apidays LIVE London 2021 - Reaching Maximum Potential in Banking & Insurance with API Mindset October 27 & 28, 2021 API Security Authorization is on the rise. What if there was an API for it? Damian Schenkelman, Principal Engineer at Auth0

1. Authorization is on the rise.
What if there was an API for it?
@dschenkelman

2. Building software in 2021…

3. Security

4. Privacy

5. New York
JULY
Australia
SEPTEMBER
Singapore
APRIL
Helsinki & North
MARCH
Paris
DECEMBER
London
OCTOBER
Jakarta
FEBRUARY
Hong Kong
AUGUST
JUNE
India
MAY
Check out our API Conferences here
50+ events since 2012, 14 countries, 2,000+ speakers, 50,000+ attendees,
300k+ online community
Want to talk at one of our conferences?
Apply to speak here

6. Compliance

7. Table Stakes
https://medium.com/pm-insights/how-to-pick-winning-product-
features-7b03abcf7d12

8. Collaboration

9. Sharing

10. Partnerships

11. Differentiator
https://medium.com/pm-insights/how-to-pick-winning-product-
features-7b03abcf7d12

12. Authorization

13. NOT Authentication

14. Authorization

15. OWASP TOP 1
https://owasp.org/Top10/
Broken Access Control

16. In the beginning…
RBAC
DELETE /customers/{id}
const user = await db.users.get(cookie.userId);
if (user.role === "admin")) {
// delete customer
// return 204
} else {
// return 403
}
select role from users
where userId == {uid};

17. In the beginning…
RBAC
DELETE /customers/{id}
const user = await db.users.get(cookie.userId);
if (user.role === "admin")) {
// delete customer
// return 204
} else {
// return 403
}
select role from users
where userId == {uid};

18. In the beginning…
RBAC
DELETE /customers/{id}
const user = await db.users.get(cookie.userId);
if (user.role === "admin")) {
// delete customer
// return 204
} else {
// return 403
}
select role from users
where userId == {uid};

19. In the beginning…
RBAC
DELETE /customers/{id}
const user = await db.users.get(cookie.userId);
if (user.role === "admin")) {
// delete customer
// return 204
} else {
// return 403
}
select role from users
where userId == {uid};

20. In the beginning…
RBAC
DELETE /customers/{id}
const user = await db.users.get(cookie.userId);
if (user.role === "admin")) {
// delete customer
// return 204
} else {
// return 403
}
select role from users
where userId == {uid};

21. Finer Grained Authorization

22. I want to use attributes from subject and object…
ABAC
DELETE /customers/{id}
const user = await db.users.get(cookie.userId);
const customer = await db.customers.get(req.path.id);
if (user.department === "IT" && !customer.subscribed)) {
// delete customer
// return 204
} else {
// return 403
}
select department from users
where id == {uid};
select subscribed from customers
where id == {cid};

23. I want to use attributes from subject and object…
ABAC
DELETE /customers/{id}
const user = await db.users.get(cookie.userId);
const customer = await db.customers.get(req.path.id);
if (user.department === "IT" && !customer.subscribed)) {
// delete customer
// return 204
} else {
// return 403
}
select department from users
where id == {uid};
select subscribed from customers
where id == {cid};

24. I want to use attributes from subject and object…
ABAC
DELETE /customers/{id}
const user = await db.users.get(cookie.userId);
const customer = await db.customers.get(req.path.id);
if (user.department === "IT" && !customer.subscribed)) {
// delete customer
// return 204
} else {
// return 403
}
select department from users
where id == {uid};
select subscribed from customers
where id == {cid};

25. I want to use attributes from subject and object…
ABAC
DELETE /customers/{id}
const user = await db.users.get(cookie.userId);
const customer = await db.customers.get(req.path.id);
if (user.department === "IT" && !customer.subscribed)) {
// delete customer
// return 204
} else {
// return 403
}
select department from users
where id == {uid};
select subscribed from customers
where id == {cid};

26. I want to use attributes from subject and object…
ABAC
DELETE /customers/{id}
const user = await db.users.get(cookie.userId);
const customer = await db.customers.get(req.path.id);
if (user.department === "IT" && !customer.subscribed)) {
// delete customer
// return 204
} else {
// return 403
}
select department from users
where id == {uid};
select subscribed from customers
where id == {cid};

27. I want to use attributes from subject and object…
ABAC
DELETE /customers/{id}
const user = await db.users.get(cookie.userId);
const customer = await db.customers.get(req.path.id);
if (user.department === "IT" && !customer.subscribed)) {
// delete customer
// return 204
} else {
// return 403
}
select department from users
where id == {uid};
select subscribed from customers
where id == {cid};

28. I want to know who did what…
DELETE /customers/{id}
// log: cookie.userId requesting authz to delete customer
const user = await db.users.get(cookie.userId);
const customer = await db.customers.get(req.path.id);
if (user.department === "IT" && customer.unsubscribed)) {
// log: cookie.userId authorized to delete customer
// delete customer
// return 204
} else {
// log: cookie.userId unauthorized to delete customer
// return 403
}
select department from users
where id == {uid};
select unsubscribed from customers
where id == {cid};

29. I want to know who did what…
DELETE /customers/{id}
// log: cookie.userId requesting authz to delete customer
const user = await db.users.get(cookie.userId);
const customer = await db.customers.get(req.path.id);
if (user.department === "IT" && customer.unsubscribed)) {
// log: cookie.userId authorized to delete customer
// delete customer
// return 204
} else {
// log: cookie.userId unauthorized to delete customer
// return 403
}
select department from users
where id == {uid};
select unsubscribed from customers
where id == {cid};

30. I want to know who did what…
DELETE /customers/{id}
// log: cookie.userId requesting authz to delete customer
const user = await db.users.get(cookie.userId);
const customer = await db.customers.get(req.path.id);
if (user.department === "IT" && customer.unsubscribed)) {
// log: cookie.userId authorized to delete customer
// delete customer
// return 204
} else {
// log: cookie.userId unauthorized to delete customer
// return 403
}
select department from users
where id == {uid};
select unsubscribed from customers
where id == {cid};

31. I want it to be reliable and fast…
DELETE /customers/{id}
// log: cookie.userId requesting authz to delete customer
const user = await db.users.get(cookie.userId);
const customer = await db.customers.get(req.path.id);
if (user.department === "IT" && customer.unsubscribed)) {
// log: cookie.userId authorized to delete customer
// delete customer
// return 204
} else {
// log: cookie.userId unauthorized to delete customer
// return 403
}
select department from users
where id == {uid};
select unsubscribed from customers
where id == {cid};

32. Access Review?
Who can access what?

33. Approval?
Change Management

34. Auditing?
What happened?

35. Reliability?

36. Latency?

37. Developer APIs

38. Approach #1: Policies

39. Mental Picture
public enum Decision {
Allow,
Deny,
…
}
public Decision {policy_name} (subject, permission, object, context)
{
// rules…
}

40. Example Architecture
3. get user and
customer data
2. can user
delete customer?
1. can user
delete customer?
Manage Policies
PAP
Policy
Decision
Point
Policy
Information
Point
6. delete customer
5. user is
authorized
Policy Repository
Customer
Service
4. evaluate policy

41. Advantages
• Easier to understand what authorization logic applies
• Authorization change management is simpler than having it in code
• Auditing is implemented outside of business logic

42. Disadvantages
• Requires operating more components

43. Disadvantages
• Requires operating more components
• Does not handle storage of authz data
• 👉 latency + reliability + scale
• 👉 collaboration scenarios
•

44. Approach #2: "Zanzibar"

45. Zanzibar
Not this one…

46. Google Zanzibar
https://research.google/pubs/pub48190/

47. ReBAC

48. Multi-region

49. Sweet spot
Policies
(AuthZ needs)
DBaaS
(handles data)
Zanzibar "as a Service”

50. Industry

51. Alternatives
(disclaimer: I work on Project "Sandcastle")
Project "Sandcastle"

52. DEMO

53. Architecture
Sandcastle in "PDP Mode"
2. check(user, delete, customer)
1. can user
delete customer?
Customer Service
PDP
Sandcastle
4. delete customer
3. user is authorized
nginx

54. Enforcement

55. Advantages
• Auditing is part of "aaS"
• Authorization change management is simpler than having it in code
• Easier to understand what authorization logic applies
• Multi-region and operated by someone else

56. Disadvantages
• Many things are a relationship, but not everything (e.g. time of day)

57. Approach #3: Combined

58. Architecture
Sandcastle in "PIP Mode"
4. check(user,
delete, customer)
2. can user
delete customer?
1. can user
delete customer?
Manage Policies
Distribute Policies
PAP
PDP
PIP
Sandcastle
6. delete customer
5. user is authorized
Policy Repository
3. evaluate policy

59. Final Thoughts

60. AuthZ APIs Resources
• Google Zanzibar: https://research.google/pubs/pub48190/
• Zanzibar Academy: https://zanzibar.academy
• Himeji (Zanzibar @ Airbnb): https://medium.com/airbnb-engineering/himeji-a-scalable-
centralized-system-for-authorization-at-airbnb-341664924574
• AuthZ (Zanzibar @ Carta): https://medium.com/building-carta/authz-cartas-highly-
scalable-permissions-system-782a7f2c840f
• Facebook TAO: https://www.usenix.org/system/
fi
les/conference/atc13/atc13-bronson.pdf
• Authzed: https://authzed.com/
• Ory Keto: https://www.ory.sh/keto/docs/

61. @auth0lab Resources
• Sandcastle playground: https://learn.sandcastle.cloud/
• Auth0 Lab discord: https://t.co/ybHn8hEOBl?amp=1
• Authorization in Software Podcast: https://
authorizationinsoftware.auth0.com/
• @auth0lab: https://twitter.com/auth0lab

62. Policy Resources
• OPA: https://www.openpolicyagent.org/
• Styra: https://www.styra.com/
• OSOHQ: https://docs.osohq.com/
• XACML: http://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html
• NIST ABAC: https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.sp.800-162.pdf
• RBAC: https://csrc.nist.gov/CSRC/media/Publications/conference-paper/1992/10/13/
role-based-access-controls/documents/ferraiolo-kuhn-92.pdf

63. Thanks!
@dschenkelman
@auth0lab

64. Questions?

65. New York
JULY
Australia
SEPTEMBER
Singapore
APRIL
Helsinki & North
MARCH
Paris
DECEMBER
London
OCTOBER
Jakarta
FEBRUARY
Hong Kong
AUGUST
JUNE
India
MAY
Check out our API Conferences here
50+ events since 2012, 14 countries, 2,000+ speakers, 50,000+ attendees,
300k+ online community
Want to talk at one of our conferences?
Apply to speak here