## Authentication, Authorization, and Access Control Implementation Plan
**1. Introduction**
This document outlines the architecture and implementation plan for handling authentication, authorization, and access control within the software system. The system leverages the Amorphie Token OAuth2 Server for user identity services and implements application-specific claims, resource management, and privilege definitions for fine-grained access control.

**2. Amorphie Token (OAuth2 Server)**
**2.1 User Identity Servic**
- The Amorphie Token OAuth2 Server primarily serves as a user identity service.
- It provides authentication services and manages user sessions.

**2.2 Application-Specific Claims**
- Authorizations beyond user roles are managed within the relevant applications.
- Additional information required for application-specific claims is added to the tag field of the Amorphie client definition. (e.g., "collection.team")
- This information is also tagged under the application and retrieved via a dedicated REST API within each application.

**3. Application-Specific Access Control**

**3.1 JWT Token Management**
- Application-specific information is included in JWT tokens sent to relevant applications via headers.
- Applications do not need to perform JWT validation and analysis as this is handled by Amorphie. Applications trust the received claims and forego independent JWT validation for these claims.
- Applications can request a full JWT token from Amorphie in special scenarios.

**3.2 Resource and Privilege Definitions**
- Access operations specific to applications are managed through Amorphie Resource.
- All URLs within applications are saved as resources, with the option to group URLs if desired.
- Privileges are defined to control access to these resources, requiring specific responses (e.g., 200 for success, 401 or 403 for unauthorize) when invoked.
- Privilege definitions are written and maintained by relevant application owners.
- Example privilege definition: /collection/isinteam/{header.user_reference}/{header.collection_team}. (URL path variables indicate claim usage)

**3.3 Rule Engine Integration**
- This will provide more flexibility and scalability in managing access policies.
- [API Authorization Control Technical Document](https://hackmd.io/YVvwPYcYRsS0M5Wr0om9SA)
- [Rule engine](https://microsoft.github.io/RulesEngine/)

**4. Access Control Management**
- User access control is managed by associating resources with privileges.
- This ensures fine-grained control over user access to application features and resources.

**5. Conclusion**
The outlined architecture and implementation plan provide a robust framework for managing authentication, authorization, and access control within the software system. By leveraging Amorphie Token OAuth2 Server for user identity services and implementing application-specific claims, resource management, and privilege definitions, the system ensures secure and controlled access to application features and resources.