Authorization terminology is a mess: Let's fix it

aandychiare 3 days ago 17 commentsRead Article on idpro.org

DE version is available. Content is displayed in original English for accuracy.

⚡ Community Insights

Discussion Sentiment

100% Positive

Analyzed from 640 words in the discussion.

Discussion (17 Comments)Read Original on HackerNews

usernametaken29•about 2 hours ago

https://xkcd.com/927

Nice work and all regardless

aneutron•about 1 hour ago

Quite literally the first thing that jumped to my mind when I read the title

bayindirh•about 1 hour ago

Another take I like is "The good thing about standards is there are many to choose from!"

tuberreact•about 2 hours ago

turns out naming is important

andai•about 2 hours ago

I'm maintaining a document called Tricksy words with multiple meanings that cause endless confusion and strife

Just in the past year I have wasted several months pulling my hair out due to incorrectly named projects.

It really does turn out naming is important!

rrr_oh_man•about 1 hour ago

Care to share some highlights?

ithkuil•about 1 hour ago

And renaming things is hard, if not impossible

jiggawatts•about 1 hour ago

I love how the OIDC standard is littered with “authentication identity token code id cookie identifier” and many subtle variations of homonyms in slightly different combinations and orders.

I’m sure someone thought it all made perfect sense.

Probably someone who never confuses “empathy” and “sympathy” while also carefully distinguishing between “should” and “ought”.

theasisa•about 1 hour ago

> Probably someone who never confuses “empathy” and “sympathy” while also carefully distinguishing between “should” and “ought”.

What do you mean by this?

perching_aix•6 minutes ago

[delayed]

throwaway1058•about 1 hour ago

I feel "ought" is stronger and is something that is expected of you, but English is not my native language.

"You should drink more water"

"You ought to help your sick mother"

andrewshadura•about 1 hour ago

Unclosable cookie banner. Top notch website engineering.

black_knight•about 2 hours ago

> can this subject perform this action on this object?

IMHO, the most elegant method to answer this question is capability based access control. If the subject can utter the action, then it can perform it. And then delegation is the transfer of nouns and verbs to perform the utterances.

simiones•about 1 hour ago

> If the subject can utter the action, then it can perform it.

This sounds like another layer of weird terminology that doesn't mean anything for someone who is not familiar with whatever capability system you're thinking of.

Say I am a user who can see a particular directory on a shared setup. I try to upload a file in this directory, using the same method that worked on another directory. The question of AuthZ is: will I be allowed to do it or not? In the plain sense of the words, I can absolutely "utter the action", I have all of the "verbs" (upload) and "nouns" (the file, the destination path). Still, I should not be allowed to perform the action if I was only given read-only access here.

Now sure, you can say that "upload to dirA" is a different verb than "upload to dirB". But this is just confusing terminology, it doesn't enlighten anything.

black_knight•28 minutes ago

You seem to understand it just fine.

Your accessor, dirB, should not contain the “upload files” verb, while your dirA accessor (noun) should.

My favorite example is the home directory and the file picker. Why should a program have access to all your files by default then politely ask you which file it should read/write to? It would make more sense if the file picker was something the operating system ran when a program wants to edit a file, and what came back to the program after you selected was the accessor for that file (with read and/or write verbs).

So the program only have access to those files you have it access to. It cannot even ask the question to open another file, because it only has opaque accessors to those files it has been given.

nmadden•17 minutes ago

I used to use the example of Dropbox’s chooser API to illustrate this: https://www.dropbox.com/developers/chooser

If you use this API (via a simple widget library) then the user simply picks a file in their dropbox and the app gets access to that one file. Vs OAuth where you grant the app broad access to the whole dropbox (or maybe some sub-folder).

williamdclt•about 1 hour ago

I have more experience with authorization than most engineers, even engineers who have some experience with authn/authz, and I have no idea what that "subject can utter the action" or "transfer of nouns and verbs to perform the utterances" could mean

black_knight•25 minutes ago

I chose those words here because they are not programming language specific. For the OOPers, I guess you can imagine I said “objects” and “methods”.

bijowo1676•about 2 hours ago

excellent article, very thorough and nuanced explanation.

Quarrelsome•about 2 hours ago

Nice!

I'd like to fix the prior abstract. Auth and auth upsets me greatly cos we have:

Authentication & Authorization

and we call both/either auth. Hence please help me make this a thing:

AuthENTIcation & AuthORIzation : ENTI & ORI

ENTI- can you enter, ORI (or ORIZ) what can you do?

hobofan•about 2 hours ago

This has already been solved well-enough with AuthN and AuthZ as distinct names.

rrr_oh_man•about 1 hour ago

UK is rotating in its decaying royal grave

rrr_oh_man•about 1 hour ago

andai•about 2 hours ago

ident and perms