3 ms·
wow that's a great idea, I hadn't thought of that! I guess that's just another benefit of dissociating the identity (Identity) from the login (User).
by choxi 15y ago
wow that's a great idea, I hadn't thought of that! I guess that's just another benefit of dissociating the identity (Identity) from the login (User).
- ch 15y agoThis is typically why you separate authentication and authorization. In your case many authenticated users can be authorized to access a single identity.
- roel_v 15y agoHow would you divide the two? I'd say that 'identity' and 'user' are the same, that the things you'd want to dissociate are the ('roles' | 'permission set' | 'authorization rules') from the ('identity' | 'user' | 'login'). But in that case, it wouldn't help with anonymous sessions - unless you'd just define those as new 'identities' with many of the properties set to unknown. I think the pattern is interesting enough to flesh out, but I'm not convinced yet if it's a real change from the traditional user/permission duality that is already in wide use.