For example there is a simple CRUD record management application. Let for simplicity the records are some documents.
I need to implement a mandatory access control to the records. For example if some record is marked as confidential, then only users with a confidential access level can work with this record. Sounds trivial :)
The problem is that I don't want to certificate the application, and I need to move authorization function to some external system. If it's a desktop application then the user can be authenticated using his credentials, and then these credentials are used to access a database. So the authorization is implemented on the database level. I don't need to certificate my application.
But my application is a web one. The app backend connects to the database using a single system user. So the authorization is implemented on the backend level and I have to certificate it.
Everything is complicated even more by the fact that the backend uses GraphQL API. If it would be a REST API, then I could place some security proxy between frontend and backend filtering REST API requests, and certificate this proxy only. But it's a GraphQL.
The only solution I see is to create two separate web-applications: 1) with access to public information 2) with access to public and confidential information. For both applications the single database is used with two tables: public_records and confidential_records. 1st application is connected to the database using a system user with access to public_records. 2nd application is connected to the database using a system user with access to both tables.
Maybe you could suggest a better solution?
