4 ms·

Here’s an open source Zanzibar implementation: https://github.com/ory/keto https://github.com/ory/keto Ory appears to offer a complete stack for the entire Aut

by jitl 5y ago

Here’s an open source Zanzibar implementation: https://github.com/ory/keto https://github.com/ory/keto Ory appears to offer a complete stack for the entire AuthN/AuthZ space: https://www.ory.sh https://www.ory.sh (I haven’t used or evaluated this software)

bradleyjg 5y ago
I remember reading the Zanzibar paper (highly recommended) and it depended heavily on spanner—-especially its consistency latency guarantees—-for its nice properties. This looks more like an (in progress) api compatible competitor than a open source clone.
- jakemoshenko 5y ago
  At Authzed, our implementation builds on top of CockroachDB (inspired by spanner) to get those same latency and consistency guarantees. As you are someone else who has read the paper, we would love to get your feedback on how well we've captured the spirit.
  - bradleyjg 5y ago
    Do you have a white paper or something? I saw some good blog posts, but I’m interested particularly in the differences with Zanzibar especially those that are the necessary result of the differences between cockroach and spanner.
    - jakemoshenko 5y ago
      We don't have a white paper. I wrote about my particular interpretation of the Zanzibar paper[1]. As far as the differences due to cockroach vs spanner. There are only a few minor ones. Without TrueTime cockroachdb relies on their hybrid logical clocks[2] which at the very least require more storage. The Zanzibar paper talks about separating tuples into separate databases by namespace, and shards [3§3.1.1]. We haven't had to do that yet, but we are far from operating at Google's scale. Finally, cockroachdb's CHANGEFEED API[4] combined with our single tuple table have allowed us to skip storing a separate changelog table (for now). [1]: https://authzed.com/blog/what-is-zanzibar/ https://authzed.com/blog/what-is-zanzibar/ [2]: https://www.cockroachlabs.com/blog/living-without-atomic-clocks/ https://www.cockroachlabs.com/blog/living-without-atomic-clo... [3]: https://research.google/pubs/pub48190/ https://research.google/pubs/pub48190/ [4]: https://www.cockroachlabs.com/docs/v20.2/changefeed-for.html https://www.cockroachlabs.com/docs/v20.2/changefeed-for.html
rad_gruchalski 5y ago
It's not complete (no rewrites) and does not provide RBAC component out of the box. It has the pieces but one has to put stuff together themselves. I have written more about it: https://gruchalski.com/posts/2021-05-15-rbac-with-ory-keto/ https://gruchalski.com/posts/2021-05-15-rbac-with-ory-keto/.

by jitl 5y ago

bradleyjg 5y ago

I remember reading the Zanzibar paper (highly recommended) and it depended heavily on spanner—-especially its consistency latency guarantees—-for its nice properties. This looks more like an (in progress) api compatible competitor than a open source clone.

jakemoshenko 5y ago
At Authzed, our implementation builds on top of CockroachDB (inspired by spanner) to get those same latency and consistency guarantees. As you are someone else who has read the paper, we would love to get your feedback on how well we've captured the spirit.
- bradleyjg 5y ago
  Do you have a white paper or something? I saw some good blog posts, but I’m interested particularly in the differences with Zanzibar especially those that are the necessary result of the differences between cockroach and spanner.
  - jakemoshenko 5y ago
    We don't have a white paper. I wrote about my particular interpretation of the Zanzibar paper[1]. As far as the differences due to cockroach vs spanner. There are only a few minor ones. Without TrueTime cockroachdb relies on their hybrid logical clocks[2] which at the very least require more storage. The Zanzibar paper talks about separating tuples into separate databases by namespace, and shards [3§3.1.1]. We haven't had to do that yet, but we are far from operating at Google's scale. Finally, cockroachdb's CHANGEFEED API[4] combined with our single tuple table have allowed us to skip storing a separate changelog table (for now). [1]: https://authzed.com/blog/what-is-zanzibar/ https://authzed.com/blog/what-is-zanzibar/ [2]: https://www.cockroachlabs.com/blog/living-without-atomic-clocks/ https://www.cockroachlabs.com/blog/living-without-atomic-clo... [3]: https://research.google/pubs/pub48190/ https://research.google/pubs/pub48190/ [4]: https://www.cockroachlabs.com/docs/v20.2/changefeed-for.html https://www.cockroachlabs.com/docs/v20.2/changefeed-for.html

rad_gruchalski 5y ago

It's not complete (no rewrites) and does not provide RBAC component out of the box. It has the pieces but one has to put stuff together themselves. I have written more about it: https://gruchalski.com/posts/2021-05-15-rbac-with-ory-keto/ https://gruchalski.com/posts/2021-05-15-rbac-with-ory-keto/.