3 ms·
The problem is that you hope this doesn't encourage the developers to lapse on RBAC and let an authenticated client do everything.
by judge2020 4y ago
The problem is that you hope this doesn't encourage the developers to lapse on RBAC and let an authenticated client do everything.
- gz5 4y agoabsolutely. in the case of openziti, the x.509 is the first authentication gate (optionally paired with ziti posture checks and mfa). everything from there is least privileged, attribute-based access, at a service level. default is closed - access to no services (even if authenticated at the level of the private ziti network fabric overlay).