Ya sorry Google I will be using as little of your services as possible.
Your censorship of the truth is criminal and you will be held accountable
Zanzibar: Google’s Consistent, Global Authorization System (2019)
71–80 of 99 posts
Re: Zanzibar: Google’s Consistent, Global Authorization System (2019)
#72Maybe a dumb question on standalone authorization services: does the authorization service end up having a representation for every single object in all of the rest of your datastores? (e.g. every document, every blob of storage, every user in every org). If so, does that become a chokepoint in a distributed microservice architecture? Or can that be avoided with an in-process or sidecar architecture in which a given…
As with everything, it depends on your requirements. Say your goal is to externalize just your authorization policies from your code. A simple implementation might look like an OPA sidecar to your services, with the policy itself being sourced from a separate control plane - this might be something as simple as a centrally-managed S3 bucket. The service implementation provides the attributes to OPA to allow it to eva…
Thank you, thank was a cogent summary.
Re: Zanzibar: Google’s Consistent, Global Authorization System (2019)
#73I'm curious what's driving the resurgence in interest authorization infrastructure, particularly the Zanzibar paper. As founder of Oso ( https://www.osohq.com/ ), I have my own opinions, and I think this is a good thing. But would love to hear others' points of view here.
The rise of the zero trust paradigm in corporate networks probably.
Pandemic times and working from home. Companies were already exposed by their employees mobile devices and by people working on public wifi networks, like catching up on email while having coffee at the neighborhood coffee house. Now with employees more-or-less permanently remote, what is the corporate network? Add to that the realization that as organizations adopt more and more SaaS offerings into their operations, the distinction between "corporate network" and "public network" vanishes. The old VPN/firewall/DMZ perimeter model was leaky anyway.
Re: Zanzibar: Google’s Consistent, Global Authorization System (2019)
#74There is an Open Source (Go) implementation of "Zanzibar" called
Keto [0] that integrates with the rest of the Ory ecosystem. We are actually testing it and looks great so far.
Re: Zanzibar: Google’s Consistent, Global Authorization System (2019)
#75Earlier quoted context omitted.
Airbnb Himeji also: https://medium.com/airbnb-engineering/himeji-a-scalable-cent...
I am continuing to be amazed at how much over engineering Airbnb does for ostensibly a cleaner couch surfing broker. Like they don't actually do much even for a travel site, they have so much investment and could have easily disrupted so many different travel related Fields instead they keep over engineering software. Not sure how to feel about it (since we do kinda benefit from their busywork)
They have similar incentives to Uber where their main goal is to get engineers to work for them by being interesting, and it doesn't actually have to be profitable. I think Uber also writes blog posts about architecture to trick competitors into thinking it can't be done by sharding each city into one box under someone's desk.
Re: Zanzibar: Google’s Consistent, Global Authorization System (2019)
#76Earlier quoted context omitted.
Zanzibar doesn't actually contain any object data, only authorization metadata. So you can't do the complex queries you're suggesting against Zanzibar itself, and presumably the databases that store actual data have authz as a requirement prior to the actual query (which is fine bc Zanzibar is fast)
Could you elaborate on "prior to the actual query"? Do you mean taking some rough queryable subset and then calling Zanzibar for each object in that subset? That's how I'm handling it right now, I just hoped others had a more scalable solution.
No I mean that a user either has access to the database or not. If they do, you check access prior to the query. I think you're doing something related to row level permissions within a database.
And ultimately "Implementing side-channel secure row level security in a database" is a completely independent problem from "abstract authz checker, which is what zanzibar is. You might build a row level security infra atop zanzibar, but you'd probably do that within your database engine, with zanzibar serving as some sort of authz primitive.
Re: Zanzibar: Google’s Consistent, Global Authorization System (2019)
#77Maybe a dumb question on standalone authorization services: does the authorization service end up having a representation for every single object in all of the rest of your datastores? (e.g. every document, every blob of storage, every user in every org). If so, does that become a chokepoint in a distributed microservice architecture? Or can that be avoided with an in-process or sidecar architecture in which a given…
This is a really interesting question that gets at the heart of service federation.
I don't know the answer for Zanzibar, but take a look at how AWS IAM solves it. IAM has very few strong opinions in its model of the world (essentially it divides the world into AWS account ID namespaces and AWS service names/namespaces, and there's not much detail beyond that). Everything else is handled through symbolic references (via string/wildcard matching) to principals, resources, and actions in the JSON policies, as well as variables in policy evaluation contexts (and conditions, which are predicates on the values of those variables, or parameters to customizations (policy evaluation helper procedures) provided by each service).
IAM is loosely coupled with the namespaces of the services it serves, and that allows different services to update their authz models independently with pretty much no state or model information centralized in IAM itself. This is a key, underappreciated part of what makes AWS able to move so fast.
Re: Zanzibar: Google’s Consistent, Global Authorization System (2019)
#78Interesting choice of name. https://www.researchgate.net/publication/325605315_The_1964_... >On the fiftieth anniversary of the atrocious killing and raping of the Arabs of Zanzibar in the wake of the 1964 revolution in the Island, this paper sought to establish that this mayhem was genocide. In light of the almost complete failure to notice this tragedy, the paper pursued critical genocide studies and hidden genocid…
Here's the story of how its name came to be: https://twitter.com/LeaKissner/status/1136691523104280576
Re: Zanzibar: Google’s Consistent, Global Authorization System (2019)
#79Maybe a dumb question on standalone authorization services: does the authorization service end up having a representation for every single object in all of the rest of your datastores? (e.g. every document, every blob of storage, every user in every org). If so, does that become a chokepoint in a distributed microservice architecture? Or can that be avoided with an in-process or sidecar architecture in which a given…
I've been writing about application authorization here: https://www.osohq.com/academy/chapter-2-architecture (I'm CTO at Oso, but these guides are not Oso specific). It covers this in the later part of the guide. Depending on your requirements, yes that's kind of what happens if you want to centralise. It can make sense for Google-scale problems where you really do need to handle the complex graph of relationships be…
Sam, thank you for your talks on the Python.__init__ and TalkPython podcasts. I've appreciate how well you describe the problem domain.
https://www.pythonpodcast.com/oso-open-source-authorization-...
https://talkpython.fm/episodes/show/294/oso-authorizes-pytho...
Re: Zanzibar: Google’s Consistent, Global Authorization System (2019)
#80Earlier quoted context omitted.
I've been writing about application authorization here: https://www.osohq.com/academy/chapter-2-architecture (I'm CTO at Oso, but these guides are not Oso specific). It covers this in the later part of the guide. Depending on your requirements, yes that's kind of what happens if you want to centralise. It can make sense for Google-scale problems where you really do need to handle the complex graph of relationships be…
Sam, thank you for your talks on the Python.__init__ and TalkPython podcasts. I've appreciate how well you describe the problem domain. https://www.pythonpodcast.com/oso-open-source-authorization-... https://talkpython.fm/episodes/show/294/oso-authorizes-pytho...
<3 Thank you!