tag: authorization
Authorization
Deciding what an authenticated caller may do.
Articles
- Authorization
The State Parameter in OAuth 2.0: CSRF, PKCE and RFC 9700
Why OAuth 2.0's state parameter exists, the CSRF attack it stops, how to generate and check it, and how state, PKCE and nonce divide the work under RFC 9700.
- Authorization
XACML With OpenID Connect, SAML, OAuth and SCIM: Who Does What
Five identity standards, five jobs: SAML and OIDC authenticate, OAuth delegates API access, SCIM provisions accounts and XACML evaluates authorization policies.
- Federation
Federation and Entitlement Management: How They Fit Together
Federation tells an app who the user is; entitlement management decides what they may do. How SAML, OIDC, SCIM and policy engines divide the work.
Guides
- IAM building block
Authorization: deciding what is allowed
How authorization works: role-based and attribute-based access control, XACML's PDP and PEP, policy-as-code engines, OAuth scopes, and where checks belong.
- Product overview
Axiomatics Policy Server overview
What the Axiomatics Policy Server does: attribute-based authorization with XACML and ALFA policies, PDP, PEP and PIP, and its place in IAM.
- Platform category
Entitlement management
What entitlement management systems do: inventory permissions, govern grants and reviews, and enforce fine-grained authorization with policy engines.