Ory Oathkeeper
warrant-demo-app-ts
Ory Oathkeeper | warrant-demo-app-ts | |
---|---|---|
4 | 1 | |
3,172 | 4 | |
0.6% | - | |
6.8 | 2.6 | |
3 days ago | about 1 year ago | |
Go | JavaScript | |
Apache License 2.0 | - |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Ory Oathkeeper
- Launch HN: PropelAuth (YC W22) – End-to-end auth service for B2B products
-
oathkeeper alternatives - emissary, envoy, and Nginx
4 projects | 18 Jan 2022
- Launch YC S21: Meet the Batch, Thread #4
-
The reason okta spent $6.5B Auth0
Hydra feels mature. I think it's their longest-developed product so far. Besides breaking changes during big upgrades(v0 -> v1beta -> v1), everything has been painless:
- It runs anywhere with or without containers
- API makes sense, good SDKs are available in all my used languages
- RAM usage is surprisingly low compared to usage and has been great for resource-constrained environments
- Stateless means horizontal scaling is as easy as `replicas++`
- Sub-millisecond response times for some calls, much faster than our previous setup
With Hydra, I know it's the client's fault when OAuth calls fail and not just a buggy server implementation. This is reinforced in dev mode with great errors like:
- The authorization code has already been used
- The request is missing the response_type parameter
- Parameter "nonce" must be set when using the implicit flow
- Redirect URL "https://example.com/callback" does not match
On the flipside, Oathkeeper is not a mature product and has not yet reached v1. There are breaking changes planned [1]. It lacks support for at least one popular usecase (mine) out of the box [2]. Rules can be hard to create and debug. I wouldn't recommend Oathkeeper in its current state unless you're ready to dive in and fix things yourself. Once configured it sticks with the Ory trend: fast, lean, and stable.
Depending on your usecase, Oathkeeper could be swapped out with any IAP like Pomerium or just with your reverse proxy's auth request support + some small custom shim.
I haven't tried Keto (access control) or Kratos (user management) yet. Kratos is on my todo list.
[1] https://github.com/ory/oathkeeper/issues/441
warrant-demo-app-ts
-
Launch YC S21: Meet the Batch, Thread #4
We’re Aditya and Karan, the co-founders of Warrant (https://warrant.dev/). We build APIs and infrastructure that helps developers implement authorization and access control in their apps.
Implementing flexible authorization that grows with your application is difficult. Many products only need authentication early on but eventually require authorization; however, adding complex authorization to a mature, high usage product is even harder. We’re building Warrant to better abstract the complexity of authorization and reduce implementation cost and maintenance drag for engineering teams.
Warrant abstracts your authorization rules and access control logic outside of your application so it isn’t coupled to core business logic. We adopted concepts from Google Zanzibar to make Warrant flexible enough to support any access control model. Authorization rules are easy to enforce in backend and frontend code at runtime through simple API calls. Both developers and non-technical users can modify access rules through our dashboard to change application behavior without needing to change code.
We’re taking a service-driven approach to authorization. As companies get bigger and build out multiple services, authorization logic needs to be re-implemented in the new services or some central service. Whether you’re a small startup with a monolith or a company with many microservices, we think decoupling your authorization and having a dedicated authorization service is the right approach. Check out our demo app (https://github.com/warrant-dev/warrant-demo-app-ts) for an end-to-end example of how to use Warrant.
What are some alternatives?
Ory Keto - Open Source (Go) implementation of "Zanzibar: Google's Consistent, Global Authorization System". Ships gRPC, REST APIs, newSQL, and an easy and granular permission language. Supports ACL, RBAC, and other access models.
fusionauth-issues - FusionAuth issue submission project
casbin-cpp - An authorization library that supports access control models like ACL, RBAC, ABAC in C/C++
emissary - open source Kubernetes-native API gateway for microservices built on the Envoy Proxy
objection-authorize - isomorphic, "magical" authorization integration with Objection.js 🎉
OPA (Open Policy Agent) - Open Policy Agent (OPA) is an open source, general-purpose policy engine.
awesome-authorization - A curated list of information and resources about authorization.
edge-agent - Warrant Edge agent
warrant-express-middleware - Expressjs Middleware for enforcing access control on API endpoints using the Warrant API
Nginx - An official read-only mirror of http://hg.nginx.org/nginx/ which is updated hourly. Pull requests on GitHub cannot be accepted and will be automatically closed. The proper way to submit changes to nginx is via the nginx development mailing list, see http://nginx.org/en/docs/contributing_changes.html
warrant - Warrant is a highly scalable, centralized authorization service based on Google Zanzibar, used for defining, querying, and auditing application authorization models and access control rules.