844600078504951838 #spicedb

Channels

zanzibar

spicedb

venezia

05/20/2021, 5:46 PM

oh slack

fukuroutoimasu

05/21/2021, 4:32 PM

this was a neat hack i did last night: https://twitter.com/jimmyzelinskie/status/1395532330773659648

fukuroutoimasu

05/21/2021, 4:32 PM

does anyone here use OPA at all?

metalmatze

05/21/2021, 8:49 PM

Somewhat used. Lucas introduced it as part of Observatorium for AuthZ: https://github.com/observatorium/api/blob/master/opa/opa.go

fukuroutoimasu

06/29/2021, 12:24 AM

👋

fukuroutoimasu

07/16/2021, 5:47 PM

If anyone is in NYC, we're cohosting a developer happy hour on the 27th https://docs.google.com/forms/d/e/1FAIpQLSdIVZKhuhcnAG65i1MrfhdI9Wp19W0R8xhomkFTdO0emF6jcA/viewform

Rocio

07/23/2021, 7:41 PM

hi 👋 Do you know if the talk in Papers We Love that's mentioned on this blog post: https://authzed.com/blog/zanzibar-implementations/ has already been published somewhere?

Joey

07/23/2021, 8:13 PM

hi @User, it appears the video hasn't been published as of yet. We'll keep checking and post here and on the blog as soon as it is

fukuroutoimasu

07/23/2021, 8:15 PM

We are assured it's being professionally edited right now by the PWL folks. A recording should be made available here when it's finished: https://www.youtube.com/c/PapersWeLove/videos

Rocio

07/23/2021, 8:45 PM

thank you!

jpdb

07/27/2021, 11:58 PM

Anyone ever integrate any of the Zanzibar implementations (authzed or keto) with Google Identity? I want to be be able to give users the ability to authorize other Google identities (Google Account, Service Account, Google Group, org, etc) to their resources. The problem I run into is you can't use a Google identity email as your Subject Reference because they can change. You're supposed to use the ID (

sub

claim in the JWT), and it's not possible (as far as I can tell) to access them just by email.

fukuroutoimasu

07/28/2021, 2:57 PM

When you say Google Identity what do you mean exactly? There are GAIA (the identity system at google) IDs that get exposed that are stable from their OAuth login flow. We use Auth0 -- but all Auth0 does is prefix it "google|idgoeshere"

fukuroutoimasu

07/28/2021, 3:03 PM

If you can describe your use case a bit more, we can dig into the details.

jpdb

07/28/2021, 3:47 PM

I'm familiar with Gaia, yeah. Basically I have a Widget application and I want users to be able to give other google identities access to Widgets. Typically, the users would grant access to other users (or service accounts, or google groups) via the email address. On my application, I can't grab the Gaia ID from the email address so the Subject Reference has to be the email address itself, which isn't recommended (https://developers.google.com/identity/sign-in/web/people)

jpdb

07/28/2021, 3:50 PM

so, hypothetically, if UserA granted GoogleGroupB "Admin" access to WidgetC, it might look like

Copy code

go
            Tuple: &pb.RelationTuple{
                User: &pb.User{UserOneof: &pb.User_Userset{Userset: &pb.ObjectAndRelation{
                    Namespace: "user",
                    ObjectId:  "googlegroupB@googlegroups.com",
                    Relation:  "...",
                }}},
                ObjectAndRelation: &pb.ObjectAndRelation{
                    Namespace: "widget",
                    ObjectId:  "widgetC",
                    Relation:  "admin",
                },
            },

jpdb

07/28/2021, 3:50 PM

(psuedo code heavily copy+pasted)

jpdb

07/28/2021, 3:50 PM

now, if googlegroupB is deleted and someone (malicious attacker or otherwise) re-registers it, they'd have admin access to widgetC

jpdb

07/28/2021, 3:51 PM

(because the email addresses can technically change, even if rare/not probable)

Joey

07/28/2021, 3:52 PM

yeah, the general recommendation in that case, if you are allowing direct sharing, would be to store a map in your backend from a GAIA ID and email to an internal ID, and use the internal ID as your ObjectId

Joey

07/28/2021, 3:53 PM

then, when a user logs in with a GAIA ID, you can update that record if their email has changed

Joey

07/28/2021, 3:53 PM

if a user shares with an email and it isn't in your internal mapping yet, then you create a new row without its GAIA ID

Joey

07/28/2021, 3:53 PM

and then fill it in when the first "valid" login comes in

Joey

07/28/2021, 3:53 PM

its unfortunate that it appears Google doesn't offer an email -> ID API

jpdb

07/28/2021, 4:00 PM

that's where I was at, but wanted to see if anybody else had any ideas. Darn

Joey

07/28/2021, 4:00 PM

the other option is you could write relationships between emails

Joey

07/28/2021, 4:00 PM

assuming Google doesn't allow reuse (I'm not 100% certain of their timeframe on that, if any)

Joey

07/28/2021, 4:00 PM

you could do something like (note this is Authzed schema config)

jpdb

07/28/2021, 4:01 PM

my understanding is that you can't re-use @gmail account emails

Joey

07/28/2021, 4:01 PM

Copy code

definition user {}

definition email {
   relation user: user
}

definition widget {
  relation admin: email
}

Joey

07/28/2021, 4:01 PM

okay