10

Event-Driven Authorization

This chapter covers one of the essential topics when developing secure applications: authorization.

Authorization is checking the allowed actions for an identified person. An example of authorization in the physical world is the control over the floors and rooms that a person can access after getting into a building. It can be carried out by a person, keys or cards, or even lifts that open to authorized floors only. In short, authorization is a limitation of actions that somebody can do with a set of resources.

In this chapter, you will learn how to implement authorization control with event-oriented programming. First, we will create registrations for roles and resources, the main concepts of the Role-Based Access Control (RBAC) approach. We will associate resources with roles and roles with users for, in sequence, implementing an authorization control for employees in the Inventory module. Finally, we will create a listener to verify user...