Authorization with OAuth 2 and its limitations
#AuthorizationInSoftware #FineGrainedAuthZAtScale #security
In this audio conversation, Vittorio Bertocci and Damian Schenkelman discuss #identity, #OAuth2, #JWT and what you can and can't do with those for various #authorization scenarios.
Note: A couple of minutes of audio were lost during the recording. Sorry!
Timestamps:
00:00 - Intros
04:48 - What is OAuth2?
10:37 - We have a client that had this need to call an API, what did OAuth provide and how does that work?
23:07 - With the Auth and Resource servers no longer collocated, how does the resource server what the token has access to without a shared database?
31:54 - What is JWT and what are it's implications across the industry?
40:46 - What is the profile? What authorization scenarios were you thinking of when working on the profile?
50:05 - What does it mean for authorization scenarios now that scopes, roles and entitlements can be placed in the token? What scenarios aren't easily supported when using JWT?
54:25 - If there are cases with lots of documents, what are the implications of putting scopes and roles in the token?
57:50 - What are the use cases for interoperability in the context of access tokens and authorization you are thinking about?
1:03:52 - When you are trying to secure internal applications, is the work you need to model your permissions different? Are there any solutions for that?
1:14:05 - What are the alternatives for systems need fine-grained dynamic authorization that have to use JWT for authentication?
1:17:10 - When you talk about the blob that you can hydrate that the some solutions use, does the blob have data or does it have logic?
Related links:
Blog post "On the nature of OAuth 2 scopes": https://auth0.com/blog/on-the-nature-...
OAuth 2: https://oauth.net/2/
JWT spec: https://datatracker.ietf.org/doc/html...
Site to learn about JWT: https://jwt.io/
OAuth 2 JWT Access Token profile: https://datatracker.ietf.org/doc/html...
Google Zanzibar: https://research.google/pubs/pub48190/
#Sandcastle (Auth0's Zanzibar implementation): https://learn.sandcastle.cloud
Zanzibar academy: https://zanzibar.academy/
Open policy agent: https://www.openpolicyagent.org/
Biscuit: https://www.clever-cloud.com/blog/eng...
Learn more about Fine Grained Authorization at Scale and Auth0 Sandcastle in our ongoing AuthZ series: “Authorization in Software: Subject Matter Experts Chats” - • Authorization in Software