Ory Keto, open source authorization server based on Google Zanzibar

Post by 1cvmask » Thu, Apr 08, 2021, 7:01 PM UTC

jzelinskie wrote: post #26

sroze wrote: post #20

Earlier quoted context omitted.

Amazing, I was going to start such endeavour, Zanzibar is to me that best of the ACL system that I know of, from a theoretical flexibility perspective. However, I was thinking of taking the principles but actually represent the triples as RDF and use SparQL to represent policies, to use the power of graph engines rather than building my own triple store & query engine. Any reason you went for SQL storage and a custom…

I don't work at ORY, but I do work on a Zanzibar implementation. Basically, what you're describing is called "GBAC". GBAC can be great if you need the full power of a typical Graph API, but Zanzibar-like services are focused on solving the problem of finding a path between two edges[1] and doing everything you can to optimize that operation for latency. GBAC is flexible, but at the cost of performance compared to som…

Post by robertlagrant » Thu, Apr 08, 2021, 7:30 PM UTC

yenkel wrote: post #34

This looks great, good to learn that something like this is out there. I work at Auth0 and we are building a Zanzibar inspired SaaS as well (you can read here if interested https://twitter.com/auth0lab ) and it is positive to see that there's interest in services like this, it's validating :) One of the things we found is that learning Zanzibar concepts can be a bit daunting, so we put together this playground: https…

Post by throwaway3699 » Thu, Apr 08, 2021, 7:53 PM UTC

nickthemagicman wrote: post #43

Can anyone give me a Google Zanzibar for dummies? It's the first I'm hearing about it. Is it Oauth for everything?

Post by robertlagrant » Thu, Apr 08, 2021, 7:58 PM UTC

throwaway86310 wrote: post #39

jakemoshenko wrote: post #28

Earlier quoted context omitted.

https://twitter.com/leakissner/status/1136691523104280576?la...

Thanks that cleared everything.

Post by deadmutex » Thu, Apr 08, 2021, 8:40 PM UTC

jakemoshenko wrote: post #49

nickthemagicman wrote: post #43

Can anyone give me a Google Zanzibar for dummies? It's the first I'm hearing about it. Is it Oauth for everything?

It's a really well designed distributed system for calculating access control decisions at scale. It makes a specific authorization CAP tradeoff that allows for consistency around access checks to different "versions" of a piece of content, allowing older content to be protected by checks served from read replicas and cache. Full disclosure: I am a co-founder of a company building and hosting a Zanzibar implementatio…