[id='con_authz-{context}']
= How Security Authorization Works
{brandname} authorization secures your installation by restricting user access.

User applications or clients must belong to a role that is assigned with sufficient permissions before they can perform operations on Cache Managers or caches.

For example, you configure authorization on a specific cache instance so that invoking `Cache.get()` requires an identity to be assigned a role with read permission while `Cache.put()` requires a role with write permission.

In this scenario, if a user application or client with the `io` role attempts to write an entry, {brandname} denies the request and throws a security exception.
If a user application or client with the `writer` role sends a write request, {brandname} validates authorization and issues a token for subsequent operations.

.Identities

Identities are security Principals of type `java.security.Principal`.
Subjects, implemented with the `javax.security.auth.Subject` class, represent a group of security Principals.
In other words, a Subject represents a user and all groups to which it belongs.

.Identities to roles

{brandname} uses role mappers so that security principals correspond to roles,
which you assign one or more permissions.

The following image illustrates how security principals correspond to roles:

image::SecurityRolesPermissions.svg[Roles/Permissions mapping]
