[Doc] Update the authorization documentation

[jannyHou]

Description

Since we have released the @loopback/authorization module, the authorization component page should be updated accordingly.

Acceptance Criteria

• Explain the terms/concepts in LoopBack authorization system, like authorizer, voter, etc...

• Update the authorization component page according to the new released @loopback/authorization

• Document how to use the authorization module

• Clean up the README.md file in @loopback/authorization if any content(design/usage/etc....) should be moved to the doc.

[totolef]

Would be super nice ! Thanks

[jannyHou]

cc @emonddr an outline of what we can include in the authorization documentation page:

Authorization decides if a subject can perform specific action on an object.

@loopback/authorization is built upon @loopback/authentication to verify whether a principal(user, device, or application) has access a request’s corresponding resource.

@loopback/authentication resolves the identity of principal(currently we only consider user as the principal) from the request, then passes it to @loopback/authorization. @loopback/authorization reads the endpoint’s accessibility metadata, like scope and resource name, then execute specified authorizers to decide if the identity has access to that particular protected resource, returns or rejects accordingly.

Concepts to explain:

Authorizer/Voter: Decide whether a principal can perform specific action on an object.

Authorize Interceptor: Reads metadata of the controller method, then invoke authorizer/voters with the metadata to make decision.

Principal: The identity of user/device/application.

AuthorizationMetadata: The metadata describes the resource and its accessibility.

Authorize Decorator: Annotate controller methods with authorization metadata.

[frbuceta]

Can someone help me to implement in the sequence? I am not able with the current documentation

[jannyHou]

@frbuceta Team is still working on the documentation. It's promising to be ready in next week. I will update the link here then :)

[frbuceta]

@frbuceta Team is still working on the documentation. It's promising to be ready in next week. I will update the link here then :)

Ok I subscribe to the issue

[deepakrkris]

PR merged, closing issue.