Mastering Authorization - Integrating Authentication and Authorization Data in Cloud Native Apps

Learn to master authorization in cloud-native applications by exploring the integration of authentication and authorization data through this 33-minute conference talk from CNCF. Discover how authorization has become one of the most critical considerations for cloud-native applications, as emphasized by the OWASP Top 10, and understand the historical challenges implementers have faced due to the lack of clear standards. Explore the OpenID Foundation AuthZEN Working Group's efforts to establish standards, particularly focusing on interfaces between Policy Enforcement Points (PEP) and Policy Decision Points (PDP). Examine the ongoing challenges in managing authorization data and its close relationship with authentication data, including the architectural decisions around how OpenID Providers (OP) and PDPs should manage and integrate this data. Analyze multiple methods for managing and integrating authentication and authorization data, understanding how the best approach varies depending on specific use cases. Gain practical insights through implementation examples using Keycloak as the OpenID Provider and Topaz as the Policy Decision Point, providing concrete guidance for effective data management in real-world scenarios.