Should we rename AzureManagedIdentityAuthorizationFilter?

[stijnmoreels]

Describe the solution you'd like
Should we rename AzureManagedIdentityAuthorizationFilter since it supports more than just Azure Managed Identity?

[tomkerkhove]

Moving conversation here - Please share your ideas @gverstraete @fgheysels @krottiers.

If we don't yet, then we can still do it going forward.

[gverstraete]

BearerTokenAuthorizationFilter?

[tomkerkhove]

So you think we should rename it? :)

[gverstraete]

So you think we should rename it? :)

yes :)

[fgheysels]

Indeed, I think we should rename it since the implementation is rather generic, but it is limited to JWT tokens, so I'd suggest JwtTokenAuthorizationFilter .

Is it even 'authorization' ? Now that I think of it, I'd say it is rather authentication ? We're just checking if the token is 'valid', not if the bearer of the token is allowed to perform action X of Y (except for: he's allowed to access the API).

[gverstraete]

I think for this component it's combining the two :) . But can I agree with the prefix JwtToken. No real preference..

[tomkerkhove]

That's fine for me!

In terms of authorization or authentication, I think authorization is best approach as it is fully based on the JWT token reader which does the magic, it now validates that it's valid but could be extended and is using IAsyncAuthorizationFilter.

If that doesn't make sense, then it can be authentication filter but might be confusing.

[fgheysels]

Authorization is fine; you can be authenticated and have a valid token, but the token might not represent the identity that we expect, and then you're authenticated bot not authorized. So, authorization is fine.

[tomkerkhove]

Thanks for the input folks!

@stijnmoreels Let's rename everything to JwtTokenAuthorizationFilter then!