openid / authzen

Proposed standard for an Authorization API
32 stars 10 forks source link

Are all sessions for access evalutions stateless? #56

Open eazerad opened 10 months ago

eazerad commented 10 months ago

PDP may want to keep a stateful session between the PEP and PDP. Rationale: you could provide further input that would be used for the PDP to make a decision; the PDP provide guidance and the PEP adds additional information in a subsequent request.

See - inference engines and stateful sessions (here it would mean that we keep the working memory between executions, calls between the PEP and PDP). If this is desired, session id would need to be provided.