March 2021 Summaries

This summary provides an overview of the importance of authentication and authorization, and how they are related. It explains that authentication is concerned with identity, while authorization is about permission. The text then delves into the concept of permissions, defining them as checks within a permissions system, where the question "Does subject have permission on resource?" is asked. The summary also discusses how relationships between objects in a permissions system determine whether a user can perform a certain action, and how these relationships are expressed through roles or attributes. The text then provides an example of how this works using SpiceDB, an open-source implementation of Zanzibar, to demonstrate how it answers Check questions efficiently while providing tooling to handle complexity.

The acquisition of Auth0 by Okta is a significant development in the identity and authentication space. While it may raise concerns for some, Authzed remains largely unaffected as its focus is on authorization rather than authentication. Authzed provides a hosted permissions system as a service that enables customers to make fast and accurate access management decisions without having tedious computations in their app servers. The acquisition highlights the value of hosted service providers in this space, which has been demonstrated by Auth0's success. There are alternative options available for those concerned about the impact on Auth0, including PingIdentity, SuperTokens, cloud provider identity services, and integrating with OpenID Connect endpoints. Authzed supports identity from these sources, making it a viable choice for building better services through improved permissions fidelity, reliability, and testability.

AuthZ vs AuthN are two distinct concepts that are often conflated due to their similar names. Authentication (authN) is who you are, while authorization (authZ) is what you're allowed to do. The problem with attribute-based permission systems is that they struggle with interpreting and applying significance to the presence of attributes, leading to security vulnerabilities. Relationship-Based Access Control (ReBAC) offers a modern approach by focusing on the relationships between users or services and resources, rather than traditional role-based access control or attribute-based access control. ReBAC allows for fine-grained access control, intuitive management, and a collaborative approach, promoting a more robust permission system that can withstand changes to the organization.