Externalization of Authorization

The previous chapter was about business rules management in general. In this chapter, we will analyze a particular case of authorization management, since the rights and privileges of users are one of the most common uses of business rules that you can find in many applications. Since there exist two standards for authorization management (as already explored in Chapter 8) we will quickly explain the first and more complete standard, namely XACML (short for, eXtensible Access Control Markup Language) because it helps understand how it relates to the Single Responsibility Principle (SRP); then, we will create a more complete example with the new, lighter, standard, which is OPA (short for, Open Policy Agent).

We will then end this chapter (and the series of four chapters on the different parts of an ideal information system) by reflecting on how to implement this authorization in practice, which will open the way to the analysis and the implementation...