1 of 12

OpenID AuthZEN: �1.1 Interop Read-out

Omri Gazitt

Co-founder & CEO, Aserto

David Brossard

CTO, Axiomatics

Alex Olivier

CTO, Cerbos

Atul Tulshibagwale

CTO, SGNL

1

2 of 12

Authentication and Authorization

Did the user prove they are who they say they are?

​

What can the user do in the context of this app?

​

Authentication

Authorization

CTAP

Zanzibar

NIST NGAC

AuthZEN

ALFA

2

3 of 12

The AuthZEN Charter

https://openid.net/wg/authzen/

Policy Enforcement Point (PEP)

Policy Administration Point (PAP)

Policy Decision Point (PDP)

Policy Information Point (PIP)

Initial focus: PEP-PDP API

Follow-on: Policy �Discovery & Management

Follow-on: Event delivery

3

4 of 12

AuthZEN 1.0 Implementer’s Draft: in review (expected Nov)

{

"subject": {

"type": "user",� "id": "CiRm…2Fs"

},

"action": {

"name": "can_delete_todo"

},

"resource": {

"type": "todo",

"id": "1"

"properties": {

"ownerID": "beth@the-smiths.com"

}

}

}

{

"decision": true

}

https://openid.github.io/authzen/

4

5 of 12

First interop use-case: Todo application

Viewer

Editor

Admin

Evil Genius

Todo

Create

Delete

View

Complete

https://authzen-interop.net/docs/scenarios/todo

5

6 of 12

Interop architecture & Demo

Backend

SQLLite

Authorization Service

AuthZEN Standard

React frontend that manages Todo lists

Node.JS backend that serves 5 routes that the frontend talks to

https://authzen-topaz-proxy.demo.aserto.com

6

7 of 12

Interoperable implementations as of Oct 2024

TOPAZ

Compliant with: 1.1 Preview, 1.0 Implementers Draft, 1.0 Preview

Compliant with: 1.0 Preview

7

8 of 12

Lessons learned

  • Starting with a draft helped get things going (thanks @Atul!)
  • Surveying prior art was helpful in not repeating mistakes
  • Cataloguing use-cases before moving on to specs helped define our scope
  • Defining an interop scenario (todo app) and an interop test suite helped inform the spec
  • Forcing functions – Identiverse 2024 (1.0-preview) and Authenticate 2024 (1.1-preview)

8

9 of 12

What’s Next?

  • Resource Search API: find all the resources that a subject can access
  • Subject Search API: find all the subjects that can access a resource

​

  • Create additional interop scenarios
  • Add more implementations (especially ReBAC systems)
  • Pursue policy discovery/management and event delivery into PDP/PIP

9

10 of 12

Call to action

  • Work with relying parties (Workday, SFDC, etc) to externalize authorization (help needed!)
  • Work with API Gateway vendors to wire AuthZEN into their products
  • Work with vertical-specific standards bodies (OAuth RAR, OAuth AS 🡪 PDP), FAPI, FHIR

10

11 of 12

Where to find us

Meeting notes & Design docs: https://hackmd.io/@oidf-wg-authzen

​

AuthZEN mailing list: https://openid.net/wg/authzen

​

GitHub: https://github.com/openid/authzen

​

OpenID Slack: #wg-authzen

11

12 of 12

Thank you

12