OAuth is DAC. What do you do for MAC?
Talkat OWASP AppSec Europe 2018 · on Thursday, 2018-07-05· at 13:30· St James - 4th Floor, QEII Centre Broad Sanctuary, Westminster·
summary
Covers how projects are using OAuth instead of SAML for access control and the mismatch between OAuth’s user-consent model (DAC) and the need for mandatory/administrative controls (MAC). Describes vendors’ ad-hoc extensions to authorization servers—often RBAC-based—to provide mandatory access control, argues that these approaches should be standardized in the short term, and suggests the industry should research and move beyond RBAC for long-term standardization.
AI-written summary · about
