8 ms·
Permission Systems for Enterprise That Scale
- bencyoung 9mo agoIf you're using Postgres then using the ltree module is great for permission systems. Available in RDS too
- casper14 9mo agoCould you explain why this is great over alternatives?
- nh2 9mo agoDo you have an article about that?
- bencyoung 8mo agoSorry for the delay! It's fairly simple. 1. You have a column on your objects you want secured as an LTREE[] 2. You add a GIST index on that column The values should be the different hierarchy paths to access the object starting with a "type" e.g departments.root.deptA When you run a query, depending on how you want to access you use a <@ query. E.g. I'm a user with root access to all depts "col <@ 'departments.root'::ltree" or I'm a user in dept A "col <@ 'departments.root.deptA'::ltree" etc
- calderwoodra 9mo agoAgreed, specifically for the file structure use-case, we were able to solve this with ltree.
- amcvitty 9mo agoAbout to embark on a similar project. Would love to hear any insights you can share!
- bencyoung 8mo agoSorry for the delay! It's fairly simple. 1. You have a column on your objects you want secured as an LTREE[] 2. You add a GIST index on that column The values should be the different hierarchy paths to access the object starting with a "type" e.g departments.root.deptA When you run a query, depending on how you want to access you use a <@ query. E.g. I'm a user with root access to all depts "col <@ 'departments.root'::ltree" or I'm a user in dept A "col <@ 'departments.root.deptA'::ltree" etc
- deleted 9mo ago[deleted]
- charcircuit 9mo ago>We added a point of failure, as the permissions table can get out of sync with the actual data. >The main risk with pre-computed permissions is data getting out of sync. It would make sense to have permissions be a first class concept for databases and to ensure such a desync could never happen. Data being only read or written from specific users is a very common thing for data so it would be worth having first class support for it.
- valiant55 9mo agoI'm struggling to understand what the issue that the author is getting at. The point of a database is that it's ACID compliant, wrap insets/updates/deletes in a transaction and no such drift would occur. What am I missing?
- charcircuit 9mo agoI don't think you are missing anything. I think he is just pointing out that technically nothing is enforcing this synchronization, so if someone forgets to wrap things in a transaction, it could get out of sync.
- eliocs 9mo agoI just want to point out you have to take care about that, yes you can have a trigger or a transaction to make sure it happens but it isn't there out of the box
- ahsisibssbx 9mo agoDepending on your DBMS and isolation level, using a transaction might not fix things. That being said I don’t think (at least for Postgres) most people are using an isolation level that could cause this. Much more likely I think is that you can’t use the db to prevent invalid states here (unique constraint, etc) and you’re dependent on other areas of the code correctly implementing concurrency controls. Race condition in resource A causes problems in your permissions table now. And just from a general engineering perspective, you should assume things are going to fail and assess what your path forward looks like when they do. Recovery script sounds like a good idea for a critical area.
- tekkk 9mo agoStrange the article proposes itself for "Enterprise" yet has no mention of Google's Zanzibar and how it compares to the other approaches. AFAIK it doesn't use pre-computed values but just queries really fast (using Spanner so there's that)
- smarx007 9mo agoAnd https://projects.eclipse.org/projects/technology.biscuit https://projects.eclipse.org/projects/technology.biscuit
- eliocs 9mo agoCan you let me know how would you for example query all accessible resources for a user using Google's Zanzibar?
- phrotoma 9mo agoRelated: if anyone has a method of achieving this query against GCP resources I'd be keen to learn that as well.
- jschorr 9mo agoWe actually have users that synchronize their resources from various sources (AWS, Kubernetes, etc) into SpiceDB, explicitly so they can perform these kinds of queries! One of the major benefits of a centralized authorization system is allowing for permissions queries across resources and subjects from multiple different services/sources (of course, with the need to synchronize the data in) Happy to expand on how some users do so, if you're curious.
- jschorr 9mo agoIn SpiceDB, this is known as the LookupResources [1] API, which returns all resources (of a particular type) that a particular subject (user in this case) has a particular permission on. We have a guide on doing ACL-aware filtering and listing [2] with this API and describing other approaches for larger Enterprise scales Disclaimer: I'm the co-founder and CTO of AuthZed, we develop SpiceDB, and I wrote our most recent implementation of LookupResources [1]: https://buf.build/authzed/api/docs/main:authzed.api.v1#authzed.api.v1.PermissionsService.LookupResources https://buf.build/authzed/api/docs/main:authzed.api.v1#authz... [2]: https://authzed.com/docs/spicedb/modeling/protecting-a-list-endpoint https://authzed.com/docs/spicedb/modeling/protecting-a-list-...
- Xmd5a 9mo agohttps://docs.feldera.com/use_cases/fine_grained_authorization/intro/ https://docs.feldera.com/use_cases/fine_grained_authorizatio... Fine-grained authorization as an incremental computation problem
- ExoticPearTree 9mo agoAnother approach to complex requirements without spending a lot of time querying databases is to use bitmaps. A set of permissions can be expressed through a bitmap and all you need to do in code is to "decode" that to what you actually let the user do. The downside to this approach is that it requires some planning and to maintain in code what mask retrieves what permission(s).
- the_arun 9mo agoIsn’t Open Policy Agent (OPA) and Zanzibar not good enough to be in the article or author talking about specific permission controls?
- samarthr1 9mo agoMy understanding is that Zanzibar is not usable as is for enterprises to use in their software? And that it is an internal google system?
- bitweis 9mo agoPermit.io Scales both on the tech, and on the human side - e.g. your product manager can add roles (with CI approval) without requiring engineering involvement. (I'm biased but still true)
- afiori 9mo agoI only did a quick read of permit.io offering but iirc they don't focus on hierarchical data. If having access to a resource cannot grant access to unbounded number of other independent resources (eg sharing a folder) then almost all issues of the article disappear
- bitweis 9mo agotoo quick man, it's a key feature: https://www.permit.io/rebac https://www.permit.io/rebac
- julik 9mo agoInteresting article, but it mixes up two concerns, I would say. One is retrieving trees from the DB and storing them - which can be annoying but has nothing to do with permissions. Another one is "hiding" unpermitted nodes/branches from the viewer (if that is what applying permissions is about - it can also handle read-only things, for instance). If these two concepts get separated and it is not a big deal to "overfetch" for the current user before doing the filtering - things become way easier. When the tree is reconstructed, you can do breadth-first traversal and compute permissions for every item in there - or retrieve the permissions for items at that level, if you are doing ACL stuff. From there - if there is no permission for the current viewer on that node - you exclude it from further scans and you do not add its' children to further traversals as you go down. Max. number of scans = tree depth. With some PG prowess you could even fold this into sophisticated SQL stuff. Trees with RDBMSes do stay a pain, though :-)