Ory Keto, open source authorization server based on Google Zanzibar

Post by kleton » Thu, Apr 08, 2021, 10:57 PM UTC

jakemoshenko wrote: post #49

nickthemagicman wrote: post #43

Can anyone give me a Google Zanzibar for dummies? It's the first I'm hearing about it. Is it Oauth for everything?

It's a really well designed distributed system for calculating access control decisions at scale. It makes a specific authorization CAP tradeoff that allows for consistency around access checks to different "versions" of a piece of content, allowing older content to be protected by checks served from read replicas and cache. Full disclosure: I am a co-founder of a company building and hosting a Zanzibar implementatio…

Post by CGamesPlay » Thu, Apr 08, 2021, 11:10 PM UTC

neupatr wrote: post #15

wiradikusuma wrote: post #13

So this is like https://www.keycloak.org but without Java?

Keto only does authorization, independent of users, devices, bots, applications, ... Basically you store your ACLs there and then ask "is _subject_ allowed to do _relation_ on _object_". All the variables are whatever you define them to be. Check out https://github.com/ory/kratos , our identity server. Or https://github.com/ory/hydra , our OAuth2 server. All of them together can be assembled to have something like Ke…

Post by mathgeek » Thu, Apr 08, 2021, 11:32 PM UTC

Scandiravian wrote: post #14

mumblemumble wrote: post #9

Earlier quoted context omitted.

I think that that strategy is roughly how drugs all end up with such odd names.

I have friends who's job it is to come up with names for new drugs. It's actually a difficult task, since it needs to be easy to remember, create a slightly positive or neutral association with consumers, and most importantly, not be even close to a dirty/offensive word in any language used in a major market It does result in some super silly names. So much so, that when I studied pharmaceutical sciences, we made a d…

Post by jschorr » Fri, Apr 09, 2021, 4:20 AM UTC

nickthemagicman wrote: post #54

jakemoshenko wrote: post #49

Earlier quoted context omitted.

It's a really well designed distributed system for calculating access control decisions at scale. It makes a specific authorization CAP tradeoff that allows for consistency around access checks to different "versions" of a piece of content, allowing older content to be protected by checks served from read replicas and cache. Full disclosure: I am a co-founder of a company building and hosting a Zanzibar implementatio…

Thank you! How does it integrate with apps it controls? Are there libraries? Or does it provide a data format to implement in the app you're working on?

Post by tacurran » Fri, Apr 09, 2021, 4:54 AM UTC

atainter56 wrote: post #33

It's really awesome to see the Zanzibar implementation open sourced. I also built an implementation of Zanzibar. From my understanding, one of the core features of the paper is the Leopard index system which delivers fast permission checks at scale. I noticed that your system doesn't have an index algorithm, but there is an issue in your repo to implement it. Do you have any idea when you would implement it? I'd like…