Authelia is an open-source authentication/authorization server with 2FA/SSO

Re:Authelia is an open-source authentication/authorization s... by xtracto on Wednesday March 10, 2021 @11:54AM (#26413319)

Thanks for this list, it is very useful. Do you know of a "real world" example use for Keratin Authn? I see the diagrams and it looks like it could be useful but it kind of looks like moving the login/password part of the backend to another service (OK), but what happens with authorization? (user roles have ability to do specific tasks)

[ Parent | on HN ]

Re:Authelia is an open-source authentication/authorization s... by vbsteven on Wednesday March 10, 2021 @01:28PM (#26414348)

I don’t know about real world implementations but to answer the last question: IMO authorization responsibility belongs to the backend service. I like setups where the API Gateway talks to Keycloak for authenticating a request and passes a JWT with user/role info to the backend. The backend can then use the info from the JWT to perform authorization, and if necessary performs extra queries against an ACL table (or service).

[ Parent | on HN ]