Token Enrichment Authorization Pattern

With the Token Enrichment Authorization Pattern, Thales Authorizers dynamically enrich user authorizations by calculating custom entitlements or claims based on policies, which are then served to consuming services.

IDP Authorizers help you seamlessly integrate your existing IDP systems with the Platform's dynamic Authorization calculation. This integration enables you to define fine-grained Authorization Policies, enforce access rules, and manage user privileges across your entire IDP ecosystem by enriching user claims during the user's authentication journey.

The IDP Authorizer integrates the IDP authentication flow with the Thales Token Enrichment Service, establishing a connection and initiating a request for Policy-based, real-time calculated user claims by Thales’s PDP, which are then included in the user’s token during generation by the IDP.

This process allows applications and services that rely on user token claims for access management to seamlessly benefit from the dynamic enrichment of claims provided by Thales during the authentication flow.

Use-case Example

Explanation

1. User Authenticates to the IDP.

2. IDP calls out to Thales to request which claims the user is authorized to have.

3. Thales real time calculated claims added by the IDP and enriches the user token.

4. IDP signs the JWT and it is provided to the application.

An additional enrichment flow supported by other Thales Authorizers can leverage Thales' dynamic authorization capabilities. These authorizers calculate entitlements based on policies to enrich service API requests, which are then used by customer services during internal authorization enforcement.

How Token Enrichment Works

1. User Authenticates to the IDP

2. IDP calls out to Thales and request which claims and claims values the user is authorized to have.

3. Claims are added to the JWT

4. JWT is signed and provided to the Application.

Token Enrichment Authorizers

Thales offers the following Token Enrichment Authorizers:

• Okta

• Auth0

• Entra ID

• Ping