tl;dr: what is the best option for user authentication/identity so I can use it along with SpiceDB?

You can look for anything that bills itself as an identity provider: Auth0, Supertokens, OIDC from google, GitHub, etc.

With OIDC from Google you mean like social authentication and with the JWT from them I can use the subject against SpiceDB to check for the user authorization right?

Yep

I was actually thinking about OIDC and even tho it's a layer on top of OAuth 2.0 it doesn't mean I need to use their "scope" as authorization, instead just use it to identify the user and use the subject against SpiceDB

I think I'm getting the hang of this (I think haha)

Yep, that’s exactly what we do with the JWTs from Auth0

The scope is really coarse grained attenuation, you’re probably looking for something more fine-grained

Like you can’t have a scope for every resource and access level

I read so much in order to understand a few things and you confirmed my theories. - https://www.ory.sh/oauth2-openid-connect-do-you-need-use-cases-examples/#scopes-are-not-permissions - https://authzed.com/blog/identity-isnt-the-foundation#groups-scopes-claims-dont-answer-the-question

I was really confused but now it makes more sense

Thank you @Jake

I feel like my mind is free now 🤣

I was trying to find how to go about updating the schema in spicedb? Do I just need to run zed schema write (if using zed cli) ?

yep!

that calls the

WriteSchema

API

which you can also call from code

Awesome thanks @Joey . Also wanted to confirm that I do not need to run any migration on spicedb right? And none of the relationship data is affected I assume? If there is any documentation that provides more details please send it my way. Thanks

No migration unless you’re moving to a new version of SpiceDB

Schema write will check to make sure the relationship data is not invalid before the schema updates

got it that's good to know

So if you try to remove a type that is used in an existing relationship, it will fail the schema update

(As an example)

we have officially begun running spicedb in production today. the opentelemetry integration has been so key to the process.

Glad to hear it! Can you describe how you're consuming OTEL? What provider? Is there anything missing that you wish was there?

we're sending to new relic's grpc endpoint. we get a breakdowns and statistics about every spicedb method, so we can see average response times and all that but also like how many requests get dispatched to other instances and more interesting details like that. as far as what is missing: - sometimes internal spans for DispatchCheck have an error status with

context canceled

but no more information so i can't tell if that's something that needs to be addressed. some more information on those spans would be good, or if that error status is irrelevant for it to be caught internally - if it's possible to set an attribute on CheckPermission spans to indicate whether the cache was used so we can make sure we aren't doing anything that negates caching that would be super cool

overall though i'm so pleased. we're getting quite a few sub-millisecond response times! really impressive

oh i also forgot to mention, we have context propagation set up in our client so once we expand our usage of otel to more places we'll start to see how spicedb fits into the overall system from a higher level

IIRC a typical scenario we've observed lead to cancelation is datastore hedging. A concurrent request is issued when the operation takes longer than usual. As soon as one of the two come back, the one still in flight will be cancelled.

Hi, on this page https://authzed.com/blog/acl-filtering-in-authzed/ the link in "The beta Lookup API" https://docs.authzed.com/api/lookup does not work. Can you provide the correct link and fix it on that page?