I have an authorization handler of the form:
Auth(AllowedGroups, Token) -> [Allow/Deny]
Token consist of the following tuple and its MAC tag.
TbsToken := (userid, usergroup, expiration) Token := (TbsToken, MAC)
The MAC key resides on the servers' sides, and along with the authorization handler, is used for automatic authentication with server B once user is logged onto server A.
A while ago
Now server B gets the new function of serving objects to invitees that appear anonymous to the server. To determine which object to serve, 120-bit (padding-free in base32) random ID of the object is passed to the access point.
Along with the ID, is the said token with "userid" removed (because anonymous) and "usergroup" replaced with the object ID. And the authorization handler is reused and called as:
Auth(ID, ((anon, ID, future), MAC))
It raises an alarm in me because the "AllowedGroups" is now controlled by the client, but I cannot see obvious ways this leads to vulnerability.
Is the authorization handler call 1) useful but may need tweaking? 2) useless as ID is already random, or 3) a security concern that must be removed?