Taken from Redwoodjs Role Based Access Control
Authentication is the act of validating that users are who they claim to be. Authorization is the process of giving the user permission to access a specific resource or function.
In even more simpler terms authentication is the process of verifying oneself, while authorization is the process of verifying what you have access to.
When thinking about security, it helps to think in terms of familiar examples.
Let's consider one from the physical world -- access to the various rooms of a 🏠 house -- and compare it to a digital example of a Blog.
Consider a 🏠 while you are away on vacation.
You are the owner and have given out 🔑 keys to your neighbor and a plumber that unlock the 🏠 🚪 door.
You've assigned them passcodes to turn off the 🚨 alarm that identifies them as either a neighbor or plumber.
Your neighbor can enter the kitchen to get food to feed your 😸 and the your office to water your 🌵 and also use the 🚽.
The plumber can access the basement to get at the pipes, use the 🚽, access the laundry or 🍴 kitchen to fix the sink, but not your office.
Neither of them should be allowed into your 🛏 bedroom.
The owner knows who they claim to be and has given them keys.
The passcodes inform what access they have because it says if they are a neighbor or plumber.
If your 🏠 could enforce RBAC, it needs to know the rules.
| Role | Kitchen | Basement | Office | Bathroom | Laundry | Bedroom |
|---|---|---|---|---|---|---|
| Neighbor | ✅ | ✅ | ✅ | |||
| Plumber | ✅ | ✅ | ✅ | ✅ | ||
| Owner | ✅ | ✅ | ✅ | ✅ | ✅ |
In our Blog example anyone can view Posts (authenticated or not). They are public.
- Authors can write new Posts.
- Editors can update them.
- Publishers can write, review, edit and delete Posts.
- And admins can do it all (and more).
| Role | View | New | Edit | Delete | Manage Users |
|---|---|---|---|---|---|
| Author | ✅ | ✅ | |||
| Editor | ✅ | ✅ | |||
| Publisher | ✅ | ✅ | ✅ | ✅ | |
| Admin | ✅ | ✅ | ✅ | ✅ | ✅ |