How limit user's access to a certain resource?

user_7064910 0
Viewed 107

Suppose that I have a web application. Consider it like a Black-Box for now. I want to use a backend system to limit what a user can view/do on the app.

i.e. Sample users can only do three functions, Premium users can do 10 functions and see more pictures. What is the best way to do it?

I'm trying to using WSO2 Identity Server, but it doesn't offer this functionality. So I've thought that maybe I can integrate it with the WSO2 API Manager and make an API that limits users' access to a certain resource. But really I cannot find if it's possible do it. Anyone know it?

wso2-identity-server wso2 backend api
1 Answers

Please refer to : https://docs.wso2.com/display/IS530/Access+Control+Concepts

1) WSO2IS can act as a coarse grained access manager. Your application will act as a fine grained access mnager.

It means that roles can be defined in WSO2IS, managed and assigned to user. From there Roles assigned to one user can be provided as clains with the identity token generated by WSO2IS and sent to the application.

The application, on the other side, will manage roles to permissions links.

Access control is then done at each request by the application, based on the roles presented in the Identity Token by the user and the Permissions grid based on roles in the application.

2) The access control at the application is a business logic you must implement (or at least configure if it a COTS). It is possible to outsource this logic to WSO2IS as policies on attribute (with Workflows).

Please look at : https://docs.wso2.com/display/IS530/XACML+Architecture

Jeff

user_78632580
Related