Authorization in a Service-Oriented Environment
summary
Claim: a small JSON policy language and a tiny adapter gem called IronHide provide a CanCan-compatible bridge that keeps authorization rules out of app code The implementation reads policies from flat files or a CouchDB adapter, exposes the CanCan API, and demos successfully as a library not a centralized service XACML is dismissed as too heavy, production readiness is unknown and scalability to many services and rules remains unproven
AI-written summary · about
chapters (12)
- 0:00Introduction to SOA
- 1:39Understanding Authorization
- 4:03Benefits and Challenges of SOA
- 5:01Service-Oriented Authorization
- 6:39Limitations of CanCanCan
- 8:10Decoupling Policy from Code
- 9:12SOA Heterogeneous Environment
- 12:19The XACML Approach
- 14:40A Simplified Framework
- 16:46Ironhide Ruby Gem
- 19:07Future Work and Goals
- 20:29Live Demo and Resources
related talks
09mFlexible Authorization:Storing and Managing Rules in DB
25mModernizing Authorization: From Basic Roles to Decoupled ABAC
41mAccess Denied: the missing guide to authorization in Rails
27mSecurity-by-construction: How to weave authorization into modern app stacks using Open Policy Agent
27mAuthorization in the GraphQL era
43mBuilding Authorization with Node.js: Dos and Don’ts
42mBeyond Code: Shaping Security in a Developer-Driven World
45mNext Generation Authorisation using Cedar