Skip to content

Commit 7fa2874

Browse files
xiaoyijunxiaoyijun
authored
docs: move app-level access control to authorization section (#1446)
1 parent 20c24aa commit 7fa2874

42 files changed

Lines changed: 58 additions & 42 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎docs/authorization/README.mdx‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ import Users from '@site/src/assets/users.svg';
1010

1111
[Authorization](https://auth.wiki/authorization) in Logto defines **what users and apps can do after authentication**: which APIs, resources, or actions are allowed for each identity.
1212

13-
Logto provides flexible, token-based authorization for modern SaaS and AI apps. You can protect API resources globally, or within the context of each organization. All permissions are managed through a [role-based access control (RBAC)](/authorization/role-based-access-control) system, with advanced support for multi-tenant apps via [organization templates](/authorization/organization-template).
13+
Logto provides flexible, token-based authorization for modern SaaS and AI apps. You can protect API resources globally, or within the context of each organization. All permissions are managed through a [role-based access control (RBAC)](/authorization/role-based-access-control) system, with advanced support for multi-tenant apps via [organization templates](/authorization/organization-template). Beyond controlling what users can do, you can also restrict which users can sign in to each application with [app-level access control](/authorization/app-level-access-control).
1414

1515
## Core concepts \{#core-concepts}
1616

@@ -34,6 +34,8 @@ There are three main authorization patterns in Logto. Pick the scenario that mat
3434

3535
Logto models API resources according to [RFC 8707](https://auth.wiki/resource-indicator), using the `resource` parameter in OAuth 2.0 authorization flows. This makes it simple to secure multiple APIs or microservices, and ensures compatibility with other standards-based systems.
3636

37+
These patterns control what a user can do **after** signing in to an application. To control whether a user can sign in to a specific application at all, use [app-level access control](/authorization/app-level-access-control). It restricts application access with allow rules based on users, roles, organizations, or organization roles, and works independently of the token-based patterns above.
38+
3739
:::tip
3840
Need custom claims or advanced access control? See [Custom token claims](/developers/custom-token-claims).
3941
:::
@@ -110,6 +112,16 @@ Ready to go further? Start hands-on, explore real-world guides, or deepen your u
110112
icon: <Security />,
111113
},
112114
},
115+
{
116+
type: 'link',
117+
label: 'App-level access control',
118+
href: '/authorization/app-level-access-control',
119+
description:
120+
'Restrict which users can sign in to each application using users, roles, organizations, and organization roles.',
121+
customProps: {
122+
icon: <Security />,
123+
},
124+
},
113125
{
114126
type: 'link',
115127
label: 'Customizing token claims',

docs/integrate-logto/app-level-access-control.mdx renamed to docs/authorization/app-level-access-control.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
description: Restrict which users can sign in to a specific application using users, roles, organizations, or organization roles.
33
sidebar_label: App-level access control
4-
sidebar_position: 5
4+
sidebar_position: 7
55
---
66

77
# App-level access control

‎docs/integrate-logto/README.mdx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,14 +57,14 @@ Or try a no-code integration solution via Protected App when you’re using Logt
5757
]}
5858
/>
5959

60-
Restrict which users can access a specific application:
60+
Once your applications are integrated, you can restrict which users can access a specific application:
6161

6262
<DocCardList
6363
items={[
6464
{
6565
type: 'link',
6666
label: 'App-level access control',
67-
href: '/integrate-logto/app-level-access-control',
67+
href: '/authorization/app-level-access-control',
6868
description:
6969
'Control who can sign in to each application using users, roles, organizations, and organization roles.',
7070
customProps: {

‎docs/integrate-logto/protected-app.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ The Protected App, powered by Cloudflare, operates globally on edge networks, en
1414

1515
The Protected App maintains session state and user information. If a user is not authenticated, the Protected App redirects them to the sign-in page. Once authenticated, the Protected App wraps the user's request with authentication and user information, then forwards it to the origin server.
1616

17-
To restrict which authenticated users can access a Protected App, configure [app-level access control](/integrate-logto/app-level-access-control) on the application's **Rules** tab.
17+
To restrict which authenticated users can access a Protected App, configure [app-level access control](/authorization/app-level-access-control) on the application's **Rules** tab.
1818

1919
This process is visualized in the following flowchart:
2020

‎docs/integrate-logto/third-party-applications/README.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ Thus due to OIDC builds upon [OAuth 2.0](https://auth.wiki/oauth-2.0) adding an
3535

3636
All created third-party applications will be catalogued on the Applications page under the "Third-party apps" tab. This arrangement helps you distinguish them from your own applications, making it easier to manage all your applications in one place.
3737

38-
To restrict which users can sign in to a third-party application, configure [app-level access control](/integrate-logto/app-level-access-control) on the application's **Rules** tab.
38+
To restrict which users can sign in to a third-party application, configure [app-level access control](/authorization/app-level-access-control) on the application's **Rules** tab.
3939

4040
## Integration guide \{#integration-guide}
4141

i18n/de/docusaurus-plugin-content-docs/current/integrate-logto/app-level-access-control.mdx renamed to i18n/de/docusaurus-plugin-content-docs/current/authorization/app-level-access-control.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
description: Beschränke, welche Benutzer sich bei einer bestimmten Anwendung anmelden können, indem du Benutzer, Rollen, Organisationen oder Organisationsrollen verwendest.
33
sidebar_label: Zugriffskontrolle auf App-Ebene
4-
sidebar_position: 5
4+
sidebar_position: 7
55
---
66

77
# Zugriffskontrolle auf App-Ebene

‎i18n/de/docusaurus-plugin-content-docs/current/integrate-logto/README.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ Beschränke, welche Benutzer auf eine bestimmte Anwendung zugreifen können:
6464
{
6565
type: 'link',
6666
label: 'App-spezifische Zugangskontrolle',
67-
href: '/integrate-logto/app-level-access-control',
67+
href: '/authorization/app-level-access-control',
6868
description:
6969
'Steuere, wer sich bei jeder Anwendung anmelden kann – mit Benutzern, Rollen, Organisationen und Organisationsrollen.',
7070
customProps: {

‎i18n/de/docusaurus-plugin-content-docs/current/integrate-logto/protected-app.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ Die Protected App, unterstützt durch Cloudflare, arbeitet global auf Edge-Netzw
1414

1515
Die Protected App verwaltet den Sitzungsstatus und die Benutzerinformationen. Ist ein Benutzer nicht authentifiziert, leitet die Protected App ihn zur Anmeldeseite weiter. Nach erfolgreicher Authentifizierung versieht die Protected App die Anfrage des Benutzers mit Authentifizierungs- und Benutzerinformationen und leitet sie dann an den Ursprungsserver weiter.
1616

17-
Um einzuschränken, welche authentifizierten Benutzer auf eine Protected App zugreifen können, konfiguriere die [App-Ebene Zugangskontrolle](/integrate-logto/app-level-access-control) im **Regeln**-Tab der Anwendung.
17+
Um einzuschränken, welche authentifizierten Benutzer auf eine Protected App zugreifen können, konfiguriere die [App-Ebene Zugangskontrolle](/authorization/app-level-access-control) im **Regeln**-Tab der Anwendung.
1818

1919
Dieser Prozess wird im folgenden Flussdiagramm visualisiert:
2020

‎i18n/de/docusaurus-plugin-content-docs/current/integrate-logto/third-party-applications/README.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ Da OIDC auf [OAuth 2.0](https://auth.wiki/oauth-2.0) aufbaut und eine Authentifi
3535

3636
Alle erstellten Drittanbieteranwendungen werden auf der Anwendungsseite unter dem Tab „Drittanbieter-Apps“ katalogisiert. Diese Anordnung hilft dir, sie von deinen eigenen Anwendungen zu unterscheiden und alle Anwendungen an einem Ort zu verwalten.
3737

38-
Um einzuschränken, welche Benutzer sich bei einer Drittanbieteranwendung anmelden können, konfiguriere die [App-Ebene Zugangskontrolle](/integrate-logto/app-level-access-control) im Tab **Regeln** der Anwendung.
38+
Um einzuschränken, welche Benutzer sich bei einer Drittanbieteranwendung anmelden können, konfiguriere die [App-Ebene Zugangskontrolle](/authorization/app-level-access-control) im Tab **Regeln** der Anwendung.
3939

4040
## Integrationsanleitung \{#integration-guide}
4141

i18n/es/docusaurus-plugin-content-docs/current/integrate-logto/app-level-access-control.mdx renamed to i18n/es/docusaurus-plugin-content-docs/current/authorization/app-level-access-control.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
description: Restringe qué usuarios pueden iniciar sesión en una aplicación específica usando usuarios, roles, organizaciones o roles de organización.
33
sidebar_label: Control de acceso a nivel de aplicación
4-
sidebar_position: 5
4+
sidebar_position: 7
55
---
66

77
# Control de acceso a nivel de aplicación

0 commit comments

Comments
 (0)