appnote: Add appnote covering Authorisation #115
Conversation
| They allow authorisation decisions to be made by taking a set of policies defined in some domain-specific language, along with the attributes of the user (group membership) and resource (Source/Flow class), and computing whether to allow the request. | ||
| This decision process is intended to be run inline for each request, for example at an authenticating proxy placed in front of the API server. | ||
|
|
||
| For storing classes, an initial proof-of-concept could be built using Source and Flow tags: for example defining "special" tags such as `authz_class.news = 1` (using one tag per class to enable querying for presence of that tag, which is not possible with e.g. a comma-separated list). |
There was a problem hiding this comment.
Is the = 1 here just because the tag needs content?
There was a problem hiding this comment.
Yes: it could equally be = true
samdbmg
force-pushed
the
sammg-add-authorisation-appnote
branch
from
cc16ad9 to
bcdf5f3
Compare
| They allow authorisation decisions to be made by taking a set of policies defined in some domain-specific language, along with the attributes of the user (group membership) and resource (Source/Flow class), and computing whether to allow the request. | ||
| This decision process is intended to be run inline for each request, for example at an authenticating proxy placed in front of the API server. | ||
|
|
||
| For storing classes, an initial proof-of-concept could be built using Source and Flow tags: for example defining "special" tags such as `authz_class.news = 1` (using one tag per class to enable querying for presence of that tag, which is not possible with e.g. a comma-separated list). |
There was a problem hiding this comment.
I'm concerned that using separate tags for a PoC is not representative of what we're actually do with a single field holding an array. Need to balance whether we need in a PoC to be able to query content by permission (makes sense longer term with the final API field) v providing something more representative to the permissions layer.
There was a problem hiding this comment.
I believe this approach was taken due to limitations of https://aws.amazon.com/verified-permissions/ and https://github.com/Permify/permify , as per line 85. I shall double check this.
Details
Adds AppNote 0016 proposing approaches to handling authorisation in TAMS, based on the BBC/AWS workshop in Salford in November 2024.
Jira Issue (if relevant)
Jira URL: https://jira.dev.bbc.co.uk/browse/CLOUDFIT-3534
Related PRs
Merge after #113
Submitter PR Checks
(tick as appropriate)
Reviewer PR Checks
(tick as appropriate)
Info on PRs
The checks above are guidelines. They don't all have to be ticked, but they should all have been considered.