Very much agree that authorization is a more domain-specific problem than authentication... but there are some common patterns that are emerging, and can help reduce how much wheel reinvention has to happen.
There are (at least) three of us startups on this thread that are trying to tackle this :) (disclaimer - I'm a co-founder of one of these - Aserto).
Re:Authorization in a Microservices World
by geoduck14 on Saturday April 02, 2022 @12:23AM
(#30885824)
Do you have anything for Authorization for date withing DataBricks?
maybe soon there'll be 4 ;)
Well, I potentially have some good news for you :)
There are a bunch of companies who popped up in the last few years to solve this problem. We're one of them -- Oso (I'm the CTO).
It's definitely a fun/challenging problem to work on. So if building a generalized authz SaaS is the dream, come join us!
Just a heads up, looks like markdown formatting got into your "go get" command for the golang page.
The more I come across different systems, the more I realize authorization in large distributed systems isn't ever one approach: it has to be tailored for each use case with different tradeoffs in mind. It's often directly coupled to the problem domain you're trying to solve for. It has to be integrated with the data access pathways, _and_ also has to be tailored to the authentication system it deals with, _and_ it has to be tailored for the data-locality model of the overall system.
The more authorization problems I solve, the more I realize that my dream of coming up with a generalized authz SaaS service that helps me grease out VC money & a billion dollars probably doesn't really exist. It's different from authentication, because authentication has less dimensions of coupling, and less tradeoffs (Auth0 sold for 6b, Okta worth 18b, both authentication offerings)
Maybe I'll figure it out one day. Or maybe this is one of those problem domains that is only solved by an army of engineers