Authorization for modern Applications

on YouTube ↗54m

" summary

Argues a concrete architecture: keep identity (OpenID Connect/OAuth2 tokens and claims) separate from authorization and run permissions from a runtime policy store called PolicyServer (open source on GitHub with a commercial UI). Shows a client library, middleware and ASP.NET Core policy-based authorization handlers that evaluate hospital-style permissions (doctor vs nurse, per-API scopes) and discusses caching, freshness and why tokens are for identity not mutable permission lists — it works in multiple real deployments.

AI-written summary · about

" chapters (7)

1. 0:00The need for authorization
2. 3:51Common authorization patterns
3. 14:12Identity vs. authorization
4. 27:36Building a policy engine
5. 31:52Integration strategies
6. 43:00Advanced policy handling
7. 47:33Managing complex hierarchies

" related talks

• 49mAuthorization for Modern ApplicationsDominick Baier · DevConf 2018
• 58mImplementing Authorization in Web Applications and APIsDominick Baier, Brock Allen · NDC London 2018
• 01h 02mImplementing authorization in web applications and APIsDominick Baier · NDC Sydney 2017
• 56mImplementing authorization in web applications and APIsDominick Baier, Brock Allen · NDC Oslo 2017
• 58mImplementing authorization in web applications and APIsBrock Allen · NDC Minnesota 2018
• 01h 07mGetting Authorization Right in .NET: Patterns, Pitfalls...Michele Leroux Bustamante · NDC Security 2026
• 45mThe Future of Authorization in ApplicationsGabriel L. Manor · DevDays Europe 2024
• 51mAuthentication and Authorization in ASP.NET Core 2Roland Guijt · Update Conference Prague 2018