Implementing authorization in web applications and APIs
summary
Explains why authentication stays in an identity service (example: IdentityServer issuing identity tokens) while authorization lives closer to each API via a separate authorization provider that returns per-application roles and permissions (doctor/nurse/patient → roles mapped to permissions), with caching, dynamic claim-to-role mapping, and a client library for lookups. Shows ASP.NET Core policies, on-the-fly policy providers, custom requirements and handlers, and resource-based authorization for examples like prescribing medication versus business logic for allergy checks.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 3:25Authorization is hard
- 6:50Authentication first
- 10:43Authentication metadata
- 12:49What happens if this data becomes ambiguous
- 15:01Why this is a bad idea
- 17:02Two things
- 17:18Authorization Provider
- 23:32Prototype
- 25:55Demo
- 26:52Authentication
- 27:50Client Library
- 30:58Dr Role
- 32:00Other authorization styles
- 34:55Claims transformation
- 38:09New Authorization API
- 41:14New Authorization API Demo
- 45:53Dependency Injection
- 46:58Policy Providers
- 49:11Custom Requirements
- 51:49Resource Based Authorization
related talks
58mImplementing authorization in web applications and APIs
56mImplementing authorization in web applications and APIs
58mImplementing Authorization in Web Applications and APIs
54mAuthorization for modern Applications
01h 07mGetting Authorization Right in .NET: Patterns, Pitfalls...
51mAuthentication and Authorization in ASP.NET Core 2
49mAuthorization for Modern Applications
59mASP.NET Core Authentication and Authorization - the Key Concepts