Deciding what someone can do
Recognizing an account does not settle what it may do. Authorization connects a particular request to the rules for the resource, and those rules must be enforced where the action happens.
Access has boundaries
Cora shares an album with Ava. Ava can enjoy the photos, but Cora hasn't invited her to delete them or change who else can see them.
AuthenticationChecking evidence that someone, or some application, controls an account, such as a password or a passkey. It establishes which account is being used, not what that account may do. helps the service establish which account is making a request. Authorization decides whether that request is permitted. Some requests, such as reading a public album, can be allowed without authentication at all.
Ava's accountAuthentication helps the service establish which account is making a request. Authorization decides whether that request is permitted.
View Cora's album
- Action
- View
- Resource
- Cora's album
Allowed by the sharing rule.
Delete Cora's photo
- Action
- Delete
- Resource
- Cora's photo
Not granted by permission to view.
Change who else can see them
- Action
- Change sharing
- Resource
- Cora's album
Not granted by permission to view.
Some requests, such as reading a public album, can be allowed without authentication at all.
Understanding an access decision
When Ava asks to delete a photo, the service needs more than “Ava is signed in.” It needs to consider the particular request:
- Subject: the person or application making the request.
- Resource: the particular photo being accessed.
- Action: deleting that photo.
- Context: relevant circumstances, such as the device being used.
In an access decision, the subject is whoever is asking right now. That is narrower than the subject in What is Identity?, which was the person or thing a record represents. Ava is the subject of her account record and, when she asks to delete a photo, the subject of that request too.
A policy supplies the rules. It might let an album's owner delete photos while allowing invited viewers only to read them. Ownership of another album wouldn't satisfy that rule for Cora's album.
Ava asks to delete a photo
- Subject
- Ava's account, a viewer of Cora's album
- Action
- Deleting that photo
- Resource
- A photo in Cora's album
- Context
- Such as the device being used
Which rule applies?
- An album's owner
- Delete photos
- Invited viewers
- Only read them
The owner may delete; a viewer may not.
Ownership of another album wouldn't satisfy that rule for Cora's album.
Organizing permissions
Managing each permission separately would soon become awkward. Role-based access control, or RBAC, groups permissions into roles. An album editor might be allowed to add photos and change captions. Assigning the role gives those permissions within its intended scope, perhaps one album.
An identity service can organize administrative work the same way. A help desk role might allow viewing and locking accounts without allowing password resets or role assignments. Giving only the access needed for the job is least privilege.
Some decisions need more context. A company might allow unpublished photos to be downloaded only by its communications staff, and only on laptops the company manages and keeps up to date. Attribute-based access control, or ABAC, evaluates attributes of the requester, resource, action and environment. Roles and attribute rules can work together.
Album editor
- Add photos
- Change captions
- Scope
- Perhaps one album
Assigning the role gives those permissions within its intended scope.
Help desk
- Viewing accounts
- Locking accounts
- Password resets
- Role assignments
Only the access needed for the job.
Enforcing the decision
Choosing Delete sends the photo service a request, a message asking for an action on a particular photo. The service's API, or application programming interface, defines the operations software can request and how to request them. Its response reports what happened.
The page may hide Delete from viewers, but that only removes one way to ask. Someone could send the request using another tool. The service holding the photos must check permission before deleting anything. That service runs on computers called servers, so this is often described as enforcing access on the server, rather than in the page someone sees.
The resource must be checked too. Changing an album identifier from 42 to 43 asks for a different album. Knowing its identifier supplies a way to locate it, not permission to use it.
Permissions can change while a page remains open. If access has been removed, the next protected request must be refused even if the browser still shows the old control. The service needs current permissions, not just the permissions that were true when the page loaded.
A useful audit trail records the decision: who acted, what they requested, which resource or account was affected, when it happened and the outcome. Audit records use subject in yet another way. For a change to another person's access, the actor made the change and the subject was affected by it. If Cora removes Ava's access to her album, Cora is the actor and Ava is the subject. Keeping those identities separate makes the record useful for accountability.
Delete hidden from viewers
- The page shows
- No Delete control
- The request asks
- Delete, using another tool
- The server checks
- Permission before deleting anything
Refused
An album identifier changed
- The page shows
- Album 42
- The request asks
- Album 43
- The server checks
- The resource: its identifier supplies a way to locate it, not permission to use it
Refused
Access removed while a page remains open
- The page shows
- The old control
- The request asks
- Delete
- The server checks
- Current permissions
Refused
A useful audit trail records the decision: who acted, what they requested, which resource or account was affected, when it happened and the outcome.
Album owner
Delete photo in album 42
Is the account allowed to delete photos in album 42?
Allowed
Invited viewer
Delete photo in album 42
Is the account allowed to delete photos in album 42?
Denied
Check your understanding
Try these questions before moving on. If an answer isn't right, use the feedback and try again.
Try it in the Lab
- Give Rae a small job and only the access it needsLet a helper lock an account, see why she cannot unlock it, and remove her role while her old page is still open.