What you're describing is the difference between Fine Grained Authorization (FGA) and traditional Role-based Access Control (RBAC). This article covers the difference: https://www.osohq.com/learn/what-is-fine-grained-authorizati... (disclaimer: I used to work there but continue to be a fan of their documentation).
Sort of, but not really. OAuth isn’t RBAC and the Dropbox chooser isn’t FGA in the sense of that article. My book (linked from my profile) covers the distinctions in more detail in chapters 7, 8 and 9.
What you're describing is essentially what the authorization system would need to do in order to answer the question "can this subject perform this action on this object?". If you're suggesting that the program should receive a list a priori, then there are potential scale issues since that list would need to be exhaustive of both nouns and verbs, which can be a large set.
Instead of an authorisation system trying to find a reason to give you permission, you have to carry the proof in the form of a “verb”. Which you use when you perform the action.
Right, but where do you get the proof to begin with? Using your OS example, it seems like the OS would need to precompute all of the possible accesses for the file picker? In this case, the OS is an authorization system.
Do you mean that the directory should not be responsible for making this decision and there should be a central authorization authority?
There a sort of “might makes right” principle here. If you can do it, you can mint a capability for it, which means you will perform the action when someone with that capability requests it.
A central authority is not a requirement. What is required is some way making sure capabilities are unforgeable.
This can be a central authority, which then has a completely mechanical task of registering capabilities and their ownership. But it can also be ensured “cryptographically” with a key.
The OS already has a capability system called “file descriptors”. Which works quite well, within its limited scope. This could be expanded out to more areas.
The question is - how do you get the ability to write to pathA and to pathB but not to pathC, while another user gets the ability to write to pathA and pathC but not to pathB?
Do you get a huge list of capability keys when you log into the system, one for each path? Do you ask a service for a capability when you want to perform the action?
Rockerbox enables marketers to collect and consolidate all of their marketing data, including from those that don't have API's, on a single platform. We process streaming transactional and batch aggregate data to derive insights that help marketers understand which channels are most effective for them.
We're hiring for two roles:
- Platform Engineer: Join a newly established team (3 current members) that will be tackling some hard problems to enable us to scale. Projects include spinning up K8s, building out a testing platform, and enabling continuous delivery.
- Product Engineer: Join the team on a mission to make it easy for non-technical marketing teams to integrate all of their data and visualize customer journeys. We're constantly iterating and obsess over making the insights more actionable.
reply