Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ory Keto, open source authorization server based on Google Zanzibar

github.com

Post reply on HN
Print view View original

61–70 of 70 posts

Re: Ory Keto, open source authorization server based on Google Zanzibar

#61

Post by rektide »

throwaway823882 wrote: post #38

There's already 50 of these things that have different features/providers/etc. Can't we stop making 50 different ones and just focus development on one of them? Edit: My bad, it's a corporate product, they're not gonna focus development around somebody else's code. Corporate "open source" is hopeless.

if there was more agreement anything we had was genuinely good i might allow it, but atm it's pretty clear there is much work to do, none of it is lock on solid yet. so many differing approaches are necessary.

I also think you've struggle to name a dozen commonly popular authorizers.

Re: Ory Keto, open source authorization server based on Google Zanzibar

#62

Post by rektide »

neupatr wrote: post #2

Hello! I am one of the maintainers of Ory Keto. We spent a lot of time and effort to read, learn, and analyse the Google Zanzibar paper ( https://research.google/pubs/pub48190/ ) and the release brings that all together. There are still many things missing, but with a great community we hope to build the “Kubernetes” of permissions and access control! If you have any questions, I am here to help

how do you see zanzibar being able to complement kubernetes? what if any integration points will there be? or does ory keto &c intend to provide only application level permissions & access, not ops permissions & access?

Re: Ory Keto, open source authorization server based on Google Zanzibar

#63

Post by HomeDeLaPot »

qrush wrote: post #3

Hi - as someone who's been on the keto diet a lot over the pandemic and also in the before times - just wanted to chime in saying, you're going to have a heck of a time trying to break through the mountains of pages + SEO about keto recipes/books. I'd really suggest calling this something else.

Should've just picked two or more random words that would never ever overlap with anything else. Like "Blind Forest", maybe.

Re: Ory Keto, open source authorization server based on Google Zanzibar

#64

Post by neupatr »

rektide wrote: post #62
neupatr wrote: post #2

Hello! I am one of the maintainers of Ory Keto. We spent a lot of time and effort to read, learn, and analyse the Google Zanzibar paper ( https://research.google/pubs/pub48190/ ) and the release brings that all together. There are still many things missing, but with a great community we hope to build the “Kubernetes” of permissions and access control! If you have any questions, I am here to help

how do you see zanzibar being able to complement kubernetes? what if any integration points will there be? or does ory keto &c intend to provide only application level permissions & access, not ops permissions & access?

We see it as a very universal service, so integration with k8s is definitely on our list, but there are no concrete plans yet. The ACLs are just so generic, you can describe anything with it.

Re: Ory Keto, open source authorization server based on Google Zanzibar

#65

Post by neupatr »

CGamesPlay wrote: post #53
neupatr wrote: post #15

Earlier quoted context omitted.

Keto only does authorization, independent of users, devices, bots, applications, ... Basically you store your ACLs there and then ask "is _subject_ allowed to do _relation_ on _object_". All the variables are whatever you define them to be. Check out https://github.com/ory/kratos , our identity server. Or https://github.com/ory/hydra , our OAuth2 server. All of them together can be assembled to have something like Ke…

Do any of the ORY products provide a UI? From what I've seen of Kratos, you have to completely implement all HTML output yourself. Is that accurate? Is there some drop-in UI in the ORY ecosystem?

Exactly, all of our products come without any UI whatsoever. There are example UIs that could be improved, but they can get you started easily. Something like stripe's hosted pages is on our list, just not had the time to implement it yet.

Re: Ory Keto, open source authorization server based on Google Zanzibar

#66

Post by neupatr »

jeffbee wrote: post #22

I went diving into the docs to find out how Keto implements Zanzibar's consistency guarantees, which for Zanzibar are provided mostly by Spanner, but it seems that Keto just does not[1]. This does not strike me as the kind of thing that can just be added after the project begins. https://github.com/ory/keto/blob/master/docs/docs/concepts/s...

So the idea in the paper is that you store a version token (aka. zookie) next to every object version. When you ask Zanzibar if a user is allowed to modify it, the request contains the stored token. Then you get a new token with a successful response that you store with the new version. This guarantees that a user can only access 1. objects they have access to and 2. objects they don't have access to but only at versions they once had access to. The second case only occurs until an ACL update propagates around the globe and through all distributed caches. In our opinion that can be added later on (the proto definitions already account for that), although it is a breaking change of course. One important point is that Keto can be operated locally as well, which means there are no database sync delays. This is the only mode it supports right now, and it does not need the zookies for that.

Re: Ory Keto, open source authorization server based on Google Zanzibar

#67

Post by FooBarBizBazz »

jakemoshenko wrote: post #28
throwaway86310 wrote: post #21

Not related to Ory: I don't know why the name of the Google's service is Zanzibar but if that's related to Zanzibar Island which was once a slave route, I don't feel good about it. I'd love to be enlightened on this part. You can call it my curiosity to know.

https://twitter.com/leakissner/status/1136691523104280576?la...

Lol, so it was named with full understanding. They should call auth tokens "cloves" and use a cartoon Tippu Tip as a mascot.

Re: Ory Keto, open source authorization server based on Google Zanzibar

#68

Post by nickthemagicman »

jschorr wrote: post #57
nickthemagicman wrote: post #54

Earlier quoted context omitted.

Thank you! How does it integrate with apps it controls? Are there libraries? Or does it provide a data format to implement in the app you're working on?

Hi Nick, In the case of Authzed, we provide a gRPC API [0] which can be used from any application or language that supports gRPC, as well as designed client libraries for specific languages [1] to make integration even easier. Applications primarily integrate by making Check requests [2] at any point in which a protected resource is being accessed and Write requests [3] at any point in which permissions are granted o…

Awesome! Thank you! That makes sense. That's very interesting.

Re: Ory Keto, open source authorization server based on Google Zanzibar

#69

Post by FooBarBizBazz »

FooBarBizBazz wrote: post #67
jakemoshenko wrote: post #28

Earlier quoted context omitted.

https://twitter.com/leakissner/status/1136691523104280576?la...

Lol, so it was named with full understanding. They should call auth tokens "cloves" and use a cartoon Tippu Tip as a mascot.

(For the record, they should very much not do this.)
Post reply on HN