Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zanzibar: Google’s Consistent, Global Authorization System (2019)

research.google

Post reply on HN
Print view View original

91–99 of 99 posts

Re: Zanzibar: Google’s Consistent, Global Authorization System (2019)

#91

Post by MrKristopher »

dvdkon wrote: post #62
bradstewart wrote: post #52

Earlier quoted context omitted.

What exactly is the attack you're worried about here? Why do attackers have direct query access to your database? What useful information can they extract from knowing there is an unauthorized object in the database?

My model attacker is a limited user that has access to an advanced search function with filtering on number inequality and/or string patterns akin to LIKE. Such an attacker could send a search query such as "id = 4829 AND cost > 1000" and measure the time that query took (over multiple executions). From the time data the attacker could then determine if object 4829 has a cost value of over 1000, gaining 1 bit of data…

If your object IDs are 1, 2, 3... then attacker can check all the IDs. If instead each object ID is a 256-bit UUID, then the attacker can't make a query for every possible object ID.

Re: Zanzibar: Google’s Consistent, Global Authorization System (2019)

#92

Post by skj »

guenthert wrote: post #90

Hmmh, auditing doesn't seem to be mentioned in that paper. I'd think that's a mandatory feature of an authorization service.

In Google, auditing is handled separately.

The availability guarantees necessary for basic authorization are far more strict than auditing. Auth fails closed, audit fails open.

Anything that can be stripped out of auth should be, even if we're talking about a best effort extra rpc from the auth service.

Auditing typically needs more information than auth as well, and making the auth pipe wide is a risk.

Re: Zanzibar: Google’s Consistent, Global Authorization System (2019)

#94

Post by etxm »

andyroid wrote: post #69
etxm wrote: post #59

Earlier quoted context omitted.

I use OPA with terraform and kubernetes, but I’m looking for something for application ACLs, where I as a resource owner can assign permissions to arbitrary subjects for a resource. Does OPA support that? If so that would be very very cool.

Certainly! Application and microservice authorization is probably one of the more common use cases for OPA, and there's definitely benefits in having a unified policy engine in an organization or company.

I have only found RBAC and ABAC docs and tutorials for OPA, do you happen to know of a good source of docs for ACLs like, User A gives User B edit rights on Resource C?

Update: I swear I’ve looked through the docs 20 times and I’ve never seen this use case, but of course after writing this comment I go back and immediately find what may work :-)

https://www.openpolicyagent.org/docs/latest/comparison-to-ot...

Re: Zanzibar: Google’s Consistent, Global Authorization System (2019)

#95

Post by ogazitt »

dboreham wrote: post #28
pnocera wrote: post #26

I'm just wondering if there's a one size fits all solution for authz. I spent a few days on a use case : - users have one or several roles ( these are hierarchical ) - there are some objects in the system ( hierarchical too, eg files and folders ) - there are different features available according to a user's subscription. I ended up with a 30 lines program which given a set of rules calculates who can access what in…

You are not wrong. And this pattern shows up everywhere. e.g. do you need a SaaS for "feature flags", since they're just an if statement? In the case of authz, the argument for separating it as a concern is that many applications can share the same scheme, and you can have specialized tools for provisioning, auditing, etc.

Exactly. When you cross a certain complexity threshold, it's worth separating concerns. It's true for configuration, it's true for IaC, and also for authorization policy.

Re: Zanzibar: Google’s Consistent, Global Authorization System (2019)

#96

Post by ogazitt »

KrishnaAnaril wrote: post #51

What is the status of xacml based solutions? Anyone using it?

The ideas (attribute based access control) have stood the test of time, but the spec is archaic, and there are relatively few implementations. You can achieve alot of what XACML was intended for with a general-purpose policy engine (OPA).

Re: Zanzibar: Google’s Consistent, Global Authorization System (2019)

#97

Post by joshuamorton »

dvdkon wrote: post #83
joshuamorton wrote: post #76

Earlier quoted context omitted.

No I mean that a user either has access to the database or not. If they do, you check access prior to the query. I think you're doing something related to row level permissions within a database. And ultimately "Implementing side-channel secure row level security in a database" is a completely independent problem from "abstract authz checker, which is what zanzibar is. You might build a row level security infra atop…

From what I can see, Zanzibar is also intended for "row-level" access checks. I also don't think it's such a separate problem. If you've got a set of authorization primitives, you should have some simple and foolproof way of applying them to various usecases. You might have the best policy description language and very fast evaluation, but what good is it as a central authz service when you can't securely implement s…

> From what I can see, Zanzibar is also intended for "row-level" access checks.

Yes, as a primitive for storing acl relations, not as a magic solves all security problems tool.

I thought about this more, and I think your usecase is simply unsolvable. You're allowing an untrusted user to take speculative action on something they may not have access to.

This is the same problem as spectre (and similarly unfixable). You'd need to do the acl-checks per row prior to the checks on the internal data. That is, as part of the operation `WHERE id = 123`, you need the database engine to check that you have access to the row, and only if they are acl'd, allow the check against X > 100. Otherwise, just pretend that id=123 isn't in the database.

Of course, this is a simple case, I expect that more complicated cases may not be solvable at all. Like I think the correct way is to say that certain (and perhaps all except the primary key) columns need authorization prior to access.

This is, I think, entirely a database implementation question, and ultimately has nothing to do with Zanzibar itself.

So to answer your question

> what good is it as a central authz service when you can't securely implement search on top of it?

You can, you just can't do it in the way you've described. Its a difficult problem that the central authz service shouldn't solve, and the design of this service is still faster than all of the others.

Re: Zanzibar: Google’s Consistent, Global Authorization System (2019)

#98

Post by amitkanfer »

thinkharderdev wrote: post #14
gneray wrote: post #6

I'm curious what's driving the resurgence in interest authorization infrastructure, particularly the Zanzibar paper. As founder of Oso ( https://www.osohq.com/ ), I have my own opinions, and I think this is a good thing. But would love to hear others' points of view here.

My guess is that it is mainly driven by the increasing adoption of microservice (or just generally more distributed architectures). Doing fine-grained authorization in that type of architecture quite difficult and people are starting to realize that.

Agree. That and the fact that customers today are more sophisticated, requiring their vendors to provide the ability to create custom "roles" and "permissions" in the used applications.
Post reply on HN