jperezduerto.info
Security in depth · Unit 19 · Lesson 2 of 8
A connection is not an authorization
Use a layered record to distinguish a connection problem from an expected permission decision.
Helpful before thisInitial access and credentials
After this lesson you can
- Explain an observed denial using the stated application policy without mislabeling the network.
One idea. One situation. One reasoned decision.
How it works
A working transport connection means communication was established under that protocol’s rules. It does not mean the application accepted a login or permitted a particular action. Troubleshooting improves when connection establishment, encrypted transport, authentication, and authorization are reported separately. A failure in one layer should not be “fixed” by removing a necessary control at another layer.
Read the supplied record
The fictional museum supplies one request record, with clocks and request identifiers already correlated:
| Stage | Recorded result |
|---|---|
| Transport | Connection established |
| TLS | Completed with expected server identity |
| Sign-in | Staff identity accepted |
| Report access | Denied: no membership in Project Oak |
The owner-approved policy permits a staff member to read only reports belonging to their current projects. The identity has Project Elm membership and no Oak membership. Under these supplied facts, the denial is expected enforcement, not evidence of a broken network or failed authentication.
A useful support note preserves all four results and sends the membership question to Oak’s owner. Opening more network paths would not supply the missing relationship. Also keep the conclusion narrow: this is one correlated request. It does not establish that every role or report receives the right decision, or that the user’s business need should be rejected.
The key distinction: A communication path does not define resource permissions.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
What best explains the supplied denial?
Show the answer
Correct answer: The application applied the stated project-membership rule; any additional access needs the resource owner’s decision. The user authenticated but lacks the specific relationship required to read this report.
Try it
- WriteWrite a four-stage result: transport, TLS, sign-in, and record access. Identify the owner of the remaining business-access question.