We are using Keycloak Identity server which will take care of Authentication and Authorization for our new Multi Level Marketing Website.

There was a discussion going on within our team to maintain Authorization concepts separately in our local database. As we need to use ID server only for Authentication it seems.

What are the best practices to maintain Authorization and Authentication logic separately?

closed as unclear what you're asking by Xander, Serge Ballesta, TheJulyPlot, Jedi, Steve Jun 26 '17 at 14:09

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    What do you mean by Authorization concepts in this scenario? – Jedi Jun 22 '17 at 17:23
  • @Jedi maintaining roles and permissions of the users – Nick Jun 22 '17 at 19:57

Do we need to maintain Authentication and Authorization Logic separately?

Yes, yes, yes!

These are two different tasks. Conflating the two incorrectly is one of the most common sources of vulnerability.

Number 2 and 4 of the OWASP top 10 this year, specifically: https://www.owasp.org/index.php/Top_10_2017-Top_10

Authentication is "who are you" and authorization is "what can you do."

Authenticating a user does not authorize them, and being authorized is no guarantee of authentication.

Not the answer you're looking for? Browse other questions tagged or ask your own question.