How to implement role-based Authorization for Python REST API?

Question

The basic architecture of my application is React front-end consuming a RESTful API sitting on top of a polyglot storage layer.

Front-end:
React consuming APIs

Back-end:
Python
Flask

Authentication
Auth0+OKTA

Everything is working great. However, I need to have different roles for the users. In other words, I need to control the actions that a user can perform on a resource based on the role.

Example:
-User A wants to add a new user
-He has a token in his request, so I know User A is Authenticated
-Now I need to make sure he can in fact add users base on his role.

I don't want to hard-code the user roles as suggested in other solutions, and I would like to allow for custom roles to be added.

Also, I want to be respectful of people's time, so if there is a resource that addresses my concern, please feel free to point me to it.

These are my questions:
1. Are there any best practices for implementing what I am trying to accomplish?
2. Could you point me to examples or tutorials discussing authorization(not authentication)?
3. Do I check at each service call if the authenticated user can also perform the action or do I provide the roles in some form after authorization, so a service request contains both the authentication and authorization token?(this seems pretty easy to hack so I am guessing no...)

If I sound confused on the topic of authorization, it is because I am. Please feel free to point me to any resource that have been helpful to you.

Thank you in advance for taking the time to help! I really appreciate it.

Answer 1

You can use a framework like Yosai that is based on Apache Shiro.

These are some features:

• Enables Role-Based Access Control policies through permission-level and role-level access control
• Two-Factor Authentication, featuring Time-based One-Time Passwords
• Native Support for Caching and Serialization
• Event-driven Processing
• Ready for Web Integration