The difference between roles and claims

Question

In our system, we have a way to configure users with permissions. They create a group name, such as Admin, and then assign all permissions to the tasks that they would like to do.

For example, they can add AddCompany, ViewCompany, DeleteCompany, EditCompany

This makes it easy to create different permission groups, and we can easily control security.

As I understand it, in this case the group name = Role and each permission is a complaint?

Answer 1

Role-based authorization is used to group users into groups (roles), and then to set rights to a role, and not for individual users.

For example: in your case, you can create an administrator role and provide permission to perform the tasks "AddCompany, ViewCompany, DeleteCompany, EditCompany".

In this case, it’s easier to manage a large set of users with a small set of roles. This is the most commonly used authentication model.

Claim-based authorization provides additional levels of abstraction in your authorization strategy. In addition, claims are a way of providing information about a user, not a group of users. You create authorization policies that are used to create a set of requirements based on the authentication evidence provided by the user. The user then claims the application to gain access to resources.

An application is a statement that one subject makes about himself or another subject. A statement may be about a name, identifier, key, group, privilege or opportunity, for example. Claims are issued by the provider and are assigned one or more values ​​and then packaged in security tokens issued by the issuer, commonly called the security token service (STS)

Resources: http://msdn.microsoft.com/en-gb/library/ff649821.aspx

http://msdn.microsoft.com/en-gb/library/ff649821.aspx

http://msdn.microsoft.com/en-gb/library/ff359101.aspx

Hope this helps.

Answer 2

Roles are claims, but not all claims are roles.

In a claims-based authorization system, you can use roles as permissions, but you can use more. In my current project, we have many different mappings from roles to permissions.