Authorization token including fine grain entitlements
A method of interpreting an authorization token is described herein. The service can receive an authorization token from a client device, and validate a signature of the authorization token. The service can identify an allowed function value associated at least part of an entitlement representation contained in a body of the authorization token. The service can convert the allowed function value to an allowed function bitmask that includes bits at a plurality of bit positions that are set to values indicating whether the subscriber element has attributes associated with each of the plurality of bit positions on a predefined attribute list. The service can determine whether the allowed function bitmask indicates that the subscriber element has one or more qualifying attributes that entitle a user of the client device to access the service.
1. A method of generating an authorization token, the method comprising:
generating an allowed function bitmask for a subscriber element, the allowed function bitmask comprising bits at a plurality of bit positions that are set to values indicating whether the subscriber element has attributes associated with each of the plurality of bit positions on a predefined attribute list;
converting the allowed function bitmask to an allowed function value;
adding the allowed function value in an entitlement representation;
adding the entitlement representation to a body of an authorization token; and
signing the authorization token.
2. The method of claim 1 , wherein the subscriber element is a user account, billing account, or subscription associated with a telecommunications provider.
3. The method of claim 1 , further comprising compressing the entitlement representation prior to adding the entitlement representation to the body of the authorization token.
4. The method of claim 1 , wherein whether the subscriber element has a particular attribute is determined based on information stored in a subscriber database.
5. The method of claim 1 , wherein the allowed function bitmask is generated by directly setting bits in the allowed function bitmask at each of the plurality of bit positions to “0” or “1” based on whether the subscriber element has a particular attribute corresponding to that bit position on the predefined attribute list.
6. The method of claim 1 , wherein the allowed function bitmask is generated by:
generating a separate binary value for each of the attributes on the predefined attribute list, the separate binary value including a leading bit set to “0” or “1” based on whether the subscriber element has the attribute, and zero or more trailing bits set to “0”; and
adding the separate binary values together to obtain the allowed function bitmask.
7. The method of claim 1 , wherein signing the authorization token comprises:
generating a signature using a cryptographic algorithm with a private key on the body and a header of the authorization token; and
adding the signature to the authorization token.
8. A method of generating an authorization token, the method comprising:
generating an allowed function bitmask used to identify allowed functions associated with subscriber elements, respectively, associated with a subscriber of a telecommunication provider, the allowed function bitmask comprising groups of bits in a plurality of bits, the groups of bits having values indicating whether telecommunication service attributes are included in the subscriber elements, respectively;
generating an entitlement representation based at least in part on the allowed function bitmask; and
adding the entitlement representation to a body of an authorization token.
9. The method of claim 8 , wherein generating the entitlement representation further comprises:
converting the allowed function bitmask to an allowed function value; and
adding the allowed function value in the entitlement representation.
10. The method of claim 8 , further comprising:
controlling access for a user to a service based on the telecommunication service attributes of the subscriber elements, respectively.
11. The method of claim 8 , wherein a subscriber element of the subscriber elements is a user account, billing account, or subscription associated with the telecommunications provider.
12. The method of claim 8 , wherein first bits of the plurality of bits in the allowed function bitmask are set to first values indicating that a subscriber entity has the telecommunication service attributes corresponding to the first bits, respectively, and
wherein second bits of the plurality of bits in the allowed function bitmask are set to second values indicating that a subscriber entity does not have the telecommunication service attributes corresponding to the second bits, respectively.
13. The method of claim 8 , further comprising:
signing the authorization token to indicate that an issuing entity generated the authorization token.
14. The method of claim 8 , further comprising:
inserting, into the authorization token, a signature generated with a cryptographic algorithm.
15. The method of claim 8 , wherein the telecommunication service attributes include a telecommunication service attribute indicating a function that a user has been permitted to perform in association with a subscriber element of the subscriber elements.
16. A server of a service, the server comprising:
one or more processors;
a communication connection; and
memory storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
generating an allowed function bitmask for a subscriber element, the allowed function bitmask comprising bits at a plurality of bit positions that are set to values indicating whether the subscriber element has attributes associated with each of the plurality of bit positions on a predefined attribute list;
converting the allowed function bitmask to an allowed function value;
adding the allowed function value in an entitlement representation;
adding the entitlement representation to a body of an authorization token; and
signing the authorization token.
17. The server of claim 16 , wherein the subscriber element is a user account, billing account, or subscription associated with a telecommunications provider.
18. The server of claim 16 , wherein whether the subscriber element has a particular attribute is determined based on information stored in a subscriber database.
19. The server of claim 16 , wherein the allowed function bitmask is generated by directly setting the bits in the allowed function bitmask at each of the plurality of bit positions to “0” or “1” based on whether the subscriber element has a particular attribute corresponding to that bit position on the predefined attribute list.
20. The server of claim 16 , wherein the allowed function bitmask is generated by:
generating a separate binary value for each of the attributes on the predefined attribute list, the separate binary value including a leading bit set to “0” or “1” based on whether the subscriber element has the attribute, and zero or more trailing bits set to “0”; and
adding the separate binary values together to obtain the allowed function bitmask.