SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions.

SpiceDB

an just retrieve the group memberships out of band

if you have a nice way of accessing your LDAP as-is, writing a small synchronization binary shouldn't be too difficult

```message CheckPermissionRequest {
    Consistency consistency = 1;
    // resource is the resource on which to check the permission or relation.
    ObjectReference resource = 2;
    // permission is the name of the permission (or relation) on which to execute
    // the check.
    string permission = 3;
    // subject is the subject that will be checked for the permission or relation.
    SubjectReference subject = 4;
    // additional relationships supplied by the client at query time.
    repeated Relationship dynamic_relationships = 5;
}```

what about adding `dynamic_relationships` to CheckPermissionRequest?

a kind of overlay on top of the graph in persistent storage

As an example, if I was using a JWT for AuthN that contains group memberships, I could provide those memberships as a list of Relationships along with the CheckPermissionRequest.

fundamentally or in the current implementation?

since the dynamic relationships would, by definition, be dynamic

and the cached results could therefore change based on it

true, although the set of relationships in the example I provided wouldn't change very often, so if they were included in the cache key, I don't see a difference.

if they aren't changing very often, synchronizing them in seems like a better design

the "hard" part of synchronizing is just being able to continue the sync process from where it left off, if it gets interrupted

assuming that's doable (i.e. there is some sort of pagination or continue token, etc)

then it should be fairly trivial to write

In my case, I'm not actually allowed to enumerate all users and groups in my company (> 50k employees).

how would you get the dynamic relationships then?

Using OpenID Connect for AuthN, I can get the user and their group memberships (at login time)

you could write them at login time too, in theory

downside is that if their membership changes and they haven't logged in again, it'll be "stale"

but then, it sounds like that's unavoidable

could caveated relationships help with this "just in time" data?

https://github.com/authzed/spicedb/issues/386

Hmm, that seems orthogonal to me. I also have the ability to ask "is user Joe a member of group Foo" at any time. I just can't enumerate groups and users.

Hi, I am trying to connect my go app to the spicedb instance through grpc. If I do insecurebeartoken, it will show `grpc: no transport security set (use grpc.WithInsecure() explicitly or set credentials)` and if I do securebeartoken with systemcerts it will show `error: desc = "transport: authentication handshake failed: tls: first record does not look like a TLS handshake"` when I try to add a relation. Can I get some help on this? Thank you!

<@756964817939464282> take a look here: https://github.com/authzed/zed/blob/318e580e27fdce1bf8f3f14b64fc9f50096055a1/cmd/zed/main.go#L45

you need both the insecure credentials themselves and `insecure.NewCredentials`