Why Authorization Is Hard

• OPA (Open Policy Agent)

  90 9,118 9.6 Go

  Open Policy Agent (OPA) is an open source, general-purpose policy engine.

  

From my limited research looking for authorization systems [1] it is but it is not: OPA can get actually quite slow for "real world" production scenarios. For example until recently Ory Keto used OPA and had that issue https://github.com/open-policy-agent/opa/issues/1443 . It seems to me that Oso although is based in Opa and Zanzibar ideas, it may have some performance improvements and ease of use.

[1] (we are planning to change a half-assed internal auth system to a pre-existing one)

• oso

  16 3,387 6.7 Rust

  Oso is a batteries-included framework for building authorization in your application.

  

Hey, Oso engineer here. Good question.

The rust core is indeed called from the ruby library (as it is with all of our 5 other host libraries). The core itself is pretty complex (there's a whole parser/interpreter in there), so maintaining it in a bunch of languages would be a bit hectic.

There are some files inside `lib/oso/polar/ffi` that define the C bindings used by the rest of the library. Here's an example: https://github.com/osohq/oso/blob/main/languages/ruby/lib/os...

We use the ffi gem to make that work: https://github.com/ffi/ffi

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• dd-trace-rb

  4 290 9.9 Ruby

  Datadog Tracing Ruby Client

  

Thanks! I'll pass it on to the team :D

I've got to say, the folks at Intercom made it particularly fun. They were sending us traces and graphs from their internal systems when we trying to figure out some issues with them (e.g. we ran into this datadog context problem: https://github.com/DataDog/dd-trace-rb/issues/1389)

• ffi

  5 2,053 8.1 Ruby

  Ruby FFI

  

Hey, Oso engineer here. Good question.

The rust core is indeed called from the ruby library (as it is with all of our 5 other host libraries). The core itself is pretty complex (there's a whole parser/interpreter in there), so maintaining it in a bunch of languages would be a bit hectic.

There are some files inside `lib/oso/polar/ffi` that define the C bindings used by the rest of the library. Here's an example: https://github.com/osohq/oso/blob/main/languages/ruby/lib/os...

We use the ffi gem to make that work: https://github.com/ffi/ffi

• Ory Keto

  35 4,600 8.6 Go

  Open Source (Go) implementation of "Zanzibar: Google's Consistent, Global Authorization System". Ships gRPC, REST APIs, newSQL, and an easy and granular permission language. Supports ACL, RBAC, and other access models.

  

• casbin-server

  3 296 5.2 Go

  Casbin as a Service (CaaS)

  

casbin is super flexible and it support many models[1]

[0]https://casbin.org/docs/en/service

• cerbos

  41 2,502 9.6 Go

  Cerbos is the open core, language-agnostic, scalable authorization solution that makes user permissions and authorization simple to implement and manage by writing context-aware access control policies for your application resources.

  

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

Suggest a related project