Overview
Every application that serves multiple users eventually needs to answer two fundamental questions:
- Who is making this request?
- Are they allowed to perform this action?
The mechanisms used to establish the identity of actors, and determine what those actors are permitted to do, constitute the Identity & Access Control subsystem.
Here, we explore how modern applications implement these two capabilities: the ownership scope options available, the capabilities products commonly need, and the challenges that shape a robust design.
Ownership Scope
- Managed: Delegate all the identity and access management functions, to an external auth provider.
- Hybrid: Delegate part of the subsystem to an external provider while building and operating the rest in-house.
- Built: Build and operate the entire subsystem in-house.
Capabilities
- Multi-Tenancy: Organize identities, memberships, and permissions across independent tenants within a shared application.
- Enterprise Identity & Governance: Integrate with enterprise identity infrastructure through SSO, directory synchronization, automated provisioning, and access governance.
- Fine-Grained Authorization: Control access to individual resources using roles, ownership, relationships, sharing permissions, and contextual policies.
- API & Machine Access: Authenticate and authorize external applications, services, and automated agents through API credentials, machine identities, scoped tokens, and delegated access.
Challenges
- Authorization at Scale: Evaluate permissions efficiently across large numbers of users, resources, and services.
- Authorization-Aware Data Access: Retrieve, filter, paginate, and aggregate data while respecting resource-level permissions.
- Revocation & Consistency: Ensure changes to sessions, memberships, roles, and permissions take effect within defined consistency guarantees.
- Availability & Failure Handling: Maintain secure and predictable behavior when identity providers, authorization engines, or their dependencies become unavailable.
Identity & Access Control is fundamental to building systems that are secure, trustworthy, and capable of evolving. Done well, it enables applications to grow, organizations to collaborate, and new capabilities to emerge without compromising control over who can access what.