6 ms·

CEO of Cerbos here - we'd love to hear about the other headaches everyone has faced. Authorization as we know it, isn't core to anyone's roadmap and we want to

by emreb 5y ago

CEO of Cerbos here - we'd love to hear about the other headaches everyone has faced. Authorization as we know it, isn't core to anyone's roadmap and we want to make it as easy as possible to meet the all the crazy requirements. We are building out examples of how to solve common use cases which you can find on https://cerbos.dev/ https://cerbos.dev/

throwoutway 5y ago
The architecture image on Cerbos makes it look like you pull stateful attributes from the primary sources (AD?). That doesn’t seem like it will scale well compared to cache or stateless designs. What TPS do you support? Response latency?
- emreb 5y ago
  Cerbos is stateless by design and was in fact born out of our experience of running services that handled 100k+ RPS with millisecond latency. It does not pull any data from other external sources, rather all the information required to make a decision is passed in the call to check if a request is authorized. Cerbos makes decisions based on the policies and the context provided at the request time. In most cases, the context is already in the services making the check. (it knows which user/principal and the resources that are being accessed). Because Cerbos makes decisions based on contextual data, caching is not very straightforward to implement. Response times are pretty good even without caching. We are constantly working on trying to find ways to make things quicker all the time and that may or may not involve caching. We are working on producing a reproducible and realistic benchmark for public consumption. In our internal tests, the 95th percentile response times have been always under 10ms. Of course, this depends a lot on how complex the policies are and how much data there is to process.
deleted 5y ago
[deleted]
thepra 5y ago
Will you build integration libraries or SDKs for the common programming languages and flows? In my case I'm with C# and use the dependency injection to get an instance of a service that verifies the user requests.
- alex-olivier 5y ago
  We are working through the priority list of SDKs. You can find them all on https://github.com/cerbos/ https://github.com/cerbos/ Node, Java and Go are already available and other languages are coming very soon.

by emreb 5y ago

throwoutway 5y ago

The architecture image on Cerbos makes it look like you pull stateful attributes from the primary sources (AD?). That doesn’t seem like it will scale well compared to cache or stateless designs. What TPS do you support? Response latency?

emreb 5y ago
Cerbos is stateless by design and was in fact born out of our experience of running services that handled 100k+ RPS with millisecond latency. It does not pull any data from other external sources, rather all the information required to make a decision is passed in the call to check if a request is authorized. Cerbos makes decisions based on the policies and the context provided at the request time. In most cases, the context is already in the services making the check. (it knows which user/principal and the resources that are being accessed). Because Cerbos makes decisions based on contextual data, caching is not very straightforward to implement. Response times are pretty good even without caching. We are constantly working on trying to find ways to make things quicker all the time and that may or may not involve caching. We are working on producing a reproducible and realistic benchmark for public consumption. In our internal tests, the 95th percentile response times have been always under 10ms. Of course, this depends a lot on how complex the policies are and how much data there is to process.

deleted 5y ago

[deleted]

thepra 5y ago

Will you build integration libraries or SDKs for the common programming languages and flows? In my case I'm with C# and use the dependency injection to get an instance of a service that verifies the user requests.

alex-olivier 5y ago
We are working through the priority list of SDKs. You can find them all on https://github.com/cerbos/ https://github.com/cerbos/ Node, Java and Go are already available and other languages are coming very soon.