networknt
Add fine-grained authorization along with JWT and scope
Need to implement a generic structure to handle Role-based, Rule-based and Attribute-based authorization in the framework. The real implementation or entitlement mapping will leave to customization.
One of the customers is building it internally as fine-grained auth must be in the business context. They are trying to leverage light-rule which is a rule engine based on Kotlin DSL. At this moment, I don't have any time to focus on it but I would like to provide an open source reference implementation if possible and an enterprise edition for most industries. Let me know if you are interested in working together.
@stevehu I'm interested in open source implementation and enterprise edition, thanks
A banking customer has implemented within its business context. I am still trying to figure out how to implement a list of generic middleware handlers with user-defined rules. As fine-grained authorization happening within the business context, it is very hard to draw the line between open-source implementation and industry-specific requirement.
My client is doing it in 2 handlers:
- establishes a security role, based on tamper-proof claims in the JWT handler
- performs FGA based on the security role.
The intention is to move the decision to light-rule
This has been done with yaml-rule and https://github.com/networknt/light-rest-4j/tree/master/access-control