4 ms·
I've been using Open Policy Agent for this scenario with great success. You can either use it in a AZ as a service setup or embed it into middle ware for a sort
by DIVx0 5y ago
I've been using Open Policy Agent for this scenario with great success. You can either use it in a AZ as a service setup or embed it into middle ware for a sort of "decision making" library.
- mkdirp 5y agoAs in OPA determines if a user has access to a resource? Do you have some resources on how to do this?
- qbasic_forever 5y agoOPA has a whole policy language to define how people have access to resources however you please. See details here: https://www.openpolicyagent.org/docs/latest/policy-language/ https://www.openpolicyagent.org/docs/latest/policy-language/
- ogazitt 5y agoYou do need to have a strategy for how to load the resource mappings into the OPA engine. If they don't change very much you could embed them in the data.json file of the OPA policy itself. But more often than not, that data is changed often (e.g. when someone grants someone else access to a resource). In that case, you'll need the OPA engine to query an external data store via an HTTP request. Or you can use a resource cache, the way we do at Aserto. Here's a blog post [0] about the challenges we faced when using OPA for application authorization. [0] https://www.aserto.com/blog/the-challenges-of-using-opa-for-application-authorization https://www.aserto.com/blog/the-challenges-of-using-opa-for-...