Complex authorization shibboleth
From the Spicy-questions Dept.
“Have you heard of Google Zanzibar?”
When someone wants to talk about authorization, this is my first question.
I have been working with complex authorization. It’s a little hard to define exactly. It is what arises when you cross-pollinate customers with 10k/100k users with 50 odd microservices.
Zanzibar is how Google has approached this problem. It uses a graph database to store authorization relationships, and policy execution engine to traverse that graph for quick authorization lookups.
It’s not a problem if you don’t know anything about Zanzibar - it just means my first step is to teach you about it! My most productive meetings is with people who have thought deeply about this problem, and you can’t do that without bumping into Zanzibar.
And it’s not that Zanzibar is going to be our solution - it literally can’t be, it’s internal only to Google, although copies are emerging. But our solutions will benefit from being aware of it’s approaches and architecture.