3 ms·

What do other large (non-google scale) to medium companies use for authorization? Can anyone recommend open source (preferably) or close source products?

MrSaints 7y ago
A pretty simple, and configurable one: https://github.com/casbin/casbin https://github.com/casbin/casbin
ucarion 7y ago
https://github.com/ory/ladon https://github.com/ory/ladon is an option. Essentially, it imposes a lot of the fine-grained access control model on you, but then it's up to you to implement the actual database/business-logic layer [1] as well as the API layer to actually expose the service. [1] You do so by implementing this interface: https://github.com/ory/ladon/blob/master/warden.go https://github.com/ory/ladon/blob/master/warden.go
jamafu 7y ago
We use Keycloak at our place and are really happy with it. Website: https://www.keycloak.org/ https://www.keycloak.org/ GitHub: https://github.com/keycloak/keycloak https://github.com/keycloak/keycloak
- dusty_mc_dusty 7y ago
  Jup, it's quite nice!
perlgeek 7y ago
There's also Open Policy Agent (OPA) https://github.com/open-policy-agent/opa https://github.com/open-policy-agent/opa
gen220 7y ago
We use LDAP for managing group memberships (i.e. person x is a member of `engineering` and `eng_team_y`; only members of `eng_team_y` can change the deployment status of service Z). We then define ACLs for these groups. IDK how they are enforced, but they're visible/malleable via Ansible recipes, such that the process of adding permissions for your group (or user) involves submitting a diff to said Ansible recipe and getting approval from an SRE. In practice, we use Kerberos to obtain/distribute authorization tokens, which live for less than 24 hours. The authorization-value of these tokens is determined by the LDAP affinities of the bearer. If everything is configured correctly (which it always is, until you need new permissions / switch teams), all you have to do is auth with kerberos at the beginning of each day. We have ~200 engineers.

MrSaints 7y ago

A pretty simple, and configurable one: https://github.com/casbin/casbin https://github.com/casbin/casbin

ucarion 7y ago

https://github.com/ory/ladon https://github.com/ory/ladon is an option. Essentially, it imposes a lot of the fine-grained access control model on you, but then it's up to you to implement the actual database/business-logic layer [1] as well as the API layer to actually expose the service. [1] You do so by implementing this interface: https://github.com/ory/ladon/blob/master/warden.go https://github.com/ory/ladon/blob/master/warden.go

jamafu 7y ago

We use Keycloak at our place and are really happy with it. Website: https://www.keycloak.org/ https://www.keycloak.org/ GitHub: https://github.com/keycloak/keycloak https://github.com/keycloak/keycloak

dusty_mc_dusty 7y ago
Jup, it's quite nice!

perlgeek 7y ago

There's also Open Policy Agent (OPA) https://github.com/open-policy-agent/opa https://github.com/open-policy-agent/opa

gen220 7y ago

We use LDAP for managing group memberships (i.e. person x is a member of `engineering` and `eng_team_y`; only members of `eng_team_y` can change the deployment status of service Z). We then define ACLs for these groups. IDK how they are enforced, but they're visible/malleable via Ansible recipes, such that the process of adding permissions for your group (or user) involves submitting a diff to said Ansible recipe and getting approval from an SRE. In practice, we use Kerberos to obtain/distribute authorization tokens, which live for less than 24 hours. The authorization-value of these tokens is determined by the LDAP affinities of the bearer. If everything is configured correctly (which it always is, until you need new permissions / switch teams), all you have to do is auth with kerberos at the beginning of each day. We have ~200 engineers.