Is Datalog a good language for authorization?

Re:Is Datalog a good language for authorization? by aafldkjfaljkdpr on Sunday February 20, 2022 @12:44AM (#30403522)

Puzzled: why is the conversion to SQL either interesting (SQL being a logic language so if disregarding recursion[1] they should map straightforwardly[2]) or of business value?

[1] yeah, CTEs, I know

[2] yeah, words are cheap from my end, I know

Edit: additionally, and for curiosity: the article covers use of datalog but no underlying security model (eg. consistency of access to resources so you don't have one way blocked to you but can go around via another route, as I know of one homebrew system where you could do that). How do you deal with that? I understand lattices can be used for this (TBH I have only done a little reading on these).

[ Parent | on HN ]

Re:Is Datalog a good language for authorization? by lmeyerov on Sunday February 20, 2022 @04:08AM (#30404342)

- potential to push policy execution pushdown to the db, such as for authing bulk oriented queries vs record level

- potential for use with RLS

- potential for analysis tools

In practice it seems boring, but in principle, interesting. I'd love to see actual staged compilation generation & integration (so no runtime service/runtime) and, for analysis, conversion to z3/SMT. We went for Casbin bc of the former, and seems a simpler leap for the latter.

[ Parent | on HN ]

Re:Is Datalog a good language for authorization? by aafldkjfaljkdpr on Sunday February 20, 2022 @04:39AM (#30404483)

RLS?

[ Parent | on HN ]

Re:Is Datalog a good language for authorization? by radiowave on Sunday February 20, 2022 @06:11AM (#30404862)

Row-level security, I assume.

[ Parent | on HN ]