Understanding the concepts of access control [The Confused Developer]
Channel: OktaDev
Date: 2023-01-13

Permissions, privileges, and scopes in the context of authorization, access control, and delegated authorization - what's the difference? Understanding the basics will help you better communicate a system's needs, and design solutions that minimize bad surprises. 

Access control is a complex thing. It involves users, resources, and applications, and you have to set it up properly to prevent bad surprises. However, setting up access control is not just a matter of writing code or configuring a system. It includes (or better, it relies on) understanding a few basic concepts. Things can get even more complicated when delegated authorization comes into the picture, such as when using OAuth. In this video Ben breaks down the differences between permissions, privileges, and scopes and details their relationship to one another. 

Read the accompanying blog post to this video, which includes an illustration that summarizes the content: https://auth0.com/blog/permissions-privileges-and-scopes 

Read the article on the nature of scopes: https://auth0.com/blog/on-the-nature-of-oauth2-scopes/ 

Chapters:
0:00 Welcome
00:23 Overview
01:03 What is Access Control?
01:41 What are Permissions?
02:54 What are Privileges?
03:53 An analogy of Access Control
04:49 An analogy of Delegated Authorization
05:50 How these analogies align to computer systems
06:45 How Scopes make Delegated Authorization possible
09:36 Common Myth 1: Scopes are not Privileges
10:54 Common Myth 2: Permissions and Scopes have a natural mapping
11:39 Common Myth 3: Privileges and Scopes have a natural mapping
12:27 Summary

___________________________________________
Learn with Auth0 by Okta
Try for free - https://a0.to/auth0
The Auth0 by Okta blog - https://a0.to/blog
Ask questions on the Community Forum - https://a0.to/community ___________________________________________ 
Follow Us on Social 
Twitter - https://twitter.com/oktadev
LinkedIn - https://www.linkedin.com/company/oktadev