Comment by Xingheng Wang on "Role Based Access Control/ACL via REST API?"

CommentRole Based Access Control/ACL via REST API?

Xingheng Wang

Co-founder Moesif.com (API analytics). Previous Microsoft & Zynga. CS from MIT.

Apr 3, 2018

Try JWT. The roles and permission is in the token itself.

Or if you want to more traditional way to look up permission in a database, be sure to think through the performance issues:

Here is a pro and cons of different approaches:

moesif.com/blog/technical/restful-apis/Authorizat…

Rafael Rozon

Developer

Apr 6, 2018

Thank you Xingheng Wang for your answer. What I'm looking for is more about managing users permission through a rest api, because I don't want to build it myself. Ideally, I'd like some endpoints that would allow me to create a permission group, add permissions to the group, create a user group, associate user groups with permission groups, and then users to user groups. Nothing crazy complicated. Then, having that information, I could use JWT to pass it around.

Xingheng Wang

Co-founder Moesif.com (API analytics). Previous Microsoft & Zynga. CS from MIT.

Apr 6, 2018

Ah, unless you want to manage your own servers for this, it might probably have to use one of the SASS services. Unfortunately, they aren't free. They usually have free plans lower than certain # of users per months, but no technical support.

These are the most popular ones:

also check out this.

keycloak.org

We are using Auth0. There are pro and cons with Auth0, it isn't issue free. I haven't uses others in depth to give a deep comparison, or to know we would or would not encounter similar issues. They definitely support all the features you named.

Search Hashnode