27 ms·

Rule #2 sounds dumb. If there can't be a single source of truth, for let's say permission checking, that multiple other services relay on, how would you solve t

by Perz1val 10mo ago

Rule #2 sounds dumb. If there can't be a single source of truth, for let's say permission checking, that multiple other services relay on, how would you solve that? Replicate it everywhere? Or do you allow for a new business requirement to cause massive refactors to just create a new root in your fancy graph?

kaashif 10mo ago
This is exactly the example I thought of and came here to post. The rule is obviously wrong. I think just having no cycles is good enough as a rule.
jayd16 10mo ago
Services handle the permissions of their own features. Authentication is handled at the gateway. Not sure if I agree its really the best way to do things but it can be done.
- solid_fuel 10mo ago
  That implies that every service has a `user -> permissions` table, no? That seems to contradict the idea brought up elsewhere in the thread that microservices should all be the size of one table.
  - whstl 10mo ago
    Well, depends on the permission model. For RBAC or capability-based permissions, the gateway can enrich the request or the it can be in (eg) a JWT. Then each service only has to know how to map roles/capabilities to permissions. For ABAC it depends on lots of things, but you often evaluate access based on user attributes and context (which once again can be added to the request or go into the JWT) plus resource attributes (which is already in the microservice anyway). For ACL you would need a list of users indeed... Something like Google Zanzibar can theoretically live on the gateway and apply rules to different routes. Dunno how it would deal with lists, though. After writing it down: sounds like an awful lot of work for a lot of cases. Btw: the rule for microservices that I know of, is that they must have their own database, not their own table.
    - jschorr 10mo ago
      Dealing with lists is complicated with ReBAC, but possible. See my other comment on this: https://news.ycombinator.com/item?id=45662850 https://news.ycombinator.com/item?id=45662850
    - solid_fuel 10mo ago
      Good points about RBAC and ABAC, although my concern is now the gateway must know what capabilities are possible within the service. It seems like a lot of work, indeed. > the rule for microservices that I know of, is that they must have their own database, not their own table. That's the rule for microservices that I'm familiar with too, which is why I found the assertion elsewhere that microservices should just be "one table" pretty odd. The simplest path is often auth offloaded onto STS or something like that with more complicated permissions needs handled by the services internally, if necessary (often it's not needed).

kaashif 10mo ago

This is exactly the example I thought of and came here to post. The rule is obviously wrong. I think just having no cycles is good enough as a rule.

jayd16 10mo ago

Services handle the permissions of their own features. Authentication is handled at the gateway. Not sure if I agree its really the best way to do things but it can be done.

solid_fuel 10mo ago
That implies that every service has a `user -> permissions` table, no? That seems to contradict the idea brought up elsewhere in the thread that microservices should all be the size of one table.
- whstl 10mo ago
  Well, depends on the permission model. For RBAC or capability-based permissions, the gateway can enrich the request or the it can be in (eg) a JWT. Then each service only has to know how to map roles/capabilities to permissions. For ABAC it depends on lots of things, but you often evaluate access based on user attributes and context (which once again can be added to the request or go into the JWT) plus resource attributes (which is already in the microservice anyway). For ACL you would need a list of users indeed... Something like Google Zanzibar can theoretically live on the gateway and apply rules to different routes. Dunno how it would deal with lists, though. After writing it down: sounds like an awful lot of work for a lot of cases. Btw: the rule for microservices that I know of, is that they must have their own database, not their own table.
  - jschorr 10mo ago
    Dealing with lists is complicated with ReBAC, but possible. See my other comment on this: https://news.ycombinator.com/item?id=45662850 https://news.ycombinator.com/item?id=45662850
  - solid_fuel 10mo ago
    Good points about RBAC and ABAC, although my concern is now the gateway must know what capabilities are possible within the service. It seems like a lot of work, indeed. > the rule for microservices that I know of, is that they must have their own database, not their own table. That's the rule for microservices that I'm familiar with too, which is why I found the assertion elsewhere that microservices should just be "one table" pretty odd. The simplest path is often auth offloaded onto STS or something like that with more complicated permissions needs handled by the services internally, if necessary (often it's not needed).