Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blueprint for a distributed multi-region IAM with Go and CockroachDB

ory.dev

Post reply on HN
Print view View original

31–34 of 34 posts

Re: Blueprint for a distributed multi-region IAM with Go and CockroachDB

#31

Post by KRAKRISMOTT »

leoqa wrote: post #4

I suspect most business logic can handle 25ms for authz and that’s the right trade off. I think Google’s Zanzibar is also centralized but leverages extreme caching to get lower latencies? I work on an IAM system that is sub-ms p99 for our authz checks, with policies and keys pushed to each network edge instead of running a centralized system. The biggest perf hits are crypto verification and logging to the fs. We fai…

What does GitHub use for their Authz? After inviting a user, there is no perceptible sync delay and they can start cloning the repo immediately.

Re: Blueprint for a distributed multi-region IAM with Go and CockroachDB

#32

Post by tonyhb »

KRAKRISMOTT wrote: post #31
leoqa wrote: post #4

I suspect most business logic can handle 25ms for authz and that’s the right trade off. I think Google’s Zanzibar is also centralized but leverages extreme caching to get lower latencies? I work on an IAM system that is sub-ms p99 for our authz checks, with policies and keys pushed to each network edge instead of running a centralized system. The biggest perf hits are crypto verification and logging to the fs. We fai…

What does GitHub use for their Authz? After inviting a user, there is no perceptible sync delay and they can start cloning the repo immediately.

Not sure, but I'd guess they're using Vitesse (ie. Planetscale) which is honestly really fast and durable.

Re: Blueprint for a distributed multi-region IAM with Go and CockroachDB

#33

Post by Sytten »

aeneas_ory wrote: post #25
Sytten wrote: post #22

Good post, side remark our experience with kratos have been mixed while self hosting the solution. You can feel OSS is second class for them (lots of PR never getting merged, endless debates and little progress in code), it's OK its a business and they are not doing support contracts. Just know what you are getting into. Just my experience, might be different with other products.

Sorry to hear that this has been your experience! What exactly was the issue for you? It’s true that there are lots of open PRs. We’re a small team and often busy with customer requirements which doesn’t allow us to get some community PRs over the finishing line (finish tests, refactor code, fix remaining bugs, do security reviews, …). Sometimes, PRs are not aligning with an architecture or API principle which is whe…

I think it would be fair to say that kratos was not the priority in 2022 in terms of code you can see not much was commited (https://github.com/ory/kratos/graphs/code-frequency) so I might have had a bad first impression.

A few issues on kratos that I consider relatively important are still missing / nobody from Ory is giving their input so it's hard to make progress and I would not take my time to contribute if I dont know if the owner are going to merge it.

An example that comes to mind is the OAuth email auto-verification or the search of users that is still super basic (we only recently got the filter of identifiers).

Re: Blueprint for a distributed multi-region IAM with Go and CockroachDB

#34

Post by vinckr »

Sytten wrote: post #33
aeneas_ory wrote: post #25

Earlier quoted context omitted.

Sorry to hear that this has been your experience! What exactly was the issue for you? It’s true that there are lots of open PRs. We’re a small team and often busy with customer requirements which doesn’t allow us to get some community PRs over the finishing line (finish tests, refactor code, fix remaining bugs, do security reviews, …). Sometimes, PRs are not aligning with an architecture or API principle which is whe…

I think it would be fair to say that kratos was not the priority in 2022 in terms of code you can see not much was commited ( https://github.com/ory/kratos/graphs/code-frequency ) so I might have had a bad first impression. A few issues on kratos that I consider relatively important are still missing / nobody from Ory is giving their input so it's hard to make progress and I would not take my time to contribute if I…

I would say that Ory Kratos made huge improvements in 2022, and the code graph is just looking like that because there was much more foundational work going on in 2021. In 2022 it was mostly adding features, fixing bugs etc, but the API and system was generally stable already.

from the top of my head some of the features added in 2022: - verification and recovery codes - import of MD5-hashed passwords - integration with Ory Hydra - device information in session - session management APIs - session metadata - blocking webhooks - many improvements to OIDC mappers - session refresh - opentelemetry tracing - complete rewrite of docs - import identities including hashed passwords - custom email templates - passwordless with webauth - 1:1 compatibility Ory Network and Ory Open Source

Of course there was a huge amount of bugfixes and smaller improvements going on already. 2023 also already saw a ton of work being done on Ory Kratos including the 1.0 stable release. Of course there is still much to do, and feedback like yours also helps! If you are looking to contribute its always recommended to talk to the maintainer before you start coding - then we can let you know if its realistic to be merged or not. Search is a not a trivial thing to implement, on the one hand it is needed in some form, on the other hand Ory Kratos should not bloat too much.

Anyway, thanks for the feedback, will take it into consideration :-)

Post reply on HN