spicedb
- v
venezia
05/20/2021, 5:46 PMoh slack - u
user
05/21/2021, 4:32 PMthis was a neat hack i did last night: https://twitter.com/jimmyzelinskie/status/1395532330773659648 - u
user
05/21/2021, 4:32 PMdoes anyone here use OPA at all? - m
metalmatze
05/21/2021, 8:49 PMSomewhat used. Lucas introduced it as part of Observatorium for AuthZ: https://github.com/observatorium/api/blob/master/opa/opa.go - u
user
06/29/2021, 12:24 AM👋 - u
user
07/16/2021, 5:47 PMIf anyone is in NYC, we're cohosting a developer happy hour on the 27th https://docs.google.com/forms/d/e/1FAIpQLSdIVZKhuhcnAG65i1MrfhdI9Wp19W0R8xhomkFTdO0emF6jcA/viewform - r
Rocio
07/23/2021, 7:41 PMhi 👋 Do you know if the talk in Papers We Love that's mentioned on this blog post: https://authzed.com/blog/zanzibar-implementations/ has already been published somewhere? - j
Joey
07/23/2021, 8:13 PMhi @User, it appears the video hasn't been published as of yet. We'll keep checking and post here and on the blog as soon as it is - u
user
07/23/2021, 8:15 PMWe are assured it's being professionally edited right now by the PWL folks. A recording should be made available here when it's finished: https://www.youtube.com/c/PapersWeLove/videos - r
Rocio
07/23/2021, 8:45 PMthank you! - j
jpdb
07/27/2021, 11:58 PMAnyone ever integrate any of the Zanzibar implementations (authzed or keto) with Google Identity? I want to be be able to give users the ability to authorize other Google identities (Google Account, Service Account, Google Group, org, etc) to their resources. The problem I run into is you can't use a Google identity email as your Subject Reference because they can change. You're supposed to use the ID (
claim in the JWT), and it's not possible (as far as I can tell) to access them just by email.sub - u
user
07/28/2021, 2:57 PMWhen you say Google Identity what do you mean exactly? There are GAIA (the identity system at google) IDs that get exposed that are stable from their OAuth login flow. We use Auth0 -- but all Auth0 does is prefix it "google|idgoeshere" - u
user
07/28/2021, 3:03 PMIf you can describe your use case a bit more, we can dig into the details. - j
jpdb
07/28/2021, 3:47 PMI'm familiar with Gaia, yeah. Basically I have a Widget application and I want users to be able to give other google identities access to Widgets. Typically, the users would grant access to other users (or service accounts, or google groups) via the email address. On my application, I can't grab the Gaia ID from the email address so the Subject Reference has to be the email address itself, which isn't recommended (https://developers.google.com/identity/sign-in/web/people) - j
jpdb
07/28/2021, 3:50 PMso, hypothetically, if UserA granted GoogleGroupB "Admin" access to WidgetC, it might look likego Tuple: &pb.RelationTuple{ User: &pb.User{UserOneof: &pb.User_Userset{Userset: &pb.ObjectAndRelation{ Namespace: "user", ObjectId: "googlegroupB@googlegroups.com", Relation: "...", }}}, ObjectAndRelation: &pb.ObjectAndRelation{ Namespace: "widget", ObjectId: "widgetC", Relation: "admin", }, }, - j
jpdb
07/28/2021, 3:50 PM(psuedo code heavily copy+pasted) - j
jpdb
07/28/2021, 3:50 PMnow, if googlegroupB is deleted and someone (malicious attacker or otherwise) re-registers it, they'd have admin access to widgetC - j
jpdb
07/28/2021, 3:51 PM(because the email addresses can technically change, even if rare/not probable) - j
Joey
07/28/2021, 3:52 PMyeah, the general recommendation in that case, if you are allowing direct sharing, would be to store a map in your backend from a GAIA ID and email to an internal ID, and use the internal ID as your ObjectId - j
Joey
07/28/2021, 3:53 PMthen, when a user logs in with a GAIA ID, you can update that record if their email has changed - j
Joey
07/28/2021, 3:53 PMif a user shares with an email and it isn't in your internal mapping yet, then you create a new row without its GAIA ID - j
Joey
07/28/2021, 3:53 PMand then fill it in when the first "valid" login comes in - j
Joey
07/28/2021, 3:53 PMits unfortunate that it appears Google doesn't offer an email -> ID API - j
jpdb
07/28/2021, 4:00 PMthat's where I was at, but wanted to see if anybody else had any ideas. Darn - j
Joey
07/28/2021, 4:00 PMthe other option is you could write relationships between emails - j
Joey
07/28/2021, 4:00 PMassuming Google doesn't allow reuse (I'm not 100% certain of their timeframe on that, if any) - j
Joey
07/28/2021, 4:00 PMyou could do something like (note this is Authzed schema config) - j
jpdb
07/28/2021, 4:01 PMmy understanding is that you can't re-use @gmail account emails - j
Joey
07/28/2021, 4:01 PMdefinition user {} definition email { relation user: user } definition widget { relation admin: email } - j
Joey
07/28/2021, 4:01 PMokay