly use service B's API to access X
2- ...
1
vote
0answers
65 views
How to model ACLs?
There are different kinds of ACLs I've generally implemented:
Does a user have access to a resourcetype(API)?
Does a user have access to a resource(Object)?
Does a resource have access to another ...
0
votes
2answers
1k views
Multitenancy with Cross-Tenant Users
We currently have a requirement to build a multi-tenant application that has cross-tenant users. That is the business data is separated by tenant but users can belong to multiple tenants and should ...
2
votes
1answer
73 views
What are some authorization based design patterns to limit functionality from the perspective of size or amount of data?
I am well aware of role based / activity based authorization in the context of limiting user functionality in a simple on/off manner; however, the problem gets difficult when it's not so black and ...
1
vote
1answer
102 views
Do authorization checks belong in the controller or the repository/persistor
I have a Laravel project where the controllers (all derived from one of two base controllers) use repository and persistor classes to interface with Eloquent models. Authorization logic is implemented ...
2
votes
0answers
29 views
How authorize web application and manage sessions
i am building a single page react app that uses redux as state manager and an express node js as backend server but i don't know what is the best way to authorize my users in the application!
if it ...
3
votes
1answer
79 views
should you have separate application service methods for different roles
Say I have a shipping service where I have both a driver and a dispatcher, but there are multiple roles and a user can belong to more than one role. Both the driver and dispatcher roles can mark a ...
5
votes
2answers
8k views
Authentication and authorization - front-end vs back-end dilemma
I'm working on centralized authentication and authorization API system and got stuck in front-end vs back-end dilemma.
Front-end person is telling that should to have only one request to that API to ...
2
votes
2answers
1k views
Dealing with property-level permissions in DDD and should UI or authorization influence the domain model?
Suppose I have a command like below:
public sealed class UpdateExampleCommand
{
public int Field1 { get; set; }
public string Field2 { get; set; }
public bool Field3 { get; set; }
...
3
votes
0answers
66 views
Designing ABAC-style Authorization module with Row-level security
I'm designing the Authorization part of the AAA module of a business software suite.
Requirements:
There are Users and Groups, and you can assign Permissions to any of those.
You can Grant or ...
2
votes
2answers
2k views
How to efficiently pass permissions that control view and access of specific front-end elements from backend to the SPA using JWT
I would like to introduce permissions based access control in my Single Page Application (SPA) front-end which authenticates the user with token based authentication (JWT).
Permission Requirement:
...
4
votes
1answer
258 views
How to keep inter-service authorization maintainable?
In our environment (as in many others), it is often the case that one microservice must call another in order to accomplish a task.
In our environment, authentication is clear enough - we have a ...
