Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [authorization]

The tag has no usage guidance.

-1
votes
2answers
115 views

Should I prepopulate resources and permissions in my system?

I am following the rbac model in my system. I want to know if I should prepopulate the resources and permissions table? I have resources like contracts, contract_drafts, SLA (service level agreement)...
3
votes
1answer
773 views

REST API Design: Multiple resources and authorization

I'm working on a service that forwards/unifies our API calls to external platforms/services. For example, let's say that I don't want to handle all possible actions (create post, retrieve post, edit ...
1
vote
1answer
43 views

Multiple app authentication, universal user login, best practice

Please see the below diagram. There are two apps that each have a different set of functions, User A is a user of App1 and User B is a user of App2. They should not be able to log in directly to the ...
-1
votes
1answer
26 views

How to implement linkedin authentication/data sharing with multi party?

Hi I am working on application 2. My application interacts with application 1 and 3. Clients of application 1 need to be to share their linkedin profile information with application 3. I have ...
-2
votes
1answer
107 views

How to migrate an existing ASP.NET MVC site to ASP.NET MVC Core - specifically on authorization

I am in the process of upgrading an existing website to ASP.NET Core 2.1. The goal is simplification and ease of maintenance. Existing site is using: EF and .NET 4.6.2 A [Users] table in SQL Server ...
4
votes
0answers
785 views

Oauth 2 store access token vs verifying on each call

Let's say my Server is both Authorization Server and Resource server My Client (for example mobile app) can authenticate in 2 matters: via Resource Owner Password Credentials Grant via ...
4
votes
0answers
181 views

How to make sure media are used only on authorized sites?

I have a video library that I need to publish for my clients. The clients need to be able to embed a player into their sites and play the videos. I need to restrict access to my clients only so that ...
3
votes
0answers
93 views

Adding new service to authenticated website

So I've created an API that I want to leverage to add some functionality to an existing web app. My current website authenticates users using SAML. What I'm looking to do is instead of moving the code ...
2
votes
0answers
87 views

How can a client authorize us to collect their data from a service provider?

Our clients need to authorize our partners to release data to us. We can collect this data via a push/pull mechanism. Since our partners have never shared data before, they don't have OAuth ...
1
vote
0answers
102 views

How to support anonymous user in web application?

I work for a publishing company that also provides content distribution to their users. In order to access a piece of content the user must be entitled to do so. Traditionally this authorization check ...
1
vote
0answers
24 views

OAuth2 - client_credentials

I am in the process of building out a private REST API. This API is intended for machine to machine communication. In short someone else's server will kick off a job via CRON that pulls information ...
1
vote
0answers
41 views

Viable ways to handle an access token on the resource/web application server

Use case: We have a product which ties a set of resources to a concrete user. Now we would like to provide the customers with an API so that an automated client application can have access to a ...
1
vote
0answers
242 views

Authorization, permissions, and scoping resources in a microservice/DDD architecture

I'm building a microservice-based application (services according to DDD) and am about to implement authorization service. There are API gateways and UI applications that access backend servers, and ...
1
vote
0answers
65 views

Feedback on simple authorisation system design

I'm writing a fairly simple authentication/authorisation api for an intranet application we are developing. It's my first roles based authorisation system and its a good opportunity for a first ...
0
votes
0answers
34 views

User Managed Access on authorization servers: appropriate fine-grained authorization policy use-case?

We need to set up a third party authorization system for exchanges between a server, owning a resource, and a "requesting party" client, needing action on this resource (reading, modifying). The User-...
0
votes
0answers
40 views

Asynchronous Micro-Service Authorization

I have the following setup for my application: A User logs in and is granted a Session Token. When making API requests to Service A the User provides the Session Token. All requests go through an API ...
0
votes
0answers
157 views

How to handle role based access in my microservice architecture

We are trying to move from a monolith application to a microservice architecture faced by a spa application. One of the reason, is that we want to expose some services of our business to partners and ...
0
votes
0answers
50 views

Storing user access on objects

I have a web app that has different types of object: Car, Client, Lead. Each record has a user owner and a user can do according to its permissions action only on its own records. Database is MySQL. ...
0
votes
0answers
19 views

Document rights vs document section rights

We have a document management web application, which users use to collaborate on a document. There are 2 roles at the application level - Editor and Reviewer, and 3 rights at the document and document ...
0
votes
0answers
55 views

Authorizing view content

Let's say I have a view which should change it's content based on the user resp. on the users permission. After some research I basically found 2 types of authorization. Role-Based and Activity-Based ...