Engineering Authorization

After a user has found the service that they want to access in the directory and authenticated to it, the service will have to validate their access and decide what features the user is allowed to use and what data they may access within the service. This is called authorization. In Active Directory-based applications, authorization is mostly performed using group memberships: when a ticket is issued to a principal, the SIDs of the groups it is a member in, including nested (transitive) memberships, are added to the ticket along with the user’s own SID. The application performing authorization will evaluate permissions assigned to each SID and produce an authorization verdict.