kkajla

6 ms·

1.
by kkajla 3y ago
> I prefer to have the entitlement itself just store the expiration date and the details about what entitlements the subscription grants during the time period it is active. The billing system can store the subscription and sync back to
2.
Warrant Query Language – A query language for permissions(blog.warrant.dev)
3 points by kkajla 3y ago|0 comments
3.
Warrant Launch Week – Day 1(blog.warrant.dev)
3 points by kkajla 3y ago|0 comments
4.
What Is Role Based Access Control (RBAC)?(warrant.dev)
2 points by kkajla 3y ago|0 comments
5.
Attribute Based Access Control (ABAC) Explained(warrant.dev)
2 points by kkajla 3y ago|0 comments
6.
Relationship Based Access Control (ReBAC) Explained(warrant.dev)
3 points by kkajla 3y ago|0 comments
7.
by kkajla 3y ago
That's fair and also why I believe a complete authz solution needs some elements of both.
8.
by kkajla 3y ago
I would describe this debate more as Policy-as-Data (Zanzibar) vs Policy-as-Code (OPA et al). In Zanzibar, all of the information required to make an authorization decision (namespaces, relationship tuples, etc.) is stored in Zanzibar, and
9.
Show HN: Open-Source, Google Zanzibar Inspired Authorization Service(github.com)
7 points by kkajla 3y ago|0 comments
10.
by kkajla 3y ago
> though we would have preferred a managed solution We completely agree here, which is why we initially started out with our managed cloud offering, Warrant Cloud[1]. While Zanzibar is powerful, operating it with solid latency/avail
11.
by kkajla 3y ago
At Google, I believe some client applications build and maintain "permission-aware" search indexes based on the permissions in Zanzibar. In essence, Zanzibar can be queried to figure out the object ids a particular subject has acc
12.
by kkajla 3y ago
Apologies for the confusion! Maybe an interesting idea for us to explore next :P
13.
by kkajla 3y ago
You've highlighted a very important part of the paper. A lot of the external consistency guarantees provided by Zanzibar are facilitated by Spanner and its TrueTime mechanism. Warrant doesn't currently support/use Spanner. Ho
14.
by kkajla 3y ago
I think GraphQL might be a good example. Some might not consider it to be very niche, but its intention is to consolidate dependent API queries such that the client can fetch all the data it needs in a single request. In both Zanzibar and G
15.
by kkajla 3y ago
Google doesn't actually offer Zanzibar as a product/service (in GCP or otherwise) to customers. However, they do use it internally to manage permissions across their various products (Google Docs, Drive, YouTube, etc.) and have ha
16.
by kkajla 3y ago
Another interesting feature of capability-based systems (that is outside Zanzibar's scope) is that capabilities can themselves be used to gain access to an object. This is because they are unforgeable tokens, meaning they essentially h
17.
by kkajla 3y ago
As I understand it, "capabilities" in capability-based schemes uniquely reference an object and specify a list of access rights on that object. This seems fairly similar to tuples in Zanzibar, which reference a unique object, an a
18.
Why Google Zanzibar shines at building authorization(blog.warrant.dev)
205 points by kkajla 3y ago|87 comments
19.
Authorization Explained(warrant.dev)
3 points by kkajla 4y ago|0 comments
20.
What Is Multitenancy?(warrant.dev)
2 points by kkajla 4y ago|0 comments
21.
by kkajla 4y ago
That's definitely one of the more complicated problems. One way we've considered approaching it is to allow customers to attach metadata to resources they manage via Warrant and allow them to query (or search) against this metadat
22.
by kkajla 4y ago
Thanks! As a developer myself, I've loved seeing companies like Stripe, Plaid, Auth0, etc. build solutions to hairy technical problems catered to developers. In my experience, technical leaders (decision makers) always looked to their
23.
by kkajla 4y ago
Love what you're building at Clerk! Would love to work together. Will reach out!
24.
by kkajla 4y ago
Really appreciate the balanced feedback. I don't quite agree that rolling your own authz is that simple (especially fine-grained / resource-based authz), but I understand your other concerns, and we'll work to address them. A
25.
by kkajla 4y ago
Completely agree re: UI components. As a full stack engineer, I personally dealt with the pain of permissions on the frontend and want to make things much easier than they are today. We've already started working on this. Our first for
26.
by kkajla 4y ago
As others have mentioned, solutions like Cognito and Auth0 are primarily focused on providing authentication (authn) and stop at basic RBAC when it comes to authorization (authz). Many companies quickly outgrow RBAC or need more powerful au
27.
Show HN: Open Source Edge Proxy for Low Latency Distributed Authorization(github.com)
7 points by kkajla 4y ago|0 comments
28.
by kkajla 4y ago
It's interesting to see this project published shortly after our launch of Warrant Sync[0][1], an automatic data-syncing solution for Warrant's authorization service. [0]: https://blog.warrant.dev/introducing-sync&
29.
Implementing Role-Based Access Control with Warrant and Postman(blog.postman.com)
3 points by kkajla 4y ago|0 comments
30.
Storing Access Policies in Policy Files vs. a Policy Database(blog.warrant.dev)
4 points by kkajla 4y ago|0 comments

More ›