6 ms·

Can anyone give me a Google Zanzibar for dummies? It's the first I'm hearing about it. Is it Oauth for everything?

kyrra 6y ago
OAuth is just an identity tool (to say a login is a certain person). Zanzibar can be seen more as a ACL system that you can put across your system. So it is there to validate that a given user is able to access any specific resource.
- robertlagrant 6y ago
  OAuth(2) are for access delegation. They are not for authentication or identity. For this reason, OIDC was built on top.
throwaway3699 6y ago
It is authorization (as opposed to authentication).
jakemoshenko 6y ago
It's a really well designed distributed system for calculating access control decisions at scale. It makes a specific authorization CAP tradeoff that allows for consistency around access checks to different "versions" of a piece of content, allowing older content to be protected by checks served from read replicas and cache. Full disclosure: I am a co-founder of a company building and hosting a Zanzibar implementation as a service: https://authzed.com https://authzed.com
- deadmutex 6y ago
  > really well designed distributed system Since you're an expert in this area, and I am lazy... :) What makes it well designed? What are the top 2 or 3 things it does to make it a really well designed system?
- kleton 6y ago
  Is Zanzibar ganpati?
  - tazjin 6y ago
    No. Ganpati is a system that provides user & group information (not ACLs themselves), but it's only sort of related to Zanzibar.
- nickthemagicman 6y ago
  Thank you! How does it integrate with apps it controls? Are there libraries? Or does it provide a data format to implement in the app you're working on?
  - jschorr 6y ago
    Hi Nick, In the case of Authzed, we provide a gRPC API [0] which can be used from any application or language that supports gRPC, as well as designed client libraries for specific languages [1] to make integration even easier. Applications primarily integrate by making Check requests [2] at any point in which a protected resource is being accessed and Write requests [3] at any point in which permissions are granted or removed. Source: I am the third cofounder at https://authzed.com https://authzed.com :) [0]: https://docs.authzed.com/api/overview https://docs.authzed.com/api/overview [1]: https://docs.authzed.com/lang/lib-index https://docs.authzed.com/lang/lib-index [2]: https://docs.authzed.com/api/check https://docs.authzed.com/api/check [3]: https://docs.authzed.com/api/write https://docs.authzed.com/api/write
    - nickthemagicman 6y ago
      Awesome! Thank you! That makes sense. That's very interesting.

OAuth is just an identity tool (to say a login is a certain person). Zanzibar can be seen more as a ACL system that you can put across your system. So it is there to validate that a given user is able to access any specific resource.

robertlagrant 6y ago
OAuth(2) are for access delegation. They are not for authentication or identity. For this reason, OIDC was built on top.

throwaway3699 6y ago

It is authorization (as opposed to authentication).

jakemoshenko 6y ago

It's a really well designed distributed system for calculating access control decisions at scale. It makes a specific authorization CAP tradeoff that allows for consistency around access checks to different "versions" of a piece of content, allowing older content to be protected by checks served from read replicas and cache. Full disclosure: I am a co-founder of a company building and hosting a Zanzibar implementation as a service: https://authzed.com https://authzed.com

deadmutex 6y ago
> really well designed distributed system Since you're an expert in this area, and I am lazy... :) What makes it well designed? What are the top 2 or 3 things it does to make it a really well designed system?
kleton 6y ago
Is Zanzibar ganpati?
- tazjin 6y ago
  No. Ganpati is a system that provides user & group information (not ACLs themselves), but it's only sort of related to Zanzibar.
nickthemagicman 6y ago
Thank you! How does it integrate with apps it controls? Are there libraries? Or does it provide a data format to implement in the app you're working on?
- jschorr 6y ago
  Hi Nick, In the case of Authzed, we provide a gRPC API [0] which can be used from any application or language that supports gRPC, as well as designed client libraries for specific languages [1] to make integration even easier. Applications primarily integrate by making Check requests [2] at any point in which a protected resource is being accessed and Write requests [3] at any point in which permissions are granted or removed. Source: I am the third cofounder at https://authzed.com https://authzed.com :) [0]: https://docs.authzed.com/api/overview https://docs.authzed.com/api/overview [1]: https://docs.authzed.com/lang/lib-index https://docs.authzed.com/lang/lib-index [2]: https://docs.authzed.com/api/check https://docs.authzed.com/api/check [3]: https://docs.authzed.com/api/write https://docs.authzed.com/api/write
  - nickthemagicman 6y ago
    Awesome! Thank you! That makes sense. That's very interesting.