Authorization

Every application at some point needs to tackle user permissions. It may be early for some systems or much later in others, but one thing for certain is that as soon as you have more than one user type, the logic will slowly evolve into spaghetti code. And then each time you need to update it will take longer and longer to complete.

In this talk, we’ll proselytize about why decoupling authorization logic is the absolute best solution to the spaghetti code problem and other common authorization pitfalls. We'll look at real-world(ish) permissions implementations using open-source solutions. We'll try things like adding new role-based access controls to an application and evolving it to fine-grained attribute-based access controls. Along the way, we will run into typical blockers and try out ways to solve them. We'll also look at best practices for authorization (role management, policy evolution, the filtering problem, etc.) and when to just use the most obvious solution.

Sign-on standards, such as SAML and OpenID Connect (OIDC), have paved the way for an interoperable identity fabric that has propelled the industry forward. It’s time for authorization to have its “OIDC moment.”


Over the past few years, we’ve seen the rise of a new architectural pattern - externalizing authorization logic out of applications, and treating it as a separate concern. Google, Netflix, Airbnb, Carta, Intuit, and others have shared their experiences around how they’ve built their internal authorization systems, helping seed a growing movement around modern authorization.

Most organizations, however, don’t have the luxury of building these systems from scratch. Fortunately, a new generation of authorization vendors have created innovative solutions that promise to democratize modern authorization. With that said, each of these solutions defines its own APIs. In much the same way identity standards such as OIDC brought about “single sign-on for the web”, authorization standards promise to reduce barriers to adoption, increase reusability, and mitigate risk for organizations that want to take advantage of this innovation.

To get this off the ground, a group of authorization practitioners and vendors, including those represented on this panel, submitted a charter proposal to the OpenID Foundation for the establishment of the AuthZEN working group. The charter was accepted shortly after IIW 37 in October 2023. Since then, the group has been developing use cases, cataloging authorization patterns, and drafting proposals such as an interop spec for a PEP-PDP protocol. These efforts will unify a set of disparate ecosystems into a larger authorization community, which will create a rising tide for the industry at large.

Join us to discuss the current state of modern authorization. We’ll also describe the progress we’ve made defining authorization patterns, documenting use-cases and how best to accomplish them, and reviewing the interoperability standards we have drafted.