1 of 14

�The Laws of Externalized Authorization ��

Omri Gazitt

Co-founder & CEO, aserto.com

IIW 39, October 2024

2 of 14

About Me

Dev Tech, Cloud, IAM, startups, skiing

@omrig

omri@aserto.com

3 of 14

“n * m” problem

State of IAM

Identity

Access

“n + m” problem

OAuth2�OIDC

SAML

JWT

4 of 14

Authentication vs Authorization – developer perspective

Did the user prove they are who they say they are?

​

Standards: OAuth2, OpenID Connect, SAML, JWT

​

Developer services: Okta, Auth0, Azure AD, �AWS Cognito, PingID, OneLogin, …

What can the user do in the context of this app?

​

Standards: ?

​

Developer services: ?

​

Authentication

Authorization

Broken Access Control: #1 !!

Problems:

  • Bad security1
  • Inconsistency
  • Opportunity cost

(1) https://owasp.org/Top10/

5 of 14

Authorization is finally having its moment…

Zanzibar1

Himeji3

AuthZ2

Product Access Service5

AuthZ4

(1) https://research.google/pubs/pub48190/

(2) https://medium.com/intuit-engineering/authz-intuits-unified-dynamic-authorization-system-bea554d18f91

(3) https://medium.com/airbnb-engineering/himeji-a-scalable-centralized-system-for-authorization-at-airbnb-341664924574

(5) https://www.infoq.com/presentations/authorization-scalability/

(4) https://medium.com/building-carta/authz-cartas-highly-scalable-permissions-system-782a7f2c840f

6 of 14

…but has become a confusing landscape of technology

RBAC

LDAP

7 of 14

…and vendors

8 of 14

Externalized authorization enables a transformation…

Coarse-grained, tenant-level permissions��Authorization “spaghetti logic” embedded in the application��Permissions evaluated at login time, scopes embedded in access token

​

Fine-grained: resource-level permissions��Policy-based: authorization logic extracted out of the application��Real-time: permissions evaluated before granting access to resource

Traditional

Modern

WHAT

​

HOW

​

WHEN

​

Principle of least privilege

�Separation �of duties

�Continuous enforcement

9 of 14

Fine-grained access control evolution

Role-based Access Control: 1990’s-2000’s (LDAP, AD)

Is Bob in the sales-admin role?

RBAC

Relationship-based Access Control – 2020 (Zanzibar)

Does Eve have read access to this document if she’s in the �sales group, the document is in the sales folder, and the �sales group is in the “editor” relation on the sales folder?

ReBAC

Access Control Lists: 1980’s-1990’s (UNIX, NT CACL)

ACL

Does Alice have read access to this file?

Attribute-based Access Control: 2000’s-2010’s (XACML)

ABAC

Is Mallory in the sales department, is the document in �the sales folder, and is it currently working hours in the US?

10 of 14

Policy-based access management

Policy written in Rego (Open Policy Agent / Topaz)

Application code uses middleware to call authz service

Lift access control logic out of the application and into its own policy-as-code artifact

Store and version policy just like application code

​

Every policy change is part of a git changelog

​

Policy can be evolved by security team, decoupled from app

​

Policy can be built into an immutable image and signed�(https://github.com/opcr-io/policy)

11 of 14

Real-time access checks

Authorize locally

Manage centrally

  • Authorization is in the critical path of every application request
  • Requires 100% availability at milliseconds of latency
  • Must be deployed right next to the application / microservice
  • Compute decision using cached policy, user, and resource data
  • Control plane manages policies, user directory, resource data
  • Decision log collection and aggregation
  • High-speed event and data fabric between control plane and edge

Done correctly, authorization is a distributed systems problem

allowed?

true/false

Local Authorizer �(microservice or sidecar)

App �or API

Directory

Policy

Decision logs

Decision

Engine

Control Plane

Directory�users, groups, resources

Policy-as-code

Decision Logs

Identity providers

Logging systems

Source code repos

12 of 14

Modern authorization: open source landscape

​

​

+ CNCF graduated project, one single OSS implementation

+ general-purpose, flexible decision engine

+ built for PBAM & ABAC (similar to XACML)

​

- Datalog-derived logic-based language, high learning curve

- no help with modeling application authz (FGA / ReBAC)

- no help with getting user / resource data to the engine

“Policy as code” (ABAC)

​

​

+ opinionated authorization model

+ can model a relationship graph between subjects & objects

+ built for Google Docs style authorization (RBAC + ACL)

​

- at least half a dozen competing OSS implementations

- no common schema / data language

- hard to go outside strict ReBAC (e.g. attributes)

“Policy as data” (ReBAC)

🌟 🌟 https://github.com/aserto-dev/topaz 🌟 🌟

Topaz: “The best of both”

Open Policy Agent

Zanzibar-inspired projects

Alternatives:

Alternatives:

Casbin

13 of 14

The Laws of Authorization

Fine-grained

Policy-based

Real-time

Centrally managed

Compliance & forensics

Support a consistent model (RBAC, ABAC, ReBAC) that fits the application domain

Extract policy out of the app and into its own repo, and build into a signed image

Authorization is a local call, executing over fresh user / resource data

Policy and directory/resource data are centrally managed

Decision logs are aggregated and stored centrally

Developer-centric

Integrates easily

Cloud-native and open

Authorization with a single line of code

Identity providers, source code repos, artifact registries, logging systems

Ecosystem effects of using k8s-native technologies like Open Policy Agent, Topaz, OCI

14 of 14

The best of OPA and Zanzibar