Cloud Native Data Security with OAuth

Chapter 9. Entitlements

You have seen how to design and work with access tokens so that you create a secure solution from the authorization server’s token issuance to clients sending the tokens to APIs. Eventually, the access token is a credential that your APIs use to perform authorization decisions, and you should understand what authorization techniques you can apply to it.

In this chapter, we introduce you to common models for designing entitlements and access control policies. We discuss how you can evolve your access control mechanisms with an entitlement management system (EMS) that makes sure that APIs grant users the right entitlements at the right time in a consistent and scalable manner with the help of the OAuth access token. To demonstrate the theory, we look into Open Policy Agent (OPA) and the relevant features as part of an EMS. Finally, we showcase our arguments with an end-to-end example that connects all the dots.

Access Control Models

Access control (aka authorization) is a security primitive that determines who can access what, in which way, and in what context. It distinguishes between the subject, that is, the entity requesting access; the object, that is, the protected resource like the user’s order history or company files; and the action, that is, what the subject is trying to do with the object (like read or write). Authentication is an important prerequisite for access controls to reliably identify the subject (“who”). In OAuth, the access token can ...