Not related to Ory: I don't know why the name of the Google's service is Zanzibar but if that's related to Zanzibar Island which was once a slave route, I don't feel good about it. I'd love to be enlightened on this part. You can call it my curiosity to know.
Ory Keto, open source authorization server based on Google Zanzibar
21–30 of 70 posts
Re: Ory Keto, open source authorization server based on Google Zanzibar
#22I went diving into the docs to find out how Keto implements Zanzibar's consistency guarantees, which for Zanzibar are provided mostly by Spanner, but it seems that Keto just does not[1]. This does not strike me as the kind of thing that can just be added after the project begins.
https://github.com/ory/keto/blob/master/docs/docs/concepts/s...
Re: Ory Keto, open source authorization server based on Google Zanzibar
#23Not related to Ory: I don't know why the name of the Google's service is Zanzibar but if that's related to Zanzibar Island which was once a slave route, I don't feel good about it. I'd love to be enlightened on this part. You can call it my curiosity to know.
[deleted]
Re: Ory Keto, open source authorization server based on Google Zanzibar
#24So this is like https://www.keycloak.org but without Java?
Keto only does authorization, independent of users, devices, bots, applications, ... Basically you store your ACLs there and then ask "is _subject_ allowed to do _relation_ on _object_". All the variables are whatever you define them to be. Check out https://github.com/ory/kratos , our identity server. Or https://github.com/ory/hydra , our OAuth2 server. All of them together can be assembled to have something like Ke…
Kratos can manage users and groups right? Looks like it requires a database backend today. I have been noodling what a distributed AAA service like kratos might look like--any plans to leverage etcd instead?
What about managing auth for (Linux) servers? PAM, sudo, etc?
Re: Ory Keto, open source authorization server based on Google Zanzibar
#25Not related to Ory: I don't know why the name of the Google's service is Zanzibar but if that's related to Zanzibar Island which was once a slave route, I don't feel good about it. I'd love to be enlightened on this part. You can call it my curiosity to know.
virtue signaling is boring
Re: Ory Keto, open source authorization server based on Google Zanzibar
#26Hello! I am one of the maintainers of Ory Keto. We spent a lot of time and effort to read, learn, and analyse the Google Zanzibar paper ( https://research.google/pubs/pub48190/ ) and the release brings that all together. There are still many things missing, but with a great community we hope to build the “Kubernetes” of permissions and access control! If you have any questions, I am here to help
Amazing, I was going to start such endeavour, Zanzibar is to me that best of the ACL system that I know of, from a theoretical flexibility perspective. However, I was thinking of taking the principles but actually represent the triples as RDF and use SparQL to represent policies, to use the power of graph engines rather than building my own triple store & query engine. Any reason you went for SQL storage and a custom…
I don't work at ORY, but I do work on a Zanzibar implementation.
Basically, what you're describing is called "GBAC". GBAC can be great if you need the full power of a typical Graph API, but Zanzibar-like services are focused on solving the problem of finding a path between two edges[1] and doing everything you can to optimize that operation for latency. GBAC is flexible, but at the cost of performance compared to something more structured.
[0]: https://docs.authzed.com/authz/what-else#gbac-graph-based-ac...
Re: Ory Keto, open source authorization server based on Google Zanzibar
#27Do you plan to add ABAC permission policies consisting of an expression of arbitrary attribute-based conditions for the object? Say 'o.group = 'guest' AND o.location in ['CA', 'WA'].
Recently a prospective client, coming from the world of Active Directory, has expressed a need for such a feature in ASPSecurityKit.
I haven't read the Zanzibar paper, but In ASPSecurityKit we've implemented ACLs on a similar concept – we call it activity-data authorization (ADA) [0]. Since it works as part of your application as a library, it can inspect request and automatically discover and authorize access to objects [1]. The attribute-based permission policies for users is something we're evaluating now.
0: https://youtu.be/u9NnBNEMpF4 1: https://aspsecuritykit.net/docs/article/how-to-perform-activ...
Re: Ory Keto, open source authorization server based on Google Zanzibar
#28Not related to Ory: I don't know why the name of the Google's service is Zanzibar but if that's related to Zanzibar Island which was once a slave route, I don't feel good about it. I'd love to be enlightened on this part. You can call it my curiosity to know.
Re: Ory Keto, open source authorization server based on Google Zanzibar
#29How does this differ from OpenPolicyAgent?
OPA takes a whole different approach. They basically have a specific language and a corresponding interpreter. The previous version of Keto was based off of OPA. We discovered that it is not suitable for our needs and what we want to offer because it can be very hard to meet certain performance goals (e.g. https://github.com/ory/keto/issues/104 ) Taking this simple approach allows us to provide a global, low latency,…
[deleted]
Re: Ory Keto, open source authorization server based on Google Zanzibar
#30Hello! I am one of the maintainers of Ory Keto. We spent a lot of time and effort to read, learn, and analyse the Google Zanzibar paper ( https://research.google/pubs/pub48190/ ) and the release brings that all together. There are still many things missing, but with a great community we hope to build the “Kubernetes” of permissions and access control! If you have any questions, I am here to help
This is awesome! Full Disclosure: I'm a YC W21 founder that's built authzed, which is effectively Zanzibar as a Service, but anything that gets mindshare towards using ACL services is huge. How close do ya'll plan to follow the paper? At a glance, I noticed a few of differences. It'd be amazing if we had API compatibility across our products.
We tried to follow as close as possible, but left out all optimizations and cluster inter-node messaging for now. The data structures and APIs are followed 1:1.
In some places it was hard to follow the paper as they leave out important details, but you probably experienced that as well ;)
Your APIs look quite compatible, as you probably also stayed very close to the paper.