All Questions

Tagged with
Filter by
Sorted by
Tagged with
1
vote
0answers
65 views

Designing distributed authentication/authorisation system

I'm trying to design a system that has the following elements: the main backend REST API (currently one, probably multiple in the future) front-channel client(s) -- JS-based single-page app(s) back-...
0
votes
1answer
66 views

SSO authentication & authorization architecture/implemenation

We got a bunch of different services (SPAs + API GW, legacy JavaEE apps, etc.). Each of those is usually ran in multiple instances (customer specific instances). The plan is to federate them under a ...
3
votes
1answer
124 views

What are the security implications of having a dummy user account representing unauthenticated users?

In my web application, users are assigned to groups and groups are granted permissions on objects. The application exposes some objects to unauthenticated public users (i.e. people casually visiting ...
8
votes
1answer
8k views

What is the difference between claims, attributes, and roles?

Many questions have already been asked about Claims-based authentication and the differences with other approaches: Role-based vs Claims-based Explain claims-based authentication Now, my favorite ...
31
votes
2answers
17k views

Role Based Authorization vs. Claim Based Authorization

What is the difference between "role based authorization" and "claim based authorization"? Under which circumstances would it be appropriate to implement each of these authorization models?