Should access control be managed from inside application?

Question

I am a developer who's just starting to learn about authorization and authentication for web apps. I am bit unclear on the concept of managing access control to parts of the app, and where is the best place to have access control managed, given the plethora of third-party authorization services like AD or Auth0.

For instance, let's say I have an eCommerce website, and I use Azure's Active Directory (AD) to manage my users login. Several parts of the website include, say, items management, category management, and promotion management. Some roles could be, "item manager" - who's able to see and modify items, a "marketing executive", who will be able to see and modify promotions, and a superadmin, who can do anything.

Is it a good practice to have the role and access management available directly inside the app? So if a superadmin would like to create a new role, who has both access to item and promotion management, they can create the role inside the app and assign it to users. The back-end then would directly go to AD and create a new role. Is this even possible?

Alternatively, should all these roles be managed directly inside AD? If so, what would happen as the application grows and have extensions of functionalities - would developers then need to add new claims to the existing roles every time they develop something?

Answer 1

As always: it depends. It depends, for example, on your relation with the users. Are they from your company or are they clients?

If the users are not from your own company, you will want to separate your application users from your internal access. That means that, if you want to use an AD for authentication/authorization, you will create a separate AD. Depending a bit on your design, you may also use LDAP or even database tables.

Also, if your users are external and part of a large company, you could use their AD (SAML tokens etc.) In that way, you do not need to do user management (think password resets). Especially larger enterprises will appreciate not having to do a separate user administration for your application.

It depends also on your organization, what you are comfortable with. Personally, I would never use an AD, not just because of the unneeded complexity that it introduces, but also because I have more experience with a simple LDAP. However, if you're in a more Microsoft-knowledgeable organization, you may be comfortable with AD. You will however probably need multiple ADs.

It also depends on who does the access management. If your user-base does their own user management, than a form of authorization management must be offered to them.

So there is no clear yes/no answer.

Some points though:

• do not mix your own users (operators, developers) and clients on the same authorization/authentication system
• if you have a corporate client, offer a way to integrate in their authentication mechanism
• if your user base does their own authorization/access management, they must have a way to do this (probably in the application), even if they cannot offer their own authentication tokens.