keto

With great power comes great responsibility :) Having the flexibility to build persistence yourself is great, it comes at the cost and responsibility of continuously maintaining it! We have run into so, so many edge cases. Here are some examples: 1. What do you do when a user with email "foo@example.org" has already signed up, and now is trying to sign up using Google with "foo@example.org"? 2. How do you ensure that a user can update sensitive information (e.g. their recovery email address, or linking additional "Sign in with" providers) while keeping a balance between security and user experience? 3. What if you now want to add biometric auth for native mobile apps, or 2FA? The complexity in building your own is not starting with the first 10%. As your app and business grows, teams are faced with ever increasing requirements. Leaning on

Implementation of Google's Zanzibar: https://github.com/ory/keto

Sorry, w.r.t my second thought, how would this differ from something like Ory Keto[0] or Oath Keeper[1]? [0] https://github.com/ory/keto [1] https://github.com/ory/oathkeeper

I was surprised not to see a comparable evaluation to Ory Keto at all in this article. Ory Keto continued to evolve out of the shortcomings of OPA https://github.com/ory/keto/issues/47 . It's also based on Zanzibar, and it's used in production applications today. Cloud version coming soon (using cockroachdb) or use the open source version (postgres).

There is also Keto - an open source project based on the Zanzibar model [https://github.com/ory/keto]

Here’s an open source Zanzibar implementation: https://github.com/ory/keto Ory appears to offer a complete stack for the entire AuthN/AuthZ space: https://www.ory.sh (I haven’t used or evaluated this software)

There is an Open Source (Go) implementation of "Zanzibar" called Keto [0] that integrates with the rest of the Ory ecosystem. We are actually testing it and looks great so far. [0]: https://github.com/ory/keto

I was auditing Keto recently, I came across this discussion: https://github.com/ory/keto/issues/47 It's a impressive example of high functioning discourse: all the participants provide valuable insight, state concerns, elegantly summarize very complex issues, and show a lot of respect to each other; great gains are made as a result. It's worth reading in its entirety.

This is tracked here: https://github.com/ory/keto/issues/319 Basically the idea is to check the attributes before actually forwarding the request to Keto. That could be done through e.g. a OPA integration. This can scale much better IMO than just doing everything in OPA.

I went diving into the docs to find out how Keto implements Zanzibar's consistency guarantees, which for Zanzibar are provided mostly by Spanner, but it seems that Keto just does not[1]. This does not strike me as the kind of thing that can just be added after the project begins. https://github.com/ory/keto/blob/master/docs/docs/concepts/s...

OPA takes a whole different approach. They basically have a specific language and a corresponding interpreter. The previous version of Keto was based off of OPA. We discovered that it is not suitable for our needs and what we want to offer because it can be very hard to meet certain performance goals (e.g. https://github.com/ory/keto/issues/104) Taking this simple approach allows us to provide a global, low latency, and consistent authorization system.

Keycloak and Authelia try to solve everything at once. So you get user management, but you also need to use their template and plugin system (so Java for Keycloak) and you can't use a different OAuth2 provider because well - you use Keycloak. I really love the projects and they have their use cases - with Ory however, you simply pick what you need: - Login, registration, mfa, user management, password change, account recovery, ... - Ory Kratos: http://github.com/ory/kratos - Permission management, roles, who is allowed to do what - Ory Keto: http://github.com/ory/keto - OAuth2, OpenID Connect Provider that you "connect" to your user management (e.g. Ory Kratos) - Ory Hydra: http://github.com/ory/hydra - A "middleware" which checks if requests are authenticated (who is the caller?) and authorized (is the caller allowed to do that) - Ory Oa