3 Benefits Authorization Brings to Your Identity Strategy

Organizations today are embracing cloud native technologies to increase time to market, scalability and cost savings. A big part of the cloud native transition is moving legacy systems and architectures to the cloud.

With this comes both complexity and new risks because modern applications are often composed of dozens of microservices, housed in containers and hosted on immutable, dynamically scaling platforms like Kubernetes. Security measures and entitlements systems that worked on legacy systems no longer apply. This is especially true for identity and authorization.

Jeff Broberg

Jeff is a director of product management with more than 30 years of experience. Prior to joining Styra, Jeff was at SecureAuth, OneLogin and CA Technologies, where he was involved with their authentication and identity management solutions.

Identity and access (IAM) teams are often faced with the challenge of shepherding the transition to the cloud for many traditional identity solutions, providing integration between various internal and external systems and focusing on the authentication of users.

Authentication standards and tools, like single sign-on (SSO) multifactor authentication (MFA) and SAML were developed to address these challenges and have evolved to provide the patterns to allow a user or service to log in or authenticate to ascertain who a user claims to be.

IAM teams can use these tools and frameworks to assure with a high degree of certainty that the user authenticating is who they claim to be. Authorization, understanding and controlling what actions or resources a user or service can access, on the other hand, has not reached the same level of maturity or understanding. Application teams are still spending many hours each week maintaining and adding authorization to new and existing applications.

This authorization challenge is why Styra created the open source project Open Policy Agent (OPA) and, soon after, Styra Declarative Authorization Service (DAS).

OPA is an example of policy-as-code and is a general-purpose policy engine that decouples policy decisions from other responsibilities of an application. OPA works equally well making decisions for Kubernetes, microservices, functional application authorization and more thanks to its single unified policy language.

An example of policy — think of it as a set of rules — is perhaps what roles are required to perform actions in a system, or authorization, a type of policy that dictates who or what gets to do what in a system.

It is not surprising that the benefits and controls that organizations have been able to achieve with OPA, and policy-as-code in general, within their infrastructure (Kubernetes, Terraform, etc.) are starting to be noticed by organizations and, specifically, by the IAM teams and the legions of engineers who are tasked with implementing authorization in their applications.

Benefits of Authorization in Your Identity Solution

Applying policy-as-code into an authentication or identity solution can provide many benefits, including:

• Leverage existing data sources (LDAP, AAD, SCIM, etc.) to make use of your existing investment in IAM. When that rich context is coupled with declarative policy, you can replicate this at scale to as many clouds, continents, regions, availability zones as you need. Additionally, you will be able to understand the impact of a policy or data change long before you deploy it, which will help with down time, testing, etc.
• Having centralized policy authoring, data management and decision logs, without sacrificing physically distributed enforcement can certainly be a time saver when it comes to making sure you can indeed run at scale.
• The availability to run an instance of the entitlements service (IAM + authorization) as close to the applications that need them as you like. Plus, distributed policies/data that are kept up to date offers an alternative to a single-point-of-failure on-premises solution and can mean the difference between a fully functional application and a broken one.

While there are several more benefits to making the perfect couple of authentication and authorization work together, the easiest way to do so is to extend existing systems of record for IAM, associate declarative policy and enforce authorization decisions across all of your deployment models. This allows you to answer the simple question, “Who can access what under which context?”

But, until recently, there hasn’t been an easy path for IAM teams to either modernize an existing authorization solution, using industry best practices, or to create from the ground up with a new solution based on industry standards and policy libraries.

As the founders and maintainers of Open Policy Agent (OPA), Styra enables enterprises to define, enforce and monitor policy across their cloud native environments. Styra provides security, operations and compliance guardrails to protect applications and the infrastructure they run on.

Learn More

The latest from Styra

Styra Declarative Authorization Service (DAS) for Cloud Native Entitlements can be brought in to fill the need of organizations where they need a broader set of controls. The understanding is that these controls will trickle down to other areas of the system or organization. For example, using an identity vendor plus Styra DAS gives an organization the ability to extend authorization environments to incorporate different types of data sources from different systems.

The organization can then take that information and use it in different areas they need to control, not just an app (like infrastructure).

Jeff is a director of product management with more than 30 years of experience. Prior to joining Styra, Jeff was at SecureAuth, OneLogin and CA Technologies, where he was involved with their authentication and identity management solutions.

Read more from Jeff Broberg