Cloud Native Data Security with OAuth

Chapter 9. Entitlements

A Note for Early Release Readers

With Early Release ebooks, you get books in their earliest form—the authors’ raw and unedited content as they write—so you can take advantage of these technologies long before the official release of these titles.

This will be the 9th chapter of the final book. The GitHub repo is available at https://github.com/curityio/cloud-native-oauth-security-examples.

If you have comments about how we might improve the content and/or examples in this book, or if you notice missing material within this chapter, please reach out to the editor at [e-mail].

In this chapter we start with introducing you to common models for designing entitlements and access control policies. We discuss how you can evolve your access control mechanisms with an entitlement management system that makes sure that APIs grant users the right entitlements at the right time in a consistent and scalable manner with the help of the OAuth access token. To demonstrate the theory, we look into Open Policy Agent and the relevant features as part of an entitlement management system. Finally, we showcase our arguments with an end-to-end example that ties together the dots.

Access Control Models

Access control (AKA authorization) is a security primitive that determines who can access what in which way and context. It distinguishes between the subject, that is the entity requesting access, the object, that is the protected resource like the user’s order history ...