AuthZEN
OpenID AuthZEN (Authorization API 1.0) defines a standard API for authorization decisions. A Policy Enforcement Point (PEP) asks a Policy Decision Point (PDP) whether a subject can perform an action on a resource.
ThunderID supports AuthZEN as both a policy decision point and a policy enforcement point. As a PDP, ThunderID evaluates requests from a gateway, adapter, service, or application and returns an allow or deny decision. As a PEP, ThunderID sends authorization evaluations to a configured AuthZEN PDP and enforces the returned decision in its authorization flow.
Use AuthZEN when the authorization decision needs more than token validation or static scope checks. For example, use AuthZEN when an API gateway must ask ThunderID for a request-time decision before it forwards a request to an upstream API.
AuthZEN Roles
| Role | Description | ThunderID Support |
|---|---|---|
| Policy Decision Point (PDP) | Evaluates access requests and returns allow or deny decisions. | Supported. See Policy Decision Point. |
| Policy Enforcement Point (PEP) | Enforces the PDP decision before the protected operation continues. | Supported. See Policy Enforcement Point. |
How the AuthZEN Flow Works
- A client sends a request for a protected resource through the PEP.
- The PEP identifies the subject, resource, and action and collects any request context.
- The PEP sends an AuthZEN access evaluation request to the PDP.
- The PDP evaluates its authorization policies and returns
decision: trueordecision: false. The response can also include context about the decision. - When the decision is
false, the PEP denies access without forwarding the request to the protected resource. - When the decision is
true, the PEP forwards the request and returns the protected resource response to the client.
For the supported PDP endpoints, request and response examples, and configuration links, see Policy Decision Point.
To configure ThunderID to enforce decisions from a configured AuthZEN PDP, see Policy Enforcement Point.
Related Guides
- Policy Decision Point: call ThunderID as an AuthZEN PDP.
- Policy Enforcement Point: use ThunderID as an AuthZEN PEP with a configured AuthZEN PDP.
- Resource Servers: define protected APIs, resources, and actions.
- Roles: assign permissions to users, groups, applications, and agents.
- Envoy: configure Envoy to call ThunderID as an AuthZEN PDP.
