Authorization for Modern Applications

on YouTube ↗49m

" summary

Modern apps authenticate with OpenID Connect/OAuth2 then ask what is this user allowed to do. The solution shown is a PolicyServer reference architecture that separates identity from authorization, exposes a management API and a client API, provides a client library with caching and middleware for claims transformation, and a dynamic policy provider that synthesizes ASP.NET Core policies at runtime. Tokens keep identity only (warning: Azure AD can put ~150 groups into tokens and break 32KB cookies). The open‑source library and commercial product are production‑used by customers.

AI-written summary · about

" chapters (5)

1. 0:00Introduction to authorization
2. 11:48Authorization challenges and approaches
3. 27:57Policy provider design and implementation
4. 37:02Modern authorization in ASP.NET Core
5. 47:29Key takeaways and recommendations

" related talks

• 54mAuthorization for modern ApplicationsDominick Baier · NDC Oslo 2018
• 58mImplementing Authorization in Web Applications and APIsDominick Baier, Brock Allen · NDC London 2018
• 51mAuthentication and Authorization in ASP.NET Core 2Roland Guijt · Update Conference Prague 2018
• 58mImplementing authorization in web applications and APIsBrock Allen · NDC Minnesota 2018
• 39mSecuring your apps with OAuth2 and OpenID ConnectRoland Guijt · Codemotion Rome 2015
• 01h 02mImplementing authorization in web applications and APIsDominick Baier · NDC Sydney 2017
• 01h 07mGetting Authorization Right in .NET: Patterns, Pitfalls...Michele Leroux Bustamante · NDC Security 2026
• 58mLet's talk AuthJordan Knight · NDC Sydney 2016