Authorization
Authorization determines what an authenticated user, application, or system is allowed to access or do.
It answers:
What are you allowed to do?
Authentication vs. Authorization
This application is Integration A.
Authorization:
Integration A may read products and orders but may not issue refunds.
The two concepts are related but separate.
How Authorization Is Applied
Authorization may control access to:
- Particular API Endpoints
- Specific records
- Read operations
- Write operations
- Administrative actions
- Particular organizations or accounts
- Specific scopes
OAuth, for example, allows access to be granted with defined permissions rather than giving another application unrestricted access to the user's account.
The OAuth 2.0 specification describes a framework for granting limited access to an HTTP service. OAuth 2.0 Authorization Framework — RFC 6749
Why It Matters
A system should generally receive only the access required for its function.
A reporting integration may need:
Read orders.
It may not need:
Delete customers.
This is closely related to the principle of least privilege used in User Roles & Permissions.
Common Problems
Common problems include:
- Every integration receiving administrator-level access
- Permissions never reviewed
- Broad scopes chosen because they are easier
- Old integrations retaining access
- Authentication succeeding and being mistaken for authorization
- Applications requesting permissions unrelated to their purpose
How to Improve
Grant the minimum access required.
Document:
- What the integration needs
- Why it needs it
- Which scopes or permissions provide it
- Who approved that access
- How access can be revoked
Review permissions when the integration's purpose changes.