Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Google Zanzibar shines at building authorization

blog.warrant.dev

Post reply on HN
Print view View original

61–70 of 91 posts

Re: Why Google Zanzibar shines at building authorization

#61

Post by [deleted] »

akajla wrote: post #59
dietr1ch wrote: post #54

Earlier quoted context omitted.

Why does it need to be checked on a per-request level? I'd expect you to be able to give short-lived capability tokens to clients that each machine can verify down the stack without making new rpcs. This would avoid the fan-out of all the internal services. Is it just to prevent abuse?

You can encode capabilities/permissions as scopes in distributed tokens (e.g. OAuth) but this can start to break down if you have very granular, fine-grained permissions (e.g. user:1 has 'editor' access to 1000s of documents/objects). This is similar to the problem that Carta ran into while building out their permissions[1]. In addition, yes - validating permissions on each request makes it so that you can revoke pri…

[deleted]

Re: Why Google Zanzibar shines at building authorization

#62

Post by TheNewsIsHere »

deanCommie wrote: post #56
TheNewsIsHere wrote: post #44

Earlier quoted context omitted.

These services aren’t really going after the same problems. Zanzibar is a Google-internal implementation of the concepts outlined in this paper, focused on managing authorization as a function of relationships between objects. AWS IAM is primarily for AAA services with AWS, though you can use it with AWS Identity Center to provide SSO to other systems via IAM.

Oh I assumed Zanzibar would have also been the model for GCP's public IAM?

I don’t know one way or the other. OP claimed elsewhere in this threat that Zanzibar is used to manage authorization records for services like Google Drive and YouTube.

But as far as Zanzibar itself, it’s not something Google makes available externally.

Having played in all the major (and common) sandboxes (so not like, Oracle), the GCP, Azure, and AWS permission systems are all fairly similar. They each have their foibles but their conceptual designs are all fairly similar. But that’s not a criticism: anyone designing that kind of IAM service really isn’t going to end up with something that different given the goals involved.

Re: Why Google Zanzibar shines at building authorization

#63

Post by hn_go_brrrrr »

skybrian wrote: post #42
aseipp wrote: post #24

Earlier quoted context omitted.

The fact they did it that way is actually a perfect example of why Google is considered so far ahead of competitors technologically and operationally by their engineers. When you have a powerful building block like Spanner that engineers can use, they then can work on the product instead of wasting time on brittle consistency models, custom storage layers, and providing their own uptime guarantees. This goes for ever…

It's been many years, but a downside back when I worked there was infrastructure churn. Migrating off deprecated infrastructure meant you had to do a lot of work just to stay where you are. Mostly unstaffed products (like Google Reader, say) were at risk of going under due to technical debt. When App Engine launched, that was great for me because I could write internal tools that were mostly off the treadmill. Unless…

They updated the churn policy to require infrastructure teams to migrate their users, not just dump the work on them. That greatly eased the unfunded mandate load on product teams. That hasn't stopped infrastructure teams from making sweeping changes, though. There's one in particular happening now that's enormous -- to riff on the "changing the engines midflight" analogy, it's replacing the fuselage without anyone noticing.

Re: Why Google Zanzibar shines at building authorization

#64

Post by hn_go_brrrrr »

ants_everywhere wrote: post #27
sulam wrote: post #16

I was super curious to hear how Zanzibar is being used to control access to buildings. Don’t be fooled, this is not that post. ;)

I wouldn't be surprised if it is somewhere. Just have the smart card system use Cloud IAM for access control decisions.

That sounds like a nightmare. A cloud outage means no one can badge in anywhere, including at DCs?

Re: Why Google Zanzibar shines at building authorization

#65

Post by arekkas »

AndreasHae wrote: post #7

We successfully used a Relationship-based Authorization System based on the Zanzibar paper at my last job building a B2B SaaS leaning heavily on cross-company integration. The flexibility in defining rules through tuples helped us iterate rapidly on new product features. We used self-hosted Ory Keto [0] instances as the implementation, though we would have preferred a managed solution. We were checking out Auth0 Fine…

Glad to see that you used Ory Keto! :)

Ory does have a managed service offering now for Ory Keto as well!

Re: Why Google Zanzibar shines at building authorization

#66

Post by scotty79 »

ryanjshaw wrote: post #60
sulam wrote: post #16

I was super curious to hear how Zanzibar is being used to control access to buildings. Don’t be fooled, this is not that post. ;)

I was surprised that Google even had offices in Zanzibar.

It's such a weird name. It's like naming a product Google California.

Re: Why Google Zanzibar shines at building authorization

#67

Post by danpalmer »

hn_go_brrrrr wrote: post #63
skybrian wrote: post #42

Earlier quoted context omitted.

It's been many years, but a downside back when I worked there was infrastructure churn. Migrating off deprecated infrastructure meant you had to do a lot of work just to stay where you are. Mostly unstaffed products (like Google Reader, say) were at risk of going under due to technical debt. When App Engine launched, that was great for me because I could write internal tools that were mostly off the treadmill. Unless…

They updated the churn policy to require infrastructure teams to migrate their users, not just dump the work on them. That greatly eased the unfunded mandate load on product teams. That hasn't stopped infrastructure teams from making sweeping changes, though. There's one in particular happening now that's enormous -- to riff on the "changing the engines midflight" analogy, it's replacing the fuselage without anyone n…

Which one is that? Feel free to just hint or PM me.

Re: Why Google Zanzibar shines at building authorization

#68

Post by sails »

kkajla wrote: post #12
sails wrote: post #5

> A Flexible, Uniform Data Model for Authorization Are there good examples of similar applications of data modules for similarly niche use cases? I get that there are obviously endless data models, but this seems to extend beyond that into a more integrated concept and I don’t quite know why that seems to be the case.

I think GraphQL might be a good example. Some might not consider it to be very niche, but its intention is to consolidate dependent API queries such that the client can fetch all the data it needs in a single request. In both Zanzibar and GraphQL, the idea behind the schema/modeling language is to provide a layer where logic specific to relationships between data (in the case of GraphQL) or logic specific to authoriz…

Thanks, I suppose GraphQL is a valid example, I was thinking niche in terms of application eg Zanzibar is auth only, and you would struggle to use it for much else

Re: Why Google Zanzibar shines at building authorization

#69

Post by h1fra »

seymon wrote: post #21

One thing I find difficult using access control systems as a distributed service like Zanzibar is a convenient and performant way to search and filter resource data using permissions. For example defining database queries that should only return resources a subject has access to based on Zanzibar permissions.

Same reason I didn't invest much in this field yet.

When you access one resource it's fine to a do a roundtrip, but with listing, filtering, searching if you don't join at query time it doesn't work. I'm not entirely sure how they achieve it and I found it annoying that it's never mentioned because it's very common.

Re: Why Google Zanzibar shines at building authorization

#70

Post by mort96 »

smarx007 wrote: post #36
comboy wrote: post #35

Earlier quoted context omitted.

Can anybody explain me why there seem to be much focus on scalability in this context? I mean we have 8 billion people. If the whole planet registers, home PC can handle it, plus it partitions beautifully if necessary in case of authentication. So what am I missing?

Forget about 8B people in this context. If you have 1000 microservices in the company and each has 100 rps, you are looking at ca. 100k rps to a Zanzibar-style system to authorize every request (not to authenticate a user).

This isn't meant to invalidate what you're saying, but this whole thread reads like a parody to me. 1000 services all making requests to Zanzibar, and this oreo keto thing.

Makes me think of this: https://m.youtube.com/watch?v=y8OnoxKotPQ

Post reply on HN