Show HN: Topaz 0.30 – OSS authz service combining the best of OPA and Zanzibar • Hacker News Board

Show HN: Topaz 0.30 – OSS authz service combining the best of OPA and Zanzibar

#1

Post by ogazitt » Mon, Nov 06, 2023, 4:02 PM UTC

Hey folks! As Topaz turns a year old, we just released a big update, including support for a new authorization schema language, a built-in visual console, REST APIs for the ReBAC directory, a full test harness, and many other improvements.

Would love to get your feedback! Check out the blog post [0] for the complete details (including some cool screenshots), or clone / fork the repo here [1]. Many thanks!

[0] https://www.aserto.com/blog/announcing-topaz-030

[1] https://github.com/aserto-dev/topaz

Show HN: Topaz 0.30 – OSS authz service combining the best of OPA and Zanzibar
aserto.com

Re: Show HN: Topaz 0.30 – OSS authz service combining the best of OPA and Zanzibar

#2

Post by apoland » Mon, Nov 06, 2023, 4:16 PM UTC

Congrats to the Topaz team. This project has had some huge advancements since it launched last year.

Re: Show HN: Topaz 0.30 – OSS authz service combining the best of OPA and Zanzibar

#3

Post by milo_a_hoffman » Mon, Nov 06, 2023, 4:16 PM UTC

How does this compare to other CNCF solutions like OpenFGA and OPA?

Re: Show HN: Topaz 0.30 – OSS authz service combining the best of OPA and Zanzibar

#4

Post by ogazitt » Mon, Nov 06, 2023, 4:20 PM UTC

milo_a_hoffman wrote: post #3

How does this compare to other CNCF solutions like OpenFGA and OPA?

Thanks for the question! Those are both great projects. Topaz combines the best elements of both:

* It uses OPA as its decision engine and Rego as the policy language, and supports the "policy as code" methodology

* It also implements a ReBAC directory, much like OpenFGA, in the same container image. It goes further, by allowing you to store not just relationships between subjects and objects, but also properties... which makes it easy to author policies that combine attribute-based (ABAC) and relationship-based (ReBAC) rules.

Re: Show HN: Topaz 0.30 – OSS authz service combining the best of OPA and Zanzibar

#5

Post by milo_a_hoffman » Mon, Nov 06, 2023, 4:22 PM UTC

milo_a_hoffman wrote: post #3

How does this compare to other CNCF solutions like OpenFGA and OPA?

Today we are using OpenFGA and OPA together, as OPA does not provide a real solution managing our data and we only have a few real attribute based checks we need to make. OpenFGA is a nice data plane, but does not provide an attribute based solution, so we are http.Send integrating the two, which is not ideal.

Re: Show HN: Topaz 0.30 – OSS authz service combining the best of OPA and Zanzibar

#6

Post by gertd » Mon, Nov 06, 2023, 4:26 PM UTC

I love the fact it is bring relational and attribute based together, happy birthday Topaz !

Re: Show HN: Topaz 0.30 – OSS authz service combining the best of OPA and Zanzibar

#7

Post by gertd » Mon, Nov 06, 2023, 4:35 PM UTC

milo_a_hoffman wrote: post #5

milo_a_hoffman wrote: post #3

How does this compare to other CNCF solutions like OpenFGA and OPA?

Today we are using OpenFGA and OPA together, as OPA does not provide a real solution managing our data and we only have a few real attribute based checks we need to make. OpenFGA is a nice data plane, but does not provide an attribute based solution, so we are http.Send integrating the two, which is not ideal.

In simple terms topaz brings a rebac data solution together with OPA, so you only have to create attribute based authorization rules when really needed, to compliment the relation authorization provided by the topaz directory.

Re: Show HN: Topaz 0.30 – OSS authz service combining the best of OPA and Zanzibar

#8

Post by milo_a_hoffman » Mon, Nov 06, 2023, 4:38 PM UTC

gertd wrote: post #7

milo_a_hoffman wrote: post #5

Earlier quoted context omitted.

Today we are using OpenFGA and OPA together, as OPA does not provide a real solution managing our data and we only have a few real attribute based checks we need to make. OpenFGA is a nice data plane, but does not provide an attribute based solution, so we are http.Send integrating the two, which is not ideal.

In simple terms topaz brings a rebac data solution together with OPA, so you only have to create attribute based authorization rules when really needed, to compliment the relation authorization provided by the topaz directory.

I see it is a container based solution, is that a requirement, we (have to) run on Windows Server, can I run topaz without a container, just bare metal?

Re: Show HN: Topaz 0.30 – OSS authz service combining the best of OPA and Zanzibar

#9

Post by bradhe » Mon, Nov 06, 2023, 4:39 PM UTC

Been fun to watch this project progress. I have tried it out in a few apps before. Love the test harness, that's super useful!

Re: Show HN: Topaz 0.30 – OSS authz service combining the best of OPA and Zanzibar

#10

Post by gertd » Mon, Nov 06, 2023, 4:48 PM UTC

milo_a_hoffman wrote: post #8

gertd wrote: post #7

Earlier quoted context omitted.

In simple terms topaz brings a rebac data solution together with OPA, so you only have to create attribute based authorization rules when really needed, to compliment the relation authorization provided by the topaz directory.

I see it is a container based solution, is that a requirement, we (have to) run on Windows Server, can I run topaz without a container, just bare metal?

You can, simply use the topazd.exe binary from the topaz_windows_x86_64.zip from the GH releases page (https://github.com/aserto-dev/topaz/releases). Note this is currently not a Windows Service, so not net start topaz. Let me know if that would be interesting.