Aserto: Developer API for permissions and RBAC • Hacker News Board

Re: Aserto: Developer API for permissions and RBAC

#51

Post by jzelinskie » Thu, Feb 17, 2022, 4:41 PM UTC

gertd wrote: post #49

gertd wrote: post #41

Earlier quoted context omitted.

So the idea is that you create a candidate set of resource keys from the permission system and join that with the external database and / or use it as a post filter?

@jzelinskie care to respond, I am really interested in the answer?

You're correct. The only thing I'd add is that post filters can also be done without a candidate set of resources by performing individual permission checks for each potential resource. This is slower, but, as I mentioned, it can actually be perform better than you'd think with some tricks.

Apologies for the delayed response.

Re: Aserto: Developer API for permissions and RBAC

#52

Post by samjs » Thu, Feb 17, 2022, 5:05 PM UTC

DandyDev wrote: post #50

samjs wrote: post #35

Earlier quoted context omitted.

It's actually a pretty great question! As others have mentioned, authorization often requires both a single method to authorize "can the user perform this action on this resource" as well as more flexible versions like "what are all the resources this user can perform this action on". That's one part of why authorization is hard, I wrote an article on this a little while ago [1]. At Oso (disclaimer: I'm the CTO), we…

Hey samjs, we've been using Oso at Source.ag for a month or so, and we're really happy with it! Precisely the fact that you solve authorization on a resource level and implement filtering on the DB level, makes it super useful! The biggest gripe we have, is lack of support for SQLAlchemy 2.0 style queries and lack of support for DB & Python enums as role names We had a chat with Graham who told us about your upcoming…

Thank you! We're looking forward to sharing more about Oso cloud too :)

Re: Aserto: Developer API for permissions and RBAC

#53

Post by emreb » Tue, Mar 01, 2022, 4:10 PM UTC

fabian2k wrote: post #21

This is probably a pretty stupid question, or at least based on some misconception of mine about this space. But I don't really understand how permissions as a service or API can work efficiently. If I request a single resource, of course this can work if I ask a second API on whether the request is allowed or not. But if I query a database for a list of items, to add access control I need to modify the database quer…

Disclaimer, I am a founder of Cerbos. At Cerbos, rather than writing policies in Rego, you can write them in a much simpler YAML/JSON (much more like AWS IAM)

(a bit late to the party)

Hi Fabian, At Cerbos we had to handle this issue as well and wrote a blog post about [1] how we can convert a policy into a generic AST that you can use in your data filtering logic on your data storage. This way you can empower your data storage queries to only fetch the relevant records.

To showcase how this works, we have released a Prisma ORM plugin [2] that converts our AST to Prisma filters - you can see a demo on Prisma’s YouTube channel[3]

[1]: https://cerbos.dev/blog/filtering-data-using-authorization-l...

[2]: https://cerbos.dev/blog/fully-featured-authorization-for-you...

[3]: https://youtu.be/lqiGj02WVqo?t=3616