11–20 of 23 posts
A lot of application frameworks have some kind of a security policy engine, but all of these invariably are inadequate - because modern policy management is about interfacing outside of systems, and that they don't do.
Exactly in the same way that load balancing should not be a part of an application framework, neither should authorization.
A coherent, formalized, well manageable policy engine can go a great deal for practical organization security
I don't know. This seems to be something I’d get a slap on the hand from our security team. No chance ever they give away the power they have for control who have permission. Just me??
Can you self host this? Feels dangerous to check an external service for RBAC.
Updates are done through OPAL (https://opal.ac) - which has a a zero trust architecture (it sends instructions on how to get the data instead of the data itself) based on topics scoped with security tokens.
You can read all about it here: - https://docs.permit.io/concepts/control-plane-and-data-plane...
Is this kind of like Auth0 but with more common features built in, or is something like auth0, AzureAD still needed in order to issue jwts?
You pass the JWTs from your AuthN solution to permit's permit.check() function.
Read more: - https://www.permit.io/blog/what-is-authorization - https://docs.permit.io/tutorials/quickstart#check-for-permis...
[flagged]
Check out this example: https://youtu.be/-W-79h7FJLQ
[flagged]