September 2024 Summaries

Google's Zanzibar model of authorization differentiates itself from other models by relying on relationships between objects, known as "resources" and "subjects". SpiceDB is an open-source implementation of Zanzibar developed by AuthZed. It stores relationships in an underlying datastore and uses this data to compute permissions. However, there exists a possibility that relationships within the external datastore could be modified without SpiceDB's knowledge, leading to incorrect or malicious answers to permissions questions. To address this issue, SpiceDB v1.36.0 introduces relationship integrity, which allows for each relationship written into the backing datastore to be signed by a key known only to SpiceDB. Currently, relationship integrity is supported with the CockroachDB datastore driver and may extend support to other drivers in the future.

Casbin is an open-source access control library that integrates directly into an application, allowing developers to embed customizable access control models like RBAC (Role-Based Access Control), ABAC (Attribute-Based Access Control), and ACLs (Access Control Lists) directly into the codebase. SpiceDB is an open source, centralized permissions system that externalizes authorization decisions from the application codebase. Both systems have their pros and cons, with Casbin offering more flexibility and control but potentially higher complexity as the system scales, while SpiceDB provides a more streamlined approach to managing permissions across distributed environments, with built-in tools for correctness, auditing, and performance. The choice between embedding an authorization library or adopting an externalized, centralized system will depend on the specific needs of the project and its growth potential.

The Zanzibar paper presents a revolutionary approach to permissions management by combining strong consistency, performance, and scalability into one global solution called "Zanzibar." To address the challenge of maintaining both consistency and caching, SpiceDB allows for some staleness in permissions requests while ensuring that the maximum possible staleness is acceptable. The concept of a ZedToken (or Zookie) was introduced to encode the minimal point-in-time at which cache results are considered valid. Additionally, SpiceDB offers per-request configurable consistency levels to accommodate different permission requirements.