Description
Events will currently perform a database query before any form of Authorization and then check the callers access to each individual event. This can be simplified if the request already have a subject we can filter for. A fully functional authorization request is going to need at least 4 parts.
- The identity of the caller
- A specific resource
- A specific subject
- Action; read (on app events) and subcribe
One thing to note here is that the both resource and subject will be a part of the resource category attribute list. Subject is a detailing of resource.
Warning
This change will effectively make it impossible to support instance delegation. Events relating to an instance will not be visible for the user if we pre-authorize and determine that the user don't have access.
Out of Scope
This Pre-authorization requires that the caller has included filtering on subject. Support for a more open search across subjects and support for instance delegation would require a manual check against authorized parties similar to how Dialogporten is doing it: Altinn/dialogporten#42
Description
Events will currently perform a database query before any form of Authorization and then check the callers access to each individual event. This can be simplified if the request already have a subject we can filter for. A fully functional authorization request is going to need at least 4 parts.
One thing to note here is that the both resource and subject will be a part of the resource category attribute list. Subject is a detailing of resource.
Warning
This change will effectively make it impossible to support instance delegation. Events relating to an instance will not be visible for the user if we pre-authorize and determine that the user don't have access.
Out of Scope
This Pre-authorization requires that the caller has included filtering on subject. Support for a more open search across subjects and support for instance delegation would require a manual check against authorized parties similar to how Dialogporten is doing it: Altinn/dialogporten#42