I originally read that as OpenFPGA (note the extra P ) and wondered what kind of eldritch abomination they had created ...
Oh, good, I'm not the only one then.
We rewrote OpenFGA in pure Postgres
11–17 of 17 posts
Re: We rewrote OpenFGA in pure Postgres
#12Earlier quoted context omitted.
[flagged]
> I remember building a project where we kept a mapping table of users to permissions for quick lookups, but man, it got messy with data updates. Yep, as I mentioned above, its not an easy problem but once it is solved for you, it becomes "just" watching the events and performing the JOINs. > especially if we could create an extension for other databases See my video I linked above about the Postgres FDW: It does exa…
Joey is the man and the domain expert on this for sure :-)
Re: We rewrote OpenFGA in pure Postgres
#13Earlier quoted context omitted.
Authorized search isn't difficult. Store authorized readers (people, groups, etc) on each result to pre-filter results, then post-filter results with an additional authorization check in case the authorization store was updated but the search results store was not. Context: I've built an authorized search solution before.
[flagged]
> I remember building a project where we kept a mapping table of users to permissions for quick lookups, but man, it got messy with data updates.
Do you mean literally users to permissions?
Usually users map into groups, groups are subgroups of each other, and permissions are granted to groups.
So you can only see the financial data if you're in financial-report-preparers. Can Bob see the report? That depends on if he's an indirect or direct member of financial-report-preparers.
This is different from RBAC where Bob might have an admin or manager role directly. If he has admin access it's because he's a member of a certain group of employees that's a subgroup of another group of employees who all have admin access etc. similarly for groups of end users.
It would be a combinatorial explosion to try to enumerate the permissions of a given user. If people are having lot of syncing problems they may not have granular enough groups.
Groups make it safe. Groups are best.
Re: We rewrote OpenFGA in pure Postgres
#14Earlier quoted context omitted.
> I remember building a project where we kept a mapping table of users to permissions for quick lookups, but man, it got messy with data updates. Yep, as I mentioned above, its not an easy problem but once it is solved for you, it becomes "just" watching the events and performing the JOINs. > especially if we could create an extension for other databases See my video I linked above about the Postgres FDW: It does exa…
Joey is the man and the domain expert on this for sure :-)
Happy to answer any other questions :D
Re: We rewrote OpenFGA in pure Postgres
#15I have similar concerns, like how to reconcile authz with search. Search wants to be its own thing, and so does authz. Pray tell how I'm supposed to get a paginated list of authorized results? You have to filter or have the search service call the authz service. Life is easier when the main database can handle everything. We should develop and translate this extension to other databases.
Have you looked into Local Authorization? https://www.osohq.com/docs/develop/facts/local-authorization it lets you apply authz filters to paginated search over a database, even if some of the data the authz depends on isn't stored in the database
Re: We rewrote OpenFGA in pure Postgres
#16I originally read that as OpenFPGA (note the extra P ) and wondered what kind of eldritch abomination they had created ...
[deleted]
Re: We rewrote OpenFGA in pure Postgres
#17Not sure couldn't it just have been multiple different tokens/sessions and based on the request, use the correct one? It obviously only solves the issue specifically for multi-tenancy, but if that meant being able to stay on RBAC and well, not doing that effort, I'd wager it'd be worth the trade-off