Why Google Zanzibar shines at building authorization
blog.warrant.dev
Why Google Zanzibar shines at building authorization
1–10 of 91 posts
Re: Why Google Zanzibar shines at building authorization
#2How does Zanzibar relate to capability-based schemes?
Re: Why Google Zanzibar shines at building authorization
#3How does Zanzibar relate to capability-based schemes?
Have you seen authzed's caveats?
Re: Why Google Zanzibar shines at building authorization
#4How does Zanzibar relate to capability-based schemes?
As I understand it, "capabilities" in capability-based schemes uniquely reference an object and specify a list of access rights on that object. This seems fairly similar to tuples in Zanzibar, which reference a unique object, an access right, and a unique subject whom the access right belongs to. You can think of Zanzibar as a layer used for defining, storing, and querying for capabilities.
Re: Why Google Zanzibar shines at building authorization
#5> A Flexible, Uniform Data Model for Authorization
Are there good examples of similar applications of data modules for similarly niche use cases? I get that there are obviously endless data models, but this seems to extend beyond that into a more integrated concept and I don’t quite know why that seems to be the case.
Re: Why Google Zanzibar shines at building authorization
#6How does Zanzibar relate to capability-based schemes?
Another interesting feature of capability-based systems (that is outside Zanzibar's scope) is that capabilities can themselves be used to gain access to an object. This is because they are unforgeable tokens, meaning they essentially have authentication baked into them. Zanzibar leaves the authentication piece to an external service and focuses on providing the ability to define, store, and query access rights for subjects.
Re: Why Google Zanzibar shines at building authorization
#7We successfully used a Relationship-based Authorization System based on the Zanzibar paper at my last job building a B2B SaaS leaning heavily on cross-company integration.
The flexibility in defining rules through tuples helped us iterate rapidly on new product features. We used self-hosted Ory Keto [0] instances as the implementation, though we would have preferred a managed solution. We were checking out Auth0 Fine Grained Authorization [1] but it was still in Alpha back then.
[0]: https://www.ory.sh/keto/ [1]: https://auth0.com/developers/lab/fine-grained-authorization
Re: Why Google Zanzibar shines at building authorization
#8[flagged]
Re: Why Google Zanzibar shines at building authorization
#9[flagged]
Google doesn't actually offer Zanzibar as a product/service (in GCP or otherwise) to customers. However, they do use it internally to manage permissions across their various products (Google Docs, Drive, YouTube, etc.) and have had a lot of success doing so. Because of that, there are many open source implementations of Zanzibar out there (as others have commented). Warrant also maintains our own open source implementation of Zanzibar[1] which powers our managed cloud offering, Warrant Cloud[2].
Re: Why Google Zanzibar shines at building authorization
#10[flagged]
The actual implementation is closed source. The backing idea is described in the inaugural paper which third parties have used to build hosted and open source alternatives that you can try.