OPAL: A Flexible, Self-Hosted Authorization Solution Inspired by Netflix's AuthZ Strategy reddit / selfhosted ---------------------------------------------------------------------- Permit_io · 2023-12-11 20:44 In 2021, when Permit.io launched, we anchored our authorization framework on Policy as Code with a specific focus on OPA/Rego. We believed, and still do, that Policy as Code approach is key to scalable authorization. While policy engines solve the challenge of decoupling policy and code, the challenge of scaling them and loading them with the right policy and data remains strong - especially for event driven systems. We reviewed how Netlfix used OPA with a a replication pattern; and decided to create a similar yet more extensible and event-driven solution - and so [OPAL (Open Policy Administration Layer)](https://github.com/permitio/opal) was born - creating a scalable, zero-trust way to manage policy engines and their policy/data at scale. Fast forward two years, and the landscape has evolved. New policies as code languages and standards have emerged (Cedar, OpenFGA, etc.), and in this evolving market, OPAL has positioned itself as a leading solution for synchronizing policy as code with policy data, particularly for self-hosted environments. What truly differentiates OPAL from other solutions like Topaz and Permify is its flexibility. OPAL is not limited to a single policy engine; it supports a variety, making it a versatile tool for authorization applications. Using a single Helm chart or Dockerfile, one can deploy a full-fledged authorization system, customized to specific policy models, languages, and engines. Besides a warm recommendation to use OPAL as your authorization service, we would also like community input for the future development of OPAL. What features would you like to see in OPAL? How can we make it more robust and efficient for your authorization needs? We value your feedback and are excited to see how your suggestions can shape OPAL's roadmap. P.S. As with any open-source project, your support on GitHub, especially stars, helps us a lot. Thanks in advance for your backing! [https://github.com/permitio/opal](https://github.com/permitio/opal) ---------------------------------------------------------------------- Fluffer_Wuffer · 2023-12-12 01:47 I suspect if you want help here, you'll need to throw a bone.. set up examples and demo with aps that are commonly used here... its how others such as Authentik , NPM., got the almost cult followings. ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-12-12 05:03 Thanks... but... Why in Python... why... we have enough security problems on the web... we have enough CVEs... For the love of god use Rust or Go at least... Use a compiled language that helps you instead of the garbage ducktyping in Python... compilers do type checks better than humans. Oh, wait. I know why... you're a special human being who doesn't do all the mistakes that all other human beings do. (Just to cover the first answer that I'll get here). Sorry for the rant... but I'm frustrated. ---------------------------------------------------------------------- This-Gene1183 · 2023-12-12 06:09 Downvoting you bud. /Rant. ---------------------------------------------------------------------- DesertCookie_ · 2023-12-12 06:15 In Germany, OPAL is the platform used by most universities for their online courses and such; some schools use it too. I was very confused reading this at first. ---------------------------------------------------------------------- xemulator · 2023-12-12 07:02 It's just a programming language ffs ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-12-12 07:16 It's a shitty programming language with zero security considerations and has caused enough damage. ---------------------------------------------------------------------- xemulator · 2023-12-12 07:17 Nuh uh ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-12-12 07:18 You're confusing me with someone who gives a crap. ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-12-12 07:20 My man, you can believe whatever you want; being willfully ignorant isn't a crime. The facts are obvious. Anyone who understands ducktyping knows why Python isn't good for security applications. ---------------------------------------------------------------------- Cylian91460 · 2023-12-12 08:19 As long as you update python it shouldn't have CVEs, and you should be happy it's not another JS app. >compilers do type checks better than humans. Runtime also does check... Did you ever use python ? ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-12-12 09:37 You seem to be a beginner who understands nothing in programming. That's OK, so let me explain then in the interest of making the world a better place. The rule is simple: Every type check you do at compile-time, is an error you avoid at run-time. This is why null pointers are called the "billion dollar mistake". So, for example, the error "None doesn't have the method \`startswith\`", where \`startswith\` is a method meant to be called on strings, shouldn't ever happen in reality, but why does it happen? It's because, for example, a programmer creates an invariant in his head, while writing a function that takes a string, that this parameter will only ever be a string. Then, a month later, he realizes, somewhere else in the program, that this parameter can be something or nothing (as opposed to always a string), based on some input that wasn't covered before. So, that string is now not a string, it's now either a string or a None (the None from Python). But then, the ideally correct way is, the compiler should tell them every place where they attempted to call a string function on that instance, like that \`startswith\` call they did a month ago. But because of duck typing and because type-checking is only at run-time, and because the program doesn't necessarily cross that execution path all the time with None, he forgets to do the check \`if s is None\` because calling \`startswith\`, and his tests miss it, and his program will crash later when the user hits that execution path and uses None as the parameter instead of a string. This is a story as old as programming. Any expert in programming understands it, which is why Rust is blowing up in popularity. In compiled programming languages, you have solutions to these problems. Types can be nullable or optional by definition, like \`std::optional\` in C++ or \`Option\` in Rust. If you're passing a String to a function, there's absolutely no way you'll do that mistake you did in Python, because the compiler ensures that all types are consistent, and only valid functions/methods are called in different types. So \`startswith\` will only be called on a type that has it, not on None, like allowed in Python because of lack of checking. ---------------------------------------------------------------------- Cylian91460 · 2023-12-12 10:16 Oh ok, yeah I understand now. Thanks ---------------------------------------------------------------------- slykethephoxenix · 2023-12-12 12:08 Does this work with Authelia? ---------------------------------------------------------------------- Permit_io · 2023-12-12 13:27 It is provider-agnostic. There is already HTTP data fetcher implemented, so API calls should work seamleslly. The system is extensible, so the community is adding plugins when needed. ---------------------------------------------------------------------- Permit_io · 2023-12-12 13:28 You made a good point here about community adoption. We are still trying to find the right way for community adoption. I'll create some examples and demo apps and get back here! Thanks for that ---------------------------------------------------------------------- bitweis · 2023-12-12 13:44 Hi friend, There's a section in the docs on why Python: [https://docs.opal.ac/overview/design#implementation-with- python](https://docs.opal.ac/overview/design#implementation-with- python) If you'd actually look at the project - you'd see it's all Pydatnic based - i.e. no duck typing. and you have both static type checks and checks in runtime. There are misconceptions about Python, coming from its earlier days - but the language has evolved a lot since. ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-12-12 14:41 My man, the documentation talks about asyncio, trying to justify the (dumb) decision of using python by claiming that asyncio is fast. Whatever, I never argued about speed. I'm 100% happy if they use Rust and maintain 50% of Python speeds. I rag on C and Linux all the time for the same reason. Besides, Pydantic doesn't guarantee type safety. You could try, but you literally can't make that guarantee. It's a mathematical impossibility, because types are ingrained in Python's PyObjects that are resolved at run-time. Sure, it's better than nothing, that's a given, but still, Python is hot garbage, and only something like Mojo can fix it, where Python gets upgraded to a typed, compiled language, and the stupid machine with large memory gets to do what it can do best: Hold invariants in a complex software. Mojo is the answer to the hot garbage that is Python nowadays. Anything else is "something better than nothing" kind of deal. But in my opinion Mojo isn't gonna fix the original problem, which is that talentless people who don't understand computer science, or the consequences of their actions, and why experts say what they say, trying to build stuff and offer it to the public using bad tooling. Even if Mojo becomes 100% widely used, we still will have the average, dumb slobbering dev who thinks he's smart enough to skip it. Now don't get me wrong, it's good that people try to help and learn and practice. But the stubbornness in people trying to justify Python is just turning into stupidity. We have enough data to support that compiled languages are safer and are the right way to go, and that Python shouldn't be used for complex software, but here we are, dumb people will do dumb things. I do my part and warn those who don't know, and hopefully it helps. ---------------------------------------------------------------------- bitweis · 2023-12-12 15:13 Dude, who hurt you? Disagreeing is one thing, but calling everyone and everything you disagree with stupid and garbage is pretty toxic behavior. Yes, there are limitations to Pydantic, and it isn't as tight as a compiled language, sure but there are pro/cons as with anything. And it can definitely tilt the scales. ---------------------------------------------------------------------- terrorTrain · 2023-12-12 15:29 My guy, You need to learn to communicate. People are going to make different choices than you would. It’s ok. If rephrase all this as a question, and are actually open to the answer, people might listen to your points, and you can have a meaningful discussion about Python security. As it stands, you just sound like a socially incompetent know it all, and everyone is going to dismiss you. ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-12-12 15:34 Dumb people will do dumb things. I've seen dumb people get burned enough times and not learn that I'm 100% convinced that it's pointless when it's dumb people on the other end. Those who would learn will learn from a word, and those who won't will not even with books written to them. That's my opinion that I'm acting upon. ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-12-12 15:39 > who hurt you CVEs. > sure but there are pro/cons as with anything None that justify writing security software with Python. Spare me. Use Python for internal scripts, calculations, etc, not for complex software. Period. The alternative is compromising on security. Anyone not getting why I'm saying this and seeing my point is just dumb or ignorant or both. I'm done giving leeway on this matter. I've seen enough. I've seen spaceships and rovers fail due to such stupidity. ---------------------------------------------------------------------- terrorTrain · 2023-12-12 16:11 Then why comment at all… just go be a hermit and write your amazing code that will stun us all in its perfection. Or you can learn to communicate and actually be a helpful part of the conversation. ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-12-12 16:46 I don't think you understood what I said. Read my last message again. And btw I know how to communicate just fine. I just choose when to give a crap. ---------------------------------------------------------------------- TheReverend403 · 2023-12-12 16:56 > And btw I know how to communicate just fine Keep telling yourself that. 😂 ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-12-12 17:10 I run a team and make high 6 figures for that and never had a single person complain, and in all my jobs people tell me I'm a very good communicator. You're confusing not being able to and not giving a crap. I guess simpletons like you don't get to control that since they have no choice. So, excuse me, Mr. No Body on reddit. Your opinion means very little to me. ---------------------------------------------------------------------- msc1 · 2023-12-12 17:56 You’re pathetic lol ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-12-12 17:59 Oh, no. Another No Body dissatisfied. Anyway. ---------------------------------------------------------------------- msc1 · 2023-12-12 18:05 Internet is filled with stories of people like you getting humbled. One day you’ll make wrong person “dissatisfied” and you’ll have to record teary eyed youtube apology video. Keep on like this. ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-12-12 18:20 Maybe. I'm a man of principle, and I never got anywhere by compromising on principles. I do what I think is right and immediately change my opinion when I'm proven wrong, and that's why I am where I am. ---------------------------------------------------------------------- Anak_Krakatoa · 2023-12-12 19:23 In my experience, anyone who claims to be a man of principle, rarely is. Your principals are not on display here, you just seem like a douche. High functioning, if your claims are to be believed. But its just a bunch of bluster on the internet lol ---------------------------------------------------------------------- TheQuantumPhysicist · 2023-12-12 19:34 > But its just a bunch of bluster on the internet It's, isn't it? ---------------------------------------------------------------------- Anak_Krakatoa · 2023-12-12 20:46 Ya, good point lol ---------------------------------------------------------------------- zaTricky · 2023-12-12 23:14 Can you give an ELI5 of how you'd use this for a small business or for a home lab? It sounds interesting - but there's a disconnect if you don't already know what AuthZ, Topaz, or Permify do. ---------------------------------------------------------------------- Trustworthy_Fartzzz · 2023-12-13 14:10 AuthZ isn’t a service - it’s shorthand for “Authorization”. Projects like this are modeled in Google Zanzibar and are an abstraction layer for people wanting an authorization rules engine framework for their services. To map that to r/selfhosting think about a self-hosted app you like that has no authentication or authorization. You can add authentication (AuthN) with Authelia or Authentik, but you’d have no way of introducing finer grained ACLs (AuthZ). With something like this you could add in AuthZ in a similar fashion that Authentik’s proxy provider allows you to add AuthN to apps that do not already support it. ---------------------------------------------------------------------- Permit_io · 2023-12-13 14:36 You are the owner of a local donut store and you have a good understanding of your regular customers' preferences. For instance, Ms. Smith loves Boston cream and also likes a pack of donut holes if she is running late. Senor Cohen requires gluten-free donuts due to his celiac disease. Mr. Schrek is always in a hurry and visits the store at exactly 10 am every day; he leaves if his order is not ready. The Drew family is a special case as they are allowed to purchase donuts outside of regular business hours. Your reputation depends on satisfying these requirements, and losing even one customer could hurt your business. However, you need to leave for an urgent trip to Italy, and you cannot teach the temporary replacement of all of these policies in such a short time. Luckily, Rego/Cedar provides a structured way to declare all of these policies using a special standard that ensures your policies will be maintained. OPA/Cedar Agent is a tool that makes decisions based on these policies and the data you provide. OPAL is the tool that connects the dots and synchronizes your policies with the current data to ensure that every employee has access to the correct policies and decision engines. For example, OPAL can update the data to reflect whether Mr. Smith arrived on time today or if an after-hours customer belongs to the Drew family. With these tools, you can rest assured that your temporary replacement will be able to handle all of your customers' needs, and your business will continue to thrive. Donut store - your application In-memory policy - non-scalable imperative if statements ---------------------------------------------------------------------- [deleted] · 2023-12-14 01:15 [removed] ---------------------------------------------------------------------- This-Gene1183 · 2023-12-16 23:08 Damn I Downvoted this too. Idk how it keeps happening ---------------------------------------------------------------------- Permit_io · 2023-12-18 18:17 We created an article about the Reddit authorization system and included OPAL examples there - https://www.permit.io/blog/how-reddit- built-authorization-with-opa