Authorization
The process of determining what resources and actions an authenticated user is allowed to access.
What is Authorization?
Authorization is the process of determining what resources and actions an authenticated user is allowed to access. It answers the question: "What are you allowed to do?"
Authorization comes after authentication - you must first prove who you are, then the system determines what you can access.
Common authorization models:
- RBAC (Role-Based Access Control): Permissions based on user roles (admin, user, guest)
- ABAC (Attribute-Based Access Control): Permissions based on user/group/resource attributes
- PBAC (Policy-Based Access Control): Permissions based on dynamic policies (time, location, device)
- OAuth 2.0 Scopes: Fine-grained API permissions (read, write, delete)
Authorization decisions can be:
- Permissive: Allow by default, deny specific actions
- Restrictive: Deny by default, allow specific actions (more secure)
Analogy
Think of authorization like a hotel key card. After you check in (authentication), your key card is programmed to open your room (resources you can access) but not other guests' rooms (resources you can't access). Authorization determines 'what you can do' after proving 'who you are'.
Types and Use Cases
- Enterprise SSO: Use RBAC to grant employees access based on job role (HR sees HR systems, Engineering sees dev tools)
- APIs: Use OAuth scopes to limit what third-party apps can do (read-only vs. read-write)
- File Systems: Use ABAC to grant access based on file owner, department, classification level
- CIAM: Use PBAC to allow admin actions only from corporate IP ranges during business hours
How it Works
// Authorization Check (Simplified RBAC Example)
// Define roles and permissions
const roles = {
admin: ["read", "write", "delete", "manage_users"],
user: ["read", "write"],
guest: ["read"]
};
// Authorization middleware
function authorize(user, resource, action) {
const userRoles = user.roles; // ["admin", "user"]
for (const role of userRoles) {
if (roles[role].includes(action)) {
return true; // Authorization granted
}
}
return false; // Authorization denied
}
// Usage
if (authorize(currentUser, "user_profile", "delete")) {
deleteUserProfile(userId);
} else {
res.status(403).send("Forbidden");
}Authorization vs Authentication
Authorization
Authentication
Authorization verifies what you can do (permissions)
Authentication verifies who you are (identity)
Authorization happens after authentication - you must prove who you are before the system determines what you can access
Authentication uses credentials (password, OTP)
Authorization uses policies/rules (RBAC, ABAC)
Best Practices for Authorization
- Follow least privilege: Only grant users the minimum permissions they need to do their job
- Use RBAC for simplicity: Start with role-based access control - it's easier to manage than ABAC
- Regular access reviews: Quarterly review user permissions and remove unnecessary access
How LoginRadius Powers Authorization
LoginRadius CIAM platform provides comprehensive authorization capabilities including Role-Based Access Control (RBAC) with custom roles and permissions, OAuth 2.0 scope management for API authorization, and administrative access controls for your team. Our platform allows you to define custom roles, assign users to multiple roles, and enforce authorization policies across your applications. LoginRadius also provides authorization APIs for programmatic permission checks, detailed audit logs for all access decisions, and compliance reporting for SOC 2, ISO 27001, and HIPAA.
FAQs
Authentication answers 'Who are you?' - it verifies your identity using credentials (password, OTP, biometric). Authorization answers 'What are you allowed to do?' - it checks your permissions (admin vs. user, read vs. write). Authentication comes first (prove who you are), then authorization (determine what you can access). Think of authentication as showing your ID to enter a building, authorization as your key card only working on certain floors.
RBAC (Role-Based Access Control) assigns permissions based on user roles (admin, user, guest) - simple but rigid. ABAC (Attribute-Based Access Control) assigns permissions based on user/group/resource attributes (department, clearance level, time of day) - flexible but complex. Use RBAC for simple scenarios (most companies), ABAC for complex scenarios (government, healthcare). Many organizations use RBAC as base + ABAC for exceptions.
LoginRadius provides robust authorization capabilities: (1) RBAC - assign users to roles (admin, user, etc.) with specific permissions, (2) Custom roles - create unlimited custom roles for your organization, (3) OAuth scopes - fine-grained API permissions (read, write, delete), (4) Admin console access - control who can manage users, configure policies, view logs. LoginRadius also provides APIs to check user permissions programmatically and audit logs for all authorization decisions.