Authorization

Also study difference of authentication and authorization from mam notes aur anywhere else

Authorization is a security mechanism used in computing to determine and enforce what specific
actions a user or process is allowed to perform within a system. It is typically based on verifying
permissions associated with users, roles, or objects within an application, service, or resource.

Key Concepts in Authorization

1. Authentication vs. Authorization:

o Authentication verifies who the user is.

o Authorization defines what the user is allowed to do.

o For example, after a user logs in (authentication), the system checks their
permissions (authorization) to determine what actions or resources they can access.

2. Permissions and Access Control:

o Permissions are rules that define which actions are allowed on a resource.

o Access Control enforces these permissions. There are several models for access
control, which dictate how permissions are granted and enforced.

Common Access Control Models

1. Role-Based Access Control (RBAC):

o Users are assigned roles (e.g., Admin, Editor, Viewer).

o Each role has predefined permissions for accessing specific resources or

o Example: An “Admin” role might allow read, write, delete permissions, while a
“Viewer” role may only allow read permissions.

2. Discretionary Access Control (DAC):

o Users have control over the resources they own and can decide who else can
access them.

o This model is commonly used in file systems where owners can set permissions
on their files.

3. Mandatory Access Control (MAC):

o Access is granted based on fixed policies controlled by the system or a central

o Access levels are often based on security classifications, such as “Confidential,”

Authentication First: The user logs in, proving their identity to the system.

Identify Role/Attributes: The system retrieves the user’s role (like Admin or Viewer) or attributes
(like department).

Permission Check: When the user attempts an action, the system checks if their role or attributes
have the necessary permissions for that action.

Access Control Decision:

 If the user has permission, they can proceed.

 If not, access is denied, and an error message is shown.

Authorization Techniques

1. Access Control Lists (ACLs):

o ACLs define permissions for each user or role on a specific resource.

o Example: A file might have an ACL specifying that “User A” can read and write, while
“User B” can only read.

2. OAuth and Token-Based Authorization:

o OAuth is a protocol used for token-based authorization.

o An application requests authorization for a third-party service from a user , and if

o Example: A user grants permission for an app to access their Google Drive files, and
the app receives a token to act on the user’s behalf.

3. JSON Web Tokens (JWTs):

o JWTs are a way to securely transmit information between parties as a JSON object.

o Commonly used for stateless authorization, where the server does not store any
user session data. The token itself contains claims about the user and their
permissions.

4. OpenID Authorization :
OpenID Connect allows applications (clients) to verify a user's identity based on
authentication performed by an external Authorization Server (e.g., Google,
Facebook) and obtain basic profile information about the user. It is widely used for
Single Sign-On (SSO), allowing users to log in once and access multiple services.
Benefits:

Improved Security:

 By restricting access to resources based on user permissions, authorization prevents

Minimizes the Principle of Least Privilege Risks:

 Authorization ensures that users have only the minimum access necessary for their roles,
limiting potential damage from accidental or malicious actions.

Customizable Access Control:

 With models like Role-Based Access Control (RBAC) or Attribute-Based Access Control
(ABAC), organizations can customize permissions based on users' roles, attributes, or specific
needs.

Streamlined User Experience:

 Authorization allows users to see only the resources and options they are authorized for,
simplifying the user interface and enhancing usability.

Reduced Risk of Data Breach and Insider Threats:

 By limiting access to sensitive data and critical systems, authorization helps reduce the risk
of data breaches and insider threats, as only trusted users can access key resources.