Forward Signed Authorization with airSlate SignNow

Cc byline authorization

hello my name is andrew kleimer and today we're going to talk about user authorization what are my options so we're going to assume that the user's been authenticated so we know who the user is now we just need to decide what they can do but before we dive into that we first want to make sure we're clear on what we mean by user authorization then once we've done that we'll look at the various options that developers use in order to deliver some form of user authorization so what do we mean by user authorization well it boils down to this can a subject typically a user perform a given action against a resource imagine this example a user wants to write a file to a particular folder in order to do that they need to be authorized the authorization services will either permit them or deny them the user attempts to write the file to the folder the authorization system denies but when they attempt to write to a different folder it may very well permit the action so now we're clear on what we mean by user authorization we'll now move on to some techniques one common approach used by developers is to leverage identity claims so what are identity claims identity claims are informational attributes about a user that get delivered post authentication so once a user's been successfully authenticated the authentication subsystem may deliver a set of identity claims additional attributes about the user that applications can use to make decision those identity claims can be anything about the user's identity name role department phone number date of birth the thing is it's a completely extensible mechanism some developers have seen this as an opportunity to say well why don't we put permissions inside those identity claims sets this will allow us to have some fine-grained control over access requirements we can just see if a user has a particular permission inside their claim set however there are downsides as a user moves job function inside the organization they'll need new permissions every time they move job function we have to go in and edit their permissions making sure they've got exactly the right permissions for their current job function and that's going to be really difficult to audit there's also poor scalability we're having to put lots of permissions on individual users but perhaps more importantly identity is not authorization identity claims need to represent information about the user's identity sure we'll use those information to drive an authorization decision but it shouldn't represent the authorization decision itself let's see how identity claims should really be used by looking at this real world example imagine you walk into a bar to buy a beer the bartender may very well challenge you to see if you're actually old enough or allowed to actually purchase alcohol at which point you present your government id your government id contains claims your name your date of...