keto

There are quite a few OSS Zanzibar-inspired authorization services/servers: - SpiceDB (https://github.com/authzed/spicedb) - Permify (https://github.com/Permify/permify) - Warrant (https://github.com/warrant-dev/warrant) - Ory Keto (https://github.com/ory/keto)

One of Ory’s core competencies is permissions. We built the first Google Zanzibar implementation in the world and it’s part of Ory Network‘s global multi-region platform (https://github.com/ory/keto) A push model is also valid if you’re heavy on policies and can accept eventual consistency. We will investigate how to generally push things to the edge (like we did with Ory Edge Sessions) or to cryptographic verification wherever staleness is acceptable. By solving the primitives correctly in the beginning (with a multi region architecture) that job does become a lot easier, which is what we decided doing at Ory :)

slightly off-topic, but related to what ory is doing in general. How do you usually do authorization-aware search? Imagine, I have a bunch of Google docs and using https://github.com/ory/keto for authorization. I can quickly answer the question "does user X have access to document Y", but it is not easy to do "search all documents with word Hello in it, for which I have access" because access can be granted through nested groups (give read access to everyone in DepartmentA, and I am part of child department)

How does Warrant compare to other Zanzibar based solutions like Ory Keto ?https://github.com/ory/keto

Interesting to see another project open sourced around Google Zanzibar. On a timeline for context: - Ory came out first with Ory Keto ( https://github.com/ory/keto ) which is trying to be a close adaptation of the paper. Initially, many concepts were missing but they are making a lot of progress with the DSL and it interfaces with the rest of Ory (OAuth2, User Mangement) - Authzed came out as a SaaS only, open sorucing the code base later on at https://github.com/authzed/spicedb - Auth0 has been playing around with Zanzibar concepts in various forms and published a beta service at https://dashboard.fga.dev - apparently now also open source parts of it similar to what Authzed did: https://github.com/openfga - Permify - who on a side note spammed me quite a lot with outreach because I was active in these communities - joins as well https://

The system is API only (headless) but we have reference implementations available. For a management UI you can use Ory Cloud :) For permissions, that’s a different service: https://github.com/ory/keto

With great power comes great responsibility :) Having the flexibility to build persistence yourself is great, it comes at the cost and responsibility of continuously maintaining it! We have run into so, so many edge cases. Here are some examples: 1. What do you do when a user with email "foo@example.org" has already signed up, and now is trying to sign up using Google with "foo@example.org"? 2. How do you ensure that a user can update sensitive information (e.g. their recovery email address, or linking additional "Sign in with" providers) while keeping a balance between security and user experience? 3. What if you now want to add biometric auth for native mobile apps, or 2FA? The complexity in building your own is not starting with the first 10%. As your app and business grows, teams are faced with ever increasing requirements. Leaning on

Implementation of Google's Zanzibar: https://github.com/ory/keto

Sorry, w.r.t my second thought, how would this differ from something like Ory Keto[0] or Oath Keeper[1]? [0] https://github.com/ory/keto [1] https://github.com/ory/oathkeeper

I was surprised not to see a comparable evaluation to Ory Keto at all in this article. Ory Keto continued to evolve out of the shortcomings of OPA https://github.com/ory/keto/issues/47 . It's also based on Zanzibar, and it's used in production applications today. Cloud version coming soon (using cockroachdb) or use the open source version (postgres).

There is also Keto - an open source project based on the Zanzibar model [https://github.com/ory/keto]

Here’s an open source Zanzibar implementation: https://github.com/ory/keto Ory appears to offer a complete stack for the entire AuthN/AuthZ space: https://www.ory.sh (I haven’t used or evaluated this software)

There is an Open Source (Go) implementation of "Zanzibar" called Keto [0] that integrates with the rest of the Ory ecosystem. We are actually testing it and looks great so far. [0]: https://github.com/ory/keto

I was auditing Keto recently, I came across this discussion: https://github.com/ory/keto/issues/47 It's a impressive example of high functioning discourse: all the participants provide valuable insight, state concerns, elegantly summarize very complex issues, and show a lot of respect to each other; great gains are made as a result. It's worth reading in its entirety.

This is tracked here: https://github.com/ory/keto/issues/319 Basically the idea is to check the attributes before actually forwarding the request to Keto. That could be done through e.g. a OPA integration. This can scale much better IMO than just doing everything in OPA.