jose VS openfga

JWT - jose

For demo purpose, we'll use some popular libs e.g. jose.

This module provides a lot of useful functions and utilities, but we will focus only on a couple of them. You can read more about the module itself if you feel like it.

Honestly, not exactly sure what the correct order is. The standard for encrypted jwt is called JWE. Most programming languages will have some kind of library that will handle the small details like order of operations. Example: jose for js.

I used standard Web APIs such as fetch() and WebCrypto. The most common thing I had to do was JWT token generation/validation. I worked with the jose library (the only dependency in the project) because it is cross-platform and also works with the WebCrypto API.

Biggest sharp edge I've encountered is the very much WIP WebCrypto API support. In practical terms, this means things like signing/verifying JWTs is not very well supported: https://github.com/panva/jose/discussions/243

That said, the situation is improving rapidly, and I've been personally willing to bet that the support will be solid by the time I finish prototyping and need to start adding auth to my latest project.

This feels very much like OpenFGA[0]. I've been evaluating authorization tool for one of my side projects and honestly most tools feels like creating relationships in a graph-like database and querying to see if there is/isn't relationship between two entities. Is there more to this (besides the implementation details) or am I missing something from these tools?

[0] https://openfga.dev/

OpenFGA

OpenFGA is CNCF Sandbox authorization service inspired by Google Zanzibar

- https://authzed.com/spicedb/ - https://cerbos.dev/ - https://openfga.dev/ - https://www.permify.co/

Thanks for the answer. I played around with Keycloak for a bit and I saw that roles could be mapped as token claims, however for systems where you need fine grained access control (where roles are not enough) you need some other solution. One option could be to use an external authorization system. One such system could be OpenFGA https://openfga.dev/ that is based on Google Zanzibar https://research.google/pubs/pub48190/ research paper. This answer on SO is also helpful https://stackoverflow.com/a/75047064/10781180

OpenFGA is similar to Permify https://github.com/openfga/openfga