Re:Zanzibar: Google’s Consistent, Global Authorization Syste...
by znpy on Thursday April 29, 2021 @11:28AM
(#26982412)
Is it my impression or nowadays the emerging technology in this sense is OPA (Open Policy Agent)?
It looks like a flexible system to build cross-language and cross-framework authorization systems.
Re:Zanzibar: Google’s Consistent, Global Authorization Syste...
by etxm on Thursday April 29, 2021 @12:22PM
(#26983114)
I use OPA with terraform and kubernetes, but I’m looking for something for application ACLs, where I as a resource owner can assign permissions to arbitrary subjects for a resource.
Does OPA support that? If so that would be very very cool.
Re:Zanzibar: Google’s Consistent, Global Authorization Syste...
by andyroid on Thursday April 29, 2021 @01:48PM
(#26984187)
Certainly! Application and microservice authorization is probably one of the more common use cases for OPA, and there's definitely benefits in having a unified policy engine in an organization or company.
Re:Zanzibar: Google’s Consistent, Global Authorization Syste...
by etxm on Friday April 30, 2021 @11:19AM
(#26994551)
I have only found RBAC and ABAC docs and tutorials for OPA, do you happen to know of a good source of docs for ACLs like, User A gives User B edit rights on Resource C?
Update: I swear I’ve looked through the docs 20 times and I’ve never seen this use case, but of course after writing this comment I go back and immediately find what may work :-)
https://www.openpolicyagent.org/docs/latest/comparison-to-ot...
Re:Zanzibar: Google’s Consistent, Global Authorization Syste...
by rad_gruchalski on Thursday April 29, 2021 @12:32PM
(#26983241)
I think Ory Keto would be a better choice because it's easier to manage individual resources on an ad-hoc basis.
https://casbin.org/