Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ory Keto, open source authorization server based on Google Zanzibar

github.com

Post reply on HN
Print view View original

31–40 of 70 posts

Re: Ory Keto, open source authorization server based on Google Zanzibar

#31

Post by zepatrik »

TriNetra wrote: post #27

Do you plan to add ABAC permission policies consisting of an expression of arbitrary attribute-based conditions for the object? Say 'o.group = 'guest' AND o.location in ['CA', 'WA']. Recently a prospective client, coming from the world of Active Directory, has expressed a need for such a feature in ASPSecurityKit. I haven't read the Zanzibar paper, but In ASPSecurityKit we've implemented ACLs on a similar concept – w…

This is tracked here: https://github.com/ory/keto/issues/319

Basically the idea is to check the attributes before actually forwarding the request to Keto. That could be done through e.g. a OPA integration. This can scale much better IMO than just doing everything in OPA.

Re: Ory Keto, open source authorization server based on Google Zanzibar

#32

Post by MattyRad »

I was auditing Keto recently, I came across this discussion:

https://github.com/ory/keto/issues/47

It's a impressive example of high functioning discourse: all the participants provide valuable insight, state concerns, elegantly summarize very complex issues, and show a lot of respect to each other; great gains are made as a result. It's worth reading in its entirety.

Re: Ory Keto, open source authorization server based on Google Zanzibar

#33

Post by atainter56 »

It's really awesome to see the Zanzibar implementation open sourced. I also built an implementation of Zanzibar. From my understanding, one of the core features of the paper is the Leopard index system which delivers fast permission checks at scale. I noticed that your system doesn't have an index algorithm, but there is an issue in your repo to implement it. Do you have any idea when you would implement it? I'd like to potentially use/contribute.

Re: Ory Keto, open source authorization server based on Google Zanzibar

#34

Post by yenkel »

This looks great, good to learn that something like this is out there.

I work at Auth0 and we are building a Zanzibar inspired SaaS as well (you can read here if interested https://twitter.com/auth0lab) and it is positive to see that there's interest in services like this, it's validating :)

One of the things we found is that learning Zanzibar concepts can be a bit daunting, so we put together this playground: https://sandman-86.herokuapp.com/, that has samples and tutorials, etc.

Hopefully that's useful for others getting started with Zanzibar. We are likely going to be adding the ability to write to the playground (it is read-only today) in the next few months.

Re: Ory Keto, open source authorization server based on Google Zanzibar

#35

Post by de6u99er »

robertlagrant wrote: post #10
neupatr wrote: post #2

Hello! I am one of the maintainers of Ory Keto. We spent a lot of time and effort to read, learn, and analyse the Google Zanzibar paper ( https://research.google/pubs/pub48190/ ) and the release brings that all together. There are still many things missing, but with a great community we hope to build the “Kubernetes” of permissions and access control! If you have any questions, I am here to help

Fantastic news - a great achievement.

Indeed!

Re: Ory Keto, open source authorization server based on Google Zanzibar

#36

Post by zepatrik »

yenkel wrote: post #34

This looks great, good to learn that something like this is out there. I work at Auth0 and we are building a Zanzibar inspired SaaS as well (you can read here if interested https://twitter.com/auth0lab ) and it is positive to see that there's interest in services like this, it's validating :) One of the things we found is that learning Zanzibar concepts can be a bit daunting, so we put together this playground: https…

Wow that playground looks awesome, is it open source? It really makes sense to have these graphs and trees, makes it way easier to understand.

Nice work there!

Re: Ory Keto, open source authorization server based on Google Zanzibar

#37

Post by jzelinskie »

yenkel wrote: post #34

This looks great, good to learn that something like this is out there. I work at Auth0 and we are building a Zanzibar inspired SaaS as well (you can read here if interested https://twitter.com/auth0lab ) and it is positive to see that there's interest in services like this, it's validating :) One of the things we found is that learning Zanzibar concepts can be a bit daunting, so we put together this playground: https…

This is really polished with the graph visualization!

Similarly, Authzed has a playground[0], but it's focused more on validation, exhaustively testing, and sharing your designs rather than visualization.

[0]: https://play.authzed.com

Re: Ory Keto, open source authorization server based on Google Zanzibar

#38

Post by throwaway823882 »

There's already 50 of these things that have different features/providers/etc. Can't we stop making 50 different ones and just focus development on one of them?

Edit: My bad, it's a corporate product, they're not gonna focus development around somebody else's code. Corporate "open source" is hopeless.

Re: Ory Keto, open source authorization server based on Google Zanzibar

#39

Post by throwaway86310 »

jakemoshenko wrote: post #28
throwaway86310 wrote: post #21

Not related to Ory: I don't know why the name of the Google's service is Zanzibar but if that's related to Zanzibar Island which was once a slave route, I don't feel good about it. I'd love to be enlightened on this part. You can call it my curiosity to know.

https://twitter.com/leakissner/status/1136691523104280576?la...

Thanks that cleared everything.

Re: Ory Keto, open source authorization server based on Google Zanzibar

#40

Post by de6u99er »

Great effort!

But your docker files are not really related to the source code. Your Dockerfile expects a prebuilt binary, and your docker-compose file a pre-built image from a container-registry (usually Dockerhub).

It would be better to do building of the project in a multi-stage Dockerfile [1], and use the local Dockerfile [2] instead of a pre-built image from Dockerhub.

[1] https://fabianlee.org/2020/01/26/golang-using-multi-stage-bu...

[2] https://docs.docker.com/compose/compose-file/compose-file-v3...

Post reply on HN