Permify: Open-Source Authorization Service For Building Fine Grained Authorization Systems At Scale! reddit / selfhosted ---------------------------------------------------------------------- ege-aytin 路 2023-12-06 15:16 Hi everyone 馃憢 I鈥檓 one of the maintainers of the Go OSS project Permify, an open- source authorization service inspired by Google Zanzibar, which is the global authorization system used at Google to handle authorization for hundreds of its services and products, including YouTube, Drive, Calendar, Cloud, and Maps. Repository:聽[https://github.com/Permify/permify](https://github.com/Pe rmify/permify) **With Permify, you can** 馃敭 Create permissions and policies using聽domain specific language聽that is compatible with traditional roles and permissions (RBAC), arbitrary relations between users and objects (ReBAC), and dynamic attributes (ABAC). 馃攼聽Manage and store authorization data聽in your preferred database with high availability and consistency. 鉁吢營nteract with the Permify API聽to perform access checks, filter your resources with specific permissions, perform bulk permission checks for various resources, and more. 馃И Test your authorization logic with聽our validation YAML file. You can conduct scenario-based testing, policy coverage analysis, and IDL parser integration to achieve end-to-end validations for your desired authorization schema. [Authorization As A Service](https://preview.redd.it/bk5b419nxo4c1.png ?width=1406&format=png&auto=webp&s=fa229732b48cef0c2815b023fff040e3e71 27867) **Any feedback appreciated!** We rely on feedback from the open-source community to improve, so we'd appreciate any suggestions you may have. We're also happy to answer any questions you might have. ---------------------------------------------------------------------- siniradam 路 2023-12-06 17:13 This is awesome, I was planning to work on something like this. I'm really intrigued. As soon as I'm done with this year's "urgent" projects. I'll start reviewing. (& if I can contributing) In the meantime; thanks, good luck, godspeed. :) ---------------------------------------------------------------------- ege-aytin 路 2023-12-06 17:47 hi u/siniradam, thanks for the kind words! we'd love to see your contributions, also feel free to join our community to discuss ideas and get the latest updates - https://discord.gg/n6KfzYxhPp ---------------------------------------------------------------------- neptrio 路 2023-12-06 21:58 I don't want to sound too cynical, but how long before the open source version is cut so much that it is no longer usable? I would find it helpful to use this, but it's a super critical part of software. Too critical that at some point it will no longer be viable for small developers like me due to excessive costs. I've become very careful with open source projects that have excellent potential to be commercialized. Modern complex software is built like this today, from a lot of individual highly specialized components. I also think the idea of healthy commercialization is very good. It can help to ensure that the project lives for a long time. But I've also seen it happen that the need to earn money has become so important that prices are set so high that it's no longer affordable. But apart from that, it looks very interesting. Thank you for sharing. ---------------------------------------------------------------------- ege-aytin 路 2023-12-06 22:37 Thanks for the angle u/neptrio, actually to be honest you're right, if you're not big enough, not having a fine grained permission requirements such as attributes or ReBAC need or not have any scalability concerns probably this product will create overkill for your needs. Instead I can suggest more coarse grained solutions, permission libraries, or built in authorization solutions within the popular frameworks. This product solves the pain points for scaled environments, microservices, more granular permission structures, etc. But its worth to note that almost every product or application tends to get big overtime so maybe starting with these kind of solution is not a very viable option for you today but believe me at some point the technical depth and authorization management issues among applications will tend to cost much higher than what similar solutions offer on top of the open source. Also, yes, it's a critical part of the software. In fact, that's why we open-sourced it. It's fully transparent, allowing you to run it with complete control - on your own servers and your own preferred database. Being open source also harnesses the power of the developer community. I'm one of the individuals working on this, we're tailoring it to actual user needs and feedback. Again thank you for your interest, please feel free to ask further questions if any. ---------------------------------------------------------------------- jorissels 路 2023-12-07 00:17 Hi! Is it possible to authenticate using a yubikey? :) ---------------------------------------------------------------------- ege-aytin 路 2023-12-07 06:28 Hi @jorissels we don鈥檛 have particular yubikey integration but you can use any authentication or identity provider with Permify. ---------------------------------------------------------------------- intellidumb 路 2023-12-07 12:05 Thanks for posting! I鈥檝e been keeping an eye on this project, and was just curious if you could give comparison (pro/con/feature differences) to https://github.com/ory ---------------------------------------------------------------------- ege-aytin 路 2023-12-07 13:57 Hi u/intellidumb thanks! and sure, here are the major differences from Ory's Keto: \- \*\*Multi Tenancy:\*\* Our architecture is tenancy-based, which means you can create custom authorization models and relation tuples accordingly for different tenants and manage them in a single place. This is an important feature, especially if you need to manage several application with different authorization logics. \- \*\*Attribute Based Access Control:\*\* We're supporting attribute- based access control and contextual permissions. This gives users the ability to define more complex policies using dynamic attributes such as boolean variables, IP range, time periods, location, etc. \- \*\*Schema Management & Visibility:\*\* We're taking an approach that help engineering teams to ease and streamline the management and collaboration of their authorization systems. We have features like \*\*Schema Stating\*\* to manage schema changes in different stages, \*\*Partial Schema Update\*\* to update schema smoothly with multiple engineering teams, \*\*Relationship Bundles\*\* to streamline relation tuple & data creation, and more. ---------------------------------------------------------------------- intellidumb 路 2023-12-07 16:29 This is great, thanks a lot for taking the time to answer!