An authorization server issues tokens that carry authorization information for access to a platform. In an OpenID Connect (OIDC) setup, it must be configurable to obtain permissions from the platform’s authorization-data source and include relevant claims after a successful login. The identity provider can act as a go-between rather than becoming the source of truth for those permissions. section 4.3.3
Authentication establishes who a user is; authorization determines what that user can do. Some decisions still require a check at the time of use, but principal permissions can also travel in issued tokens. Keeping these roles distinct matters when platform customer identity and cloud infrastructure identity need different treatment. section 4.3.3
Team-based access to a platform control plane
Suppose GitHub organization teams are the authoritative source of authorization information. A user authenticates through an identity provider, which obtains their team memberships and returns a secure means of accessing Kubernetes resources or custom platform APIs. Access can then be based on team membership. A SaaS identity provider is useful only if it supports that integration; otherwise, the platform may need to deploy and manage an authorization server. Auth0 is one SaaS option considered for this setup, while Keycloak and Dex are alternatives engineering teams may choose. section 7.3.1
Figure 7.8 For Epetech, we would like our IDP service to have built-in or easily configurable means of integrating with GitHub, requiring authentication through whatever means we have set up in GitHub. As a result of (1) successful authentication, we want the IDP to (2) get the list of all teams the user is a member of in our GitHub organization. Finally, we want to (3) return to the user a secure means of accessing the platform infrastructure or custom API resources.
The diagram traces the desired sequence: authenticate through GitHub, retrieve organization-team memberships, and return a secure means of accessing platform resources. section 7.3.1
Choose an authorization-server integration that can automate authorization configuration. Requiring developers to request roles by ticket and wait for a human to add them creates recurring friction, even when the tool satisfies a security or governance need. section 4.3.3
