3 ms·

Author here. First of all thank you for making this article appear in the HN frontpage. I read some interesting comments and approaches but I feel that a piece

Author here. First of all thank you for making this article appear in the HN frontpage. I read some interesting comments and approaches but I feel that a piece is always missing (or maybe I did not understood). The piece of how the authorization fetches the necessary application data it needs in order to decide what to do. If you do not need this piece then you can get really creative on how to solve authorization and use an approach that fits best to the needs of your system. But if you do, then I would love to hear more details about this part.

ogazitt 5y ago
Great article! Disclaimer: I'm a co-founder of Aserto [0], where we're building a platform for API / microservices authorization. I couldn't agree more that the question of how to get the data to the policy decision point is one of the most interesting and hardest challenges for this scenario. You don't want to replicate the entire world in both your application's data store and your authorization system. But you also want to follow the principle of separation of concerns as much as practical. There may be scenarios where your authorization system has to make calls to an external system, but that can cause availability and latency concerns. Ideally the decision engine has all the data it needs to make an authorization decision, without having to query another system. For filtering scenarios that involve returning too much data to the client (which the client would need to filter locally), you could also imagine the authorization system doing a "partial evaluation" and return you an AST which you can walk and attach as "where clauses" to your query. Here's an interesting read on how to do this with the OPA decision engine. [1] [0] https://www.aserto.com https://www.aserto.com [1] https://blog.openpolicyagent.org/partial-evaluation-162750eaf422 https://blog.openpolicyagent.org/partial-evaluation-162750ea...

ogazitt 5y ago

Great article! Disclaimer: I'm a co-founder of Aserto [0], where we're building a platform for API / microservices authorization. I couldn't agree more that the question of how to get the data to the policy decision point is one of the most interesting and hardest challenges for this scenario. You don't want to replicate the entire world in both your application's data store and your authorization system. But you also want to follow the principle of separation of concerns as much as practical. There may be scenarios where your authorization system has to make calls to an external system, but that can cause availability and latency concerns. Ideally the decision engine has all the data it needs to make an authorization decision, without having to query another system. For filtering scenarios that involve returning too much data to the client (which the client would need to filter locally), you could also imagine the authorization system doing a "partial evaluation" and return you an AST which you can walk and attach as "where clauses" to your query. Here's an interesting read on how to do this with the OPA decision engine. [1] [0] https://www.aserto.com https://www.aserto.com [1] https://blog.openpolicyagent.org/partial-evaluation-162750eaf422 https://blog.openpolicyagent.org/partial-evaluation-162750ea...