Difference between revisions of "Authorization"
From MgmtWiki
(→Context) |
(→Context) |
||
| Line 3: | Line 3: | ||
==Context== | ==Context== | ||
| − | * Previously [[Authorization]] was considered to be the second step after the user had been [[Authentication]] | + | * Previously [[Authorization]] was considered to be the second step after the user had been [[Authentication|Authenticated]]. |
* The challenge of [[Authorization]] can be modeled as a decision theory where [[Authorization]] of access is granted after the [[Authorization]] service has evaluated the [[Claim]]s presented and made a single decision about access where the [[Identity]] of the [[Subject]] is assumed to haven been appropriately [[Authentication]]. In the case of a failed [[Authorization]] the [[Subject]] was typically given instructions on the appropriated manual procedures to be follow to gain access to the resource. | * The challenge of [[Authorization]] can be modeled as a decision theory where [[Authorization]] of access is granted after the [[Authorization]] service has evaluated the [[Claim]]s presented and made a single decision about access where the [[Identity]] of the [[Subject]] is assumed to haven been appropriately [[Authentication]]. In the case of a failed [[Authorization]] the [[Subject]] was typically given instructions on the appropriated manual procedures to be follow to gain access to the resource. | ||
*In the long term game theory would be a better model | *In the long term game theory would be a better model | ||
Revision as of 12:29, 30 December 2018
Full Title or Meme
An action that will give a user an Access Token to a protected resource.
Context
- Previously Authorization was considered to be the second step after the user had been Authenticated.
- The challenge of Authorization can be modeled as a decision theory where Authorization of access is granted after the Authorization service has evaluated the Claims presented and made a single decision about access where the Identity of the Subject is assumed to haven been appropriately Authentication. In the case of a failed Authorization the Subject was typically given instructions on the appropriated manual procedures to be follow to gain access to the resource.
- In the long term game theory would be a better model
Bayesian Identity Proofing provides the means for a collection of authentication and verification steps to be validated.
