Autorisierungsmiddleware

Autorisierung (authorization) is the process of determining whether an authenticated subject is allowed to perform a requested action on a given resource. It follows authentication, which verifies identity, and establishes what the subject is permitted to do. Authorization decisions may depend on the identity, the resource, the action, and contextual factors such as time or location. The outcome is typically an allow or deny decision that governs access to the resource or service.

Common models and mechanisms include discretionary access control (DAC), mandatory access control (MAC), role-based access control (RBAC), and attribute-based access control (ABAC). Access is often implemented through access control lists (ACLs), capability tokens, or policy engines that evaluate rules against the request. ABAC and policy-based approaches enable fine-grained decisions using attributes of the user, resource, action, and environment.

Authorization can be implemented through protocols and standards such as OAuth 2.0 for delegated access, OpenID Connect for identity in conjunction with OAuth, and SAML for enterprise single sign-on, with tokens like JWT carrying authorization claims. Policy languages such as XACML may express complex rules; in practice many systems embed policies in code or configuration. Enforcement points can be at API gateways, application services, or resource servers.

Best practices include applying least privilege, regular reviews of permissions, prompt revocation of access, and short-lived tokens. Auditing and logging of authorization decisions help detect anomalies. Challenges include scalability, dynamic contexts, and balancing security with usability.