Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ory Keto, open source authorization server based on Google Zanzibar

github.com

Post reply on HN
Print view View original

11–20 of 70 posts

Re: Ory Keto, open source authorization server based on Google Zanzibar

#11

Post by mooreds »

If you are interested in seeing what this software package can do, as I was, you might want to check out the quickstart example: https://www.ory.sh/keto/docs/quickstart

and an example: https://www.ory.sh/keto/docs/examples/olymp-file-sharing

as well as the concepts section: https://www.ory.sh/keto/docs/concepts/relation-tuples

as well as their implemented and planned features: https://www.ory.sh/keto/docs/implemented-planned-features

Re: Ory Keto, open source authorization server based on Google Zanzibar

#12

Post by neupatr »

robertlagrant wrote: post #10
neupatr wrote: post #2

Hello! I am one of the maintainers of Ory Keto. We spent a lot of time and effort to read, learn, and analyse the Google Zanzibar paper ( https://research.google/pubs/pub48190/ ) and the release brings that all together. There are still many things missing, but with a great community we hope to build the “Kubernetes” of permissions and access control! If you have any questions, I am here to help

Fantastic news - a great achievement.

Thank you ;)

Re: Ory Keto, open source authorization server based on Google Zanzibar

#14

Post by Scandiravian »

mumblemumble wrote: post #9
markild wrote: post #7

Earlier quoted context omitted.

Just be more specific, like "java bean"... oh. Joking aside, I dislike stuff that reuses overly generic concepts and names. I get why it was chosen, it's sorta cute, and it fits the theme, but it would be very nice if it was a uniquely named concept.

I think that that strategy is roughly how drugs all end up with such odd names.

I have friends who's job it is to come up with names for new drugs. It's actually a difficult task, since it needs to be easy to remember, create a slightly positive or neutral association with consumers, and most importantly, not be even close to a dirty/offensive word in any language used in a major market

It does result in some super silly names. So much so, that when I studied pharmaceutical sciences, we made a drinking game called "Pokémon or Drug"

Re: Ory Keto, open source authorization server based on Google Zanzibar

#15

Post by neupatr »

wiradikusuma wrote: post #13

So this is like https://www.keycloak.org but without Java?

Keto only does authorization, independent of users, devices, bots, applications, ... Basically you store your ACLs there and then ask "is _subject_ allowed to do _relation_ on _object_". All the variables are whatever you define them to be.

Check out https://github.com/ory/kratos, our identity server. Or https://github.com/ory/hydra, our OAuth2 server. All of them together can be assembled to have something like Keycloak.

Re: Ory Keto, open source authorization server based on Google Zanzibar

#17

Post by neupatr »

indiv0 wrote: post #16

How does this differ from OpenPolicyAgent?

OPA takes a whole different approach. They basically have a specific language and a corresponding interpreter. The previous version of Keto was based off of OPA. We discovered that it is not suitable for our needs and what we want to offer because it can be very hard to meet certain performance goals (e.g. https://github.com/ory/keto/issues/104)

Taking this simple approach allows us to provide a global, low latency, and consistent authorization system.

Re: Ory Keto, open source authorization server based on Google Zanzibar

#19

Post by jzelinskie »

neupatr wrote: post #2

Hello! I am one of the maintainers of Ory Keto. We spent a lot of time and effort to read, learn, and analyse the Google Zanzibar paper ( https://research.google/pubs/pub48190/ ) and the release brings that all together. There are still many things missing, but with a great community we hope to build the “Kubernetes” of permissions and access control! If you have any questions, I am here to help

This is awesome!

Full Disclosure: I'm a YC W21 founder that's built authzed, which is effectively Zanzibar as a Service, but anything that gets mindshare towards using ACL services is huge.

How close do ya'll plan to follow the paper? At a glance, I noticed a few of differences.

It'd be amazing if we had API compatibility across our products.

Re: Ory Keto, open source authorization server based on Google Zanzibar

#20

Post by sroze »

neupatr wrote: post #2

Hello! I am one of the maintainers of Ory Keto. We spent a lot of time and effort to read, learn, and analyse the Google Zanzibar paper ( https://research.google/pubs/pub48190/ ) and the release brings that all together. There are still many things missing, but with a great community we hope to build the “Kubernetes” of permissions and access control! If you have any questions, I am here to help

Amazing, I was going to start such endeavour, Zanzibar is to me that best of the ACL system that I know of, from a theoretical flexibility perspective. However, I was thinking of taking the principles but actually represent the triples as RDF and use SparQL to represent policies, to use the power of graph engines rather than building my own triple store & query engine. Any reason you went for SQL storage and a custom query engine/language on top?
Post reply on HN