Authorization - Revision history

Tom: /* Categories */

2025-09-06T00:49:04Z

‎Categories

Tom: /* References */

2025-06-08T18:36:24Z

‎References

Tom: /* Problems */

2024-08-08T18:10:51Z

‎Problems

Tom: /* Problems */

2023-05-26T22:39:09Z

‎Problems

Tom: /* Problems */

2023-05-26T22:36:31Z

‎Problems

Tom: /* Problems */

2023-05-26T22:29:16Z

‎Problems

Tom: /* Problems */

2023-05-26T22:28:16Z

‎Problems

Tom: /* Problems */

2023-05-26T22:20:07Z

‎Problems

Tom: /* Context */

2023-05-24T20:08:13Z

‎Context

Tom: /* Context */

2023-05-24T20:00:56Z

‎Context

@@ Line 12: / Line 12: @@
 At its core all [[Authorization]] decisions are local to the resource being shared. There are a wide range of implementations of [[Authorization]] spanning a range of categories that resist being separated. The following is just one suggestion for categorization to help in the reader's understand of the range covered by the term.
 # Centralized categories typically are rooted in an [[Enterprise]] [[Risk Assessment]]. An example would be a Microsoft Active Directory implementing user roles.
-# Decentralized categories typically are based on policy or user attributes that are created at a Policy Definition Point (PEP) and then evaluated at the Policy Enforcement Point (PEP).
+# Decentralized categories typically are based on policy or user attributes that are created at a Policy Definition Point (PDP) and then evaluated at the Policy Enforcement Point (PEP).
 An alternate categorization that is even less distinct is:
 # [[Role Based Access Control]] (RBAC) that might implemented as roles contained in an AD user record.
 # Attribute Based Access Control (ABAC) where the user attributes are compared with local policy. (Interestingly the user role is one such attribute.)
 # Policy Based Access Control (PBAC) where some policy (or business rule) is applied at the PEP. (This could be read to include ABAC. One policy language is XACML.)
 ==Problems==

← Older revision		Revision as of 18:36, 8 June 2025
Line 33:		Line 33:
	[[Category:Glossary]]		[[Category:Glossary]]
	[[Category:Authorization]]		[[Category:Authorization]]
		+	[[Category: Policy]]

@@ Line 22: / Line 22: @@
 * In the decentralized environment of the internet, the services no longer can ask for a complete user [[Identity]]. [[Privacy]] concerns have led to a policy of limiting knowledge of the user to those [[Attribute]]s which are absolutely essential for the [[Authorization Service]] to know in order to provide access. This follows from the enlightenment focus on the [[Identity#Identity_and_Freedom| freedom to control one's own identity]] in the many different roles that a user plays during the day, from family to work to hobbies, all with a different view of the [[Identity]] of the person.
 * The more challenging problem of [[Authorization|Authorizing]] access to a [[Subject]] arriving over the public internet is that the level of [[Authentication]] that has been applied to the [[Subject]] may be adequate for initial access, but is insufficient for full access to all resources. It is that use case which is considered here. For example, as user can be [[Authentication|Authenticated]] at a supplier to purchase goods on site, but then need to provide proof of age to purchase some restricted good, like drugs, alcohol or sexually explicit material.
-* The Consumer Fraud and Abuse Act (CFAA) in the US has some sloppy language to the effect that any unauthorized access of a computer system could be considered to be a federal crime. In an era where (nearly) all computers are publicly accessible this interpretation is potentially dangerous. It is suggest that it the owner's [[Responsibility]] to secure their digital assets just as it is there [[Responsibility]] to prevent unauthorized use of their automobile.<ref>Kendra Albert +1, ''Law and Technology, Do the Right Thing'' (2023-05) '''CACM 66''' No 5 p 18-20</ref>
+* The Consumer Fraud and Abuse Act (CFAA) in the US has some sloppy language to the effect that any unauthorized access of a computer system could be considered to be a federal crime. In an era where (nearly) all computers are publicly accessible this interpretation is potentially dangerous. It is suggest that it the owner's [[Responsibility]] to secure their [[Digital Asset]]s just as it is there [[Responsibility]] to prevent unauthorized use of their automobile.<ref>Kendra Albert +1, ''Law and Technology, Do the Right Thing'' (2023-05) '''CACM 66''' No 5 p 18-20</ref>
 ==Solutions==

@@ Line 22: / Line 22: @@
 * In the decentralized environment of the internet, the services no longer can ask for a complete user [[Identity]]. [[Privacy]] concerns have led to a policy of limiting knowledge of the user to those [[Attribute]]s which are absolutely essential for the [[Authorization Service]] to know in order to provide access. This follows from the enlightenment focus on the [[Identity#Identity_and_Freedom| freedom to control one's own identity]] in the many different roles that a user plays during the day, from family to work to hobbies, all with a different view of the [[Identity]] of the person.
 * The more challenging problem of [[Authorization|Authorizing]] access to a [[Subject]] arriving over the public internet is that the level of [[Authentication]] that has been applied to the [[Subject]] may be adequate for initial access, but is insufficient for full access to all resources. It is that use case which is considered here. For example, as user can be [[Authentication|Authenticated]] at a supplier to purchase goods on site, but then need to provide proof of age to purchase some restricted good, like drugs, alcohol or sexually explicit material.
-* The Consumer Fraud and Abuse Act (CFAA) in the US has some sloppy language to the effect that any unauthorized access of a computer system could be considered to be a federal crime. In an era where (nearly) all computers are publicly accessible this interpretation is potentially dangerous. It is suggest that it the owner's responsibility to secure their digital assets just as it is there [[Responsibility]] to prevent unauthorized use of their automobile.<ref>Kendra Albert +1, ''Law and Technology, Do the Right Thing'' (2023-05) '''CACM 66''' No 5 p 18-20</ref>
+* The Consumer Fraud and Abuse Act (CFAA) in the US has some sloppy language to the effect that any unauthorized access of a computer system could be considered to be a federal crime. In an era where (nearly) all computers are publicly accessible this interpretation is potentially dangerous. It is suggest that it the owner's [[Responsibility]] to secure their digital assets just as it is there [[Responsibility]] to prevent unauthorized use of their automobile.<ref>Kendra Albert +1, ''Law and Technology, Do the Right Thing'' (2023-05) '''CACM 66''' No 5 p 18-20</ref>
 ==Solutions==

@@ Line 22: / Line 22: @@
 * In the decentralized environment of the internet, the services no longer can ask for a complete user [[Identity]]. [[Privacy]] concerns have led to a policy of limiting knowledge of the user to those [[Attribute]]s which are absolutely essential for the [[Authorization Service]] to know in order to provide access. This follows from the enlightenment focus on the [[Identity#Identity_and_Freedom| freedom to control one's own identity]] in the many different roles that a user plays during the day, from family to work to hobbies, all with a different view of the [[Identity]] of the person.
 * The more challenging problem of [[Authorization|Authorizing]] access to a [[Subject]] arriving over the public internet is that the level of [[Authentication]] that has been applied to the [[Subject]] may be adequate for initial access, but is insufficient for full access to all resources. It is that use case which is considered here. For example, as user can be [[Authentication|Authenticated]] at a supplier to purchase goods on site, but then need to provide proof of age to purchase some restricted good, like drugs, alcohol or sexually explicit material.
-* The Consumer Fraud and Abuse Act (CFAA) in the US has some sloppy language to the effect that any unauthorized access of a computer system could be considered to be a federal crime. In an era where (nearly) all computers are publicly accessible this interpretation is potentially dangerous. It is suggest that it the owner's responsibility to secure their digital assets just as it is there responsibility to prevent unauthorized use of their automobile.<ref>Kendra Albert +1, ''Law and Technology, Do the Right Thing'' (2023-05) '''CACM 66''' No 5 p 18-20</ref>
+* The Consumer Fraud and Abuse Act (CFAA) in the US has some sloppy language to the effect that any unauthorized access of a computer system could be considered to be a federal crime. In an era where (nearly) all computers are publicly accessible this interpretation is potentially dangerous. It is suggest that it the owner's responsibility to secure their digital assets just as it is there [[Responsibility]] to prevent unauthorized use of their automobile.<ref>Kendra Albert +1, ''Law and Technology, Do the Right Thing'' (2023-05) '''CACM 66''' No 5 p 18-20</ref>
 ==Solutions==

@@ Line 3: / Line 3: @@
 ==Context==
-* Authorization does have other meanings not related to Identity
+* Authorization does have other meanings not related to [[Identity and Access Management]]
 * Previously [[Authorization]] was considered to be the second step after the [[Subject]] had been successfully [[Authentication|Authenticated]].