Fine-Grained Access Control with OAuth

Fine-grained access control is a nuanced approach to managing who can access specific resources, under what conditions, and to what extent. This system allows for a detailed specification of access rights, ensuring precise control over resource access.

To achieve fine-grained authorization, combine different access control measures like PBAC (Policy-Based Access Control), RBAC (Role-Based Access Control), ABAC (Attribute-Based Access Control), RBAC (Risk-Based Access Control), and more.

With fine-grained authorization policies, you can utilize entities like OAuth scopes, different token claims, user’s authentication context, and more, to give access to resources only if specific criterias are met.

OAuth Token Scope

OAuth employs access scopes to implement fine-grained access control. With scopes, you can specify exactly which actions an application can perform on the user’s behalf. For example, a scope might allow access to a user’s email, but a lack of a specific scope in client application’s token may result in access being denied.

Scopes reflect specific service areas (service features, functions, APIs) to which access must be controlled and user consent given explicitly.

Apart from regular OAuth Scopes, Cloudentity supports Dynamic Scopes. If the developer is aware that the next set of client app’s operations relate to a single item, such as a specific account or user, they might want to restrict the authorization access token to this action or intent. It can be done by including a reference to the object as a part of the scope.

Token Claims

Claims provide additional information about the user or client, aiding in making more refined access control decisions. They can be used to dictate access based on attributes such as the user’s role, group, or other characteristics.

User’s authentication context attributes – which encapsulate details about how a user was authenticated, the attributes related to that user, and potentially other surrounding aspects of the authentication process – can be mapped to token claims and, then, included in the token itself allowing for a finer level of access control.

Token Granularity

Tokens can be configured to carry detailed access rights. This granularity ensures that clients are bestowed with the necessary rights to perform their operations, no more and no less, fostering a balance between accessibility and restriction

Conditional Access

Access decisions can be made based on various conditions like the user’s device, location, or network, providing an additional layer of granularity.