1 of 13

Omri Gazitt

Co-founder, Aserto & Co-chair, AuthZEN

IIW 39

​

OpenID AuthZEN:�The “OIDC” of Authorization

1

2 of 13

Authentication and Authorization

Did the user prove they are who they say they are?

​

What can the user do in the context of this app?

​

Authentication

Authorization

Zanzibar

NIST NGAC

AuthZEN

ALFA

2

2

3 of 13

What is modern authorization?

Coarse-grained, tenant-level permissions (RBAC)��Authorization “spaghetti logic” embedded in the application��Permissions evaluated at login time, scopes embedded in access token

​

Fine-grained: resource-level permissions (ABAC, ReBAC)��Policy-based: authorization logic extracted out of the application��Real-time: permissions evaluated before granting access to resource

Traditional

Modern

WHAT

​

HOW

​

WHEN

​

Principle of least privilege

�Separation �of duties

�Continuous enforcement

3

3

4 of 13

Modern authorization: ecosystems, standards & OSS

Policy as code (ABAC)

Policy as data (ReBAC)

Casbin

TOPAZ

Open Policy Agent

NGAC

2016

2001

AuthZEN

2024

Zanzibar

2020

2014

ALFA

4

4

5 of 13

The AuthZEN Charter

https://openid.net/wg/authzen/

Policy Enforcement Point (PEP)

Policy Administration Point (PAP)

Policy Decision Point (PDP)

Policy Information Point (PIP)

Initial focus: PEP-PDP API

Follow-on: Policy �Discovery & Management

Follow-on: Event delivery

5

5

6 of 13

AuthZEN 1.0 Implementer’s Draft: in review (expected Nov)

{

"subject": {

"type": "user",� "id": "CiRm…2Fs"

},

"action": {

"name": "can_delete_todo"

},

"resource": {

"type": "todo",

"id": "1"

"properties": {

"ownerID": "beth@the-smiths.com"

}

}

}

{

"decision": true

}

https://openid.github.io/authzen/

6

6

7 of 13

First interop use-case: Todo application

Viewer

Editor

Admin

Evil Genius

Todo

Create

Delete

View

Complete

https://authzen-interop.net/docs/scenarios/todo

7

7

8 of 13

Interop architecture & Demo

Backend

SQLLite

Authorization Service

AuthZEN Standard

React frontend that manages Todo lists

Node.JS backend that serves 5 routes that the frontend talks to

https://authzen-topaz-proxy.demo.aserto.com

8

8

9 of 13

Interoperable implementations as of Oct 2024

TOPAZ

Compliant with: 1.1 Preview, 1.0 Implementers Draft, 1.0 Preview

Compliant with: 1.0 Preview

9

9

10 of 13

Lessons learned

  • Starting with a draft helped get things going (thanks @Atul!)
  • Surveying prior art was helpful in not repeating mistakes
  • Cataloguing use-cases before moving on to specs helped define our scope
  • Defining an interop scenario (todo app) and an interop test suite helped inform the spec
  • Forcing functions – Identiverse 2024 (1.0-preview) and Authenticate 2024 (1.1-preview)

10

10

11 of 13

What’s Next?

  • Resource Search API: find all the resources that a subject can access
  • Subject Search API: find all the subjects that can access a resource

​

  • Create additional interop scenarios
  • Add more implementations (especially ReBAC systems)
  • Pursue policy discovery/management and event delivery into PDP/PIP

11

11

12 of 13

Call to action

  • Work with relying parties (Workday, SFDC, etc) to externalize authorization (help needed!)
  • Work with API Gateway vendors to wire AuthZEN into their products
  • Work with vertical-specific standards bodies (OAuth RAR, OAuth AS 🡪 PDP), FAPI, FHIR

12

12

13 of 13

Where to find us

Meeting notes & Design docs: https://hackmd.io/@oidf-wg-authzen

​

AuthZEN mailing list: https://openid.net/wg/authzen

​

GitHub: https://github.com/openid/authzen

​

OpenID Slack: #wg-authzen

13

13