Hi Dulanja, I'm -1 on this. Currently the authentication framework is utilized by the web browser redirection involved protocols such as OpenID, SAML 2.0, OAuth 2.0 Code grant and OpenID Connect. None of these specifications talks about an authorization of the user at the OpenID Provider / Identity Provider / Authorization Server. They authenticates the users and issue assertions containing user claims. And the assertion consumers process these assertions and take action on them (authorization may be a part of it). In above cases they can perform authorization based on the user claims or scope of the oauth tokens, and IS do provides APIs for these RBAC, claim based access control and Scope base access control.
So my idea is that the authorization should be an optional second step performed by the assertion consumers but not by the IS. However the assertion consumers can utilize IS APIs for authorization if it's required for them. Thanks, -Suresh On Wed, Sep 25, 2013 at 6:22 AM, Dulanja Liyanage <[email protected]> wrote: > Hi All, > > Currently we do the $subject. Even before the framework, checking > authentication + authorization was there in SAML SSO and etc. > > During an offline chat with Johann we discussed whether the authorization > part is actually needed for someone who just wants to be authenticated from > IS. > > WDYT? > > Thanks & Regards, > Dulanja > > -- > Dulanja Liyanage > Senior Software Engineer - WSO2 Inc. > M: +94776764717 > -- Suresh Attanayake Senior Software Engineer; WSO2 Inc. http://wso2.com/ Blog : http://sureshatt.blogspot.com/ Web : http://www.ssoarcade.com/ Facebook : https://www.facebook.com/IdentityWorld Twitter : https://twitter.com/sureshatt LinkedIn : http://lk.linkedin.com/in/sureshatt Mobile : +94755012060 Mobile : +01-616-617-1172
_______________________________________________ Dev mailing list [email protected] http://wso2.org/cgi-bin/mailman/listinfo/dev
