OpenID AuthZEN Interop Read Out - Authorization

During Identiverse 2024 and EIC 2024, members of the OpenID AuthZEN WG got together and demoed their authorization endpoints conforming to the AuthZEN API

1. OpenID AuthZEN Interop Read Out Identiverse 2024

2. David CTO – Axiomatics Brossard Allen Independent Foster Omri CEO – Aserto Gazitt Gerry VP Product & Standards – Strata Gebel

3. 2001 2013 2014 2016 2020 History ABAC ALFA NGAC Zanzibar

4. Identiverse 2023 – The Inception

5. The AuthZEN Charter https://openid.net/wg/authzen/ PEP PAP PDP PIP Initial focus: PEP-PDP API Follow-on: Policy Discovery & Management Follow-on: Event delivery

6. First Implementer’s Draft – May 2024 { "subject" : { "identity" : " CiRm …2Fs" }, "action" : { "name" : " can_read_user " }, "resource" : { "type" : "user" , " userID " : "[email protected]" } } { "decision": true } https:// openid.github.io / authzen /

7. First Interop Use Case https://authzen-interop.net/docs/scenarios/todo Viewer Editor Admin Evil Genius Todo Edit Delete View Complete

8. Interop Architecture Backend SQLLite Authorization Service AuthZEN Standard React frontend that manages Todo lists Node.JS backend that serves 5 routes that the frontend talks to

9. Interop Participants

10. Policy-based Graph-based ALFA OPA (Rego) Other Eve Maler a few years ago The Venn of Interop Participants

11. What next? Evaluations API : box- carring multiple requests together Resource Search API : find all the resources that a subject can access Subject Search API : find all the subjects that can access a resource Create additional interop scenarios Add more implementations (especially ReBAC systems) Work with relying parties to externalize authorization Pursue policy discovery/management and event delivery into PDP/PIP

12. Where to find us https://openid.net/wg/authzen/ 📧 Mailing List Meeting notes & Design Documents 📄 HackMD : https://hackmd.io/@oidf-wg-authzen Github 👩‍💻 https://github.com/ openid / authzen Slack 💬 #wg-authzen