Authorisation
Auth
AvailableAnswers “may user X do Y” over HTTP.
Over HTTP, Auth tells a service whether user X may do Y. It handles authorisation only and relies on the caller to know who the user is. It does not sign anyone in, store passwords, issue tokens or manage sessions. The model has users, roles and permissions, and a user holds a permission exactly when one of their roles holds it.
Who it is for. Services that need role-based access control and do not want to maintain their own roles and permissions tables.
- Status
- Available
- Part of
- Core platform
- Product site
- auth.rodmena.app
- Tags
- Access controlRoles and permissionsOne decision
What it does
-
One question
The API has one question to answer, “may user X do Y”, and it answers it consistently for all services.
-
Users, roles, permissions
Users get a role's permissions through membership of that role, and there is nothing more to model.
-
Authorisation only
Passwords, sessions and tokens are out of scope and belong to RODMENA ID.
-
Quick to adopt
Because a check is one call with one answer in a fixed response shape, a service can be brought under central access control in an afternoon.
Documentation and access details are on the product site, auth.rodmena.app. For a pilot, an integration or procurement questions, contact us.