Few days back I came to know about OpenFGA – Open Source Authorization by Auth0. Since then I am exploring it a bit. Here in this blog post we will understand what is OpenFGA.
Whenever we discuss about authorization, there is always a confusion about difference between authentication and authorization. Let’s first clear that.
Difference between Authorization and Authentication
Authentication is all about identity of the user. Authorization is all about what user can do with your system. As an application developer or system architect we always face challenges with Authorization.
There are lots of things involved with Authorization. It includes,
- Access to system entities.
- What all URLs user can access
- Types of actions, like create / read / update/ delete
- Grant and revoke permissions etc.
Considering above factors it’s always a challenge to implement robust architecture for the authorization.
OpenFGA – Fine Grained Authorization Solution
It’s a fast, scalable and flexible system. It’s inspired by Google’s Zanzibar project. This paper presents the design, implementation, and deployment of Zanzibar, a global system for storing and evaluating access control lists.
Auth0 / Okta developed OpenFGA on top of Google’s Zanzibar and made is open source. It is easy for application developers to develop their access control layer, and to add and integrate authorization which is consistent across all of their applications.
Why it is important?
As mentioned earlier in the post authorization is very critical and complex aspect of modern applications and platforms. With increasing demands from users, it’s crucial to build robust system without compromising cyber security.
Let’s understand building blocks of OpenFGA one by one.
OpenFGA Server
This act as permission engine. It uses expressive language to define your authorization model. This server consists of HTTP APIs using which one can,
- Define permission models
- Querying and modifying them
- Checking and granting permission
It has modular data storage. It supports an in-memory database and PostgreSQL. Also it has graph querying implementation inspired by Google Zanzibar. It is also available as docker image, you can check the quick start guide here.
OpenFGA Client
There are no of choices of SDK available to use in your application to set up a client. Available SDKs are GO SDK, .NET SDK, JS SDK. The client allows you to interact with the server API in an idiomatic way.
Client works with store. A store is a OpenFGA entity that contains your authorization data. You will need to create a store in OpenFGA before adding an authorization model and relationship tuples to it.
How does it work?
Let’s first get high level overview of how does it work before we see the code example. Let’s take an example of project management system.
Define the model
- A project can be created by an employee.
- It can be approved by manager of employee.
- Team member can view project.
To solve this problems, we will define the authorization model.
type project
relations
define creator as self
define approver as manager from creator
define team-member as self or creator or approver
type employee
relations
define approver as self or manager
Define the tuples
Once model is defined you will pass data by using the OpenFGA’s Write API and a few “tuples”.
Define employee manager relation. Here John is the manager of Smith. Hence he become approver.
{
"user": "employee:john",
"relation": "approver",
"object": "employee:smith"
}Employee create project
{
"user": "employee:smith",
"relation": "creator",
"object": "smith-project"
}Team member added.
{
"user": "employee:jane",
"relation": "team-member",
"object": "smith-project"
}Now we can use OpenFGA’s Check API, which will return true or false for the tuples. Based on the user, relation and object the API will return true or false.
In the next post, we will understand about js-sdk for OpenFGA and see how we can use it.
