Burden of Authorization

[Cantor, Scott]

On 12/18/14, 9:43 PM, "federator" <wpadmin at identiainc.com> wrote:

>Sounds like the terminology confusion is quite widespread.  Even Google 
>is calling their OAuth engine which performs authentication as 
>"Authorization Server".

That's directly out of OAuth's standard terminology and the list of terms 
OAuth has rendered incomprehensible would exceed this list's message size 
limit.

>Authorization deals with access control after 
>user has been authenticated by some means.  Yes, most cloud identity 
>providers only handles SSO at this point and that's not authorization by 
>all means.

The OP's problem is that most SPs don't want to do authorization at all, 
so they make the IdP do it instead and never deliver them an unauthorized 
user.

>That's very true because these vendors don't do authorization, and this 
>is why:  The hard reality is that 99% of the service provider 
>implementation today is still based on account-based security using 
>Role-based access control.

It's true that a lot of them have that basic model, and yes, that means 
provisioning and so forth, which is a hassle. Those aren't usually the 
worst problem cases though. The more common case at scale (think Google 
Apps, Box, etc.) is that there is *no* authorization model.

-- Scott