As engineers and managers in the IAM space, you know that while identity is a critical aspect of security, authorization is the next natural step in ensuring robust protection for your applications. Identity secures the front door of the application by confirming that the user is who they claim to be. Authorization kicks in once the user is authenticated and determines what that user can do in the application.

However, despite the strides made in identity protocols and standards, authorization remains a challenge. Unlike identity, which has established protocols and APIs, authorization lacks standardization. Multiple policy languages, engines, authorization models and vendor-specific APIs complicate the landscape further. As a result, every application is forced to build its own permissions.

Addressing this challenge is paramount for the IAM industry, and progress is being made. Aserto is proud to be part of a collective effort among authorization vendors and implementers, including industry leaders like AWS, Axiomatics, Disney, and Sailpoint, to establish authorization standards. This recent initiative is being spearheaded by the OpenID Foundation's AuthZEN working group.

Similar to how identity standards, such as SAML and OpenID Connect, facilitated "SSO for the web," authorization standards promise to streamline adoption, enhance reusability, and mitigate risks for organizations embracing innovation in this space. We’re excited to spread the word and meet the community in this year’s leading identity conferences!

Internet Identity Workshop #38 (IIW 2024)

Join us in Mountain View from April 16 to 18, for the Internet Identity Workshop!

IIW has been at the forefront of identity discussions for nearly 20 years. Its un-conference format fosters natural conversations, networking, and collaborative learning.

The authorization community is planning an authorization get together at the event. Learn about the progress the AuthZEN group is making in drafting authorization protocols and interoperability standards, and get insights into cloud-native access controls.

Identiverse 2024

Aserto is a proud sponsor of Identiverse 2024, in Las Vegas from May 28 to 31!

Identiverse is where the identity security community comes together. This is the 15th year of CyberRisk Alliance's must attend annual event.

Join us at booth 1321 to discuss your authorization challenges and explore how we can help with your project.

Book a time with the team here.

European Identity & Cloud (EIC) Conference

EIC is the leading conference on Digital ID, Security, Privacy and Governance in Europe.

Catch Aserto CEO, Omri Gazitt, at EIC 2024 in Berlin from June 4 to 7.

Omri will be speaking on a panel of authorization experts and AuthZEN members on June 5th about the current state of modern authorization and the latest advancements.

Join the OpenID AuthZEN: Standards for Authorization panel, or book time with Omri at EIC

Authorize Conference

The authorization community is planning an authorization-focused conference in Seattle later this year.

Join us as we dive deep into the intricacies of modern authorization, relevant use-cases, and current and future initiatives at standardization. We’re in the early stages of planning the conference, so stay tuned!

Conclusion

Authorization presents significant challenges, but with collaboration and innovation, we can overcome them. Aserto is committed to supporting developers on the journey to implement secure, granular permissions for their applications.

Our open-source authorizer, Topaz, is a great introduction to the world of fine-grained authorization. It’s the best of the two leading approaches to modern authorization, allowing you to combine attributes with relationships to authorize your applications. And it comes with templates based on a few well-known examples of fine-grained authorization: Google Drive, Slack, and GitHub.

This post covers the 2024 industry events where you can engage with the authorization community and meet the Aserto team. We hope to see you at one or all of these events. You can also always drop us a line or join our community Slack to discuss your authorization challenges. We’re here to help!