Latest / Identity at the Center / #170 - Fine Grained Authorization with Andres Aguiar

Transcript

#170 - Fine Grained Authorization with Andres Aguiar · Identity at the Center

0:09
You're listening to the identity of the center podcast, this is
0:13
the show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity of the
0:25
center podcast I'm Jeff. And that's Jim.
0:27
Hey Jim hey Jeff, how are you? Oh not so bad yourself.
0:31
I'm doing good. I've been super busy lately but
0:35
I look forward to this time each week where we get the just talk
0:38
about identity and access management.
0:42
But yeah lately I've been working on you know preparing
0:45
for a lot of upcoming events. I'm helping out Mike angle over
0:50
at one Cosmos with webinar. It's To be on what?
0:56
What happened to MFA? I don't they tried to fix
0:59
passwords. How do we fix MFA?
1:02
And so it's like kind of one of those topics that is getting a
1:06
lot of headlines lately, especially with some of the
1:09
things that have happened in the news.
1:12
So anybody who's interested in attending that webinar, it's
1:16
going to be on September, the 22nd at 1 p.m. eastern time USC.
1:24
I'm I should say and you can just go to one Cosmos.com to
1:28
register for that event. And like I said, it'll be Mike
1:31
angle CEO of one Cosmos on myself and on top of that, we've
1:36
got the authenticate conference which is the Fido Alliance
1:40
conference coming up in October and then the OCTA octane
1:44
conference which will be in November.
1:47
So, hopefully will be blessing through a bunch of additional
1:52
podcast episodes during those conversations.
1:54
Such as well, but I'm also hoping to be able to actually
1:57
sit in on some of the sessions because if you check out the
2:00
agendas of the conference's, it looks like a lot of good
2:03
content. Yeah.
2:05
I have not holding my breath especially because we're going
2:07
to be at we will be authentic 8, 20, 22, and we'll be doing
2:12
podcasting and you're a total slave driver when it comes to
2:15
booking guests. So I end up sitting in a room
2:18
somewhere recording and editing while you're out gallivanting
2:22
with the identi Rowdy but I am hopeful that I will have some
2:26
free time from my podcast Overlord here, to get to, you
2:32
know, take in some of the sessions at least it.
2:34
Jeff. I think this would be a good
2:36
time to tell the story about authenticate 2021 because again,
2:39
I pretty much tried to do the same thing to you again.
2:43
Yeah, well I mean the story is is it's a story as old as time,
2:48
right? Jim volunteers to give a
2:50
presentation at a Pattaya at a conference.
2:53
I'm like, yeah, I don't want to do it.
2:54
I will go and support you and you know, help with the content
2:57
and kind of stuff like that. And go cheer you on flash
3:01
forward to the day that we're flying out.
3:03
Jim Jim calls me sick. He's like, yeah, like you
3:06
probably shouldn't go. This is the height of the height
3:08
of the pandemic, right? If you're coughing, you probably
3:12
have covid or at least, that's what ever is going to assume.
3:14
So I was like, all right, well, I guess I'm given given the
3:17
given the, the talk at the conference which I did and you
3:20
totally left me high and dry and I will never let you live it
3:23
down. And you continue to volunteer
3:25
for for speaking engagements, and my fear is that I end up
3:30
having to do it by myself around or something like that.
3:34
Yeah, well hey, I was just appointed to because I had
3:37
gotten upgraded to first class it was the day before and then I
3:41
guess you're most concerned about was that was what was just
3:43
worried about. Not the fact that you had to do
3:45
the presentation by yourself and by the way I did submit a
3:48
question for you to answer. Yeah.
3:51
What is I? What is I am?
3:53
That's a running joke. We always have whatever company
3:56
we have to be working with. Yeah, so we got a bunch of
3:58
different things going on. We've got, you got the one
4:01
Cosmos webinar you'll be doing. I'll put a link in the show
4:03
notes so people can you know if you if you support the podcast
4:06
go support Jim I can't make it I'll be on a flight so I'll be
4:09
probably listening to it either on the flight or catching it
4:12
afterwards but you can register I'm sure they'll be a replay for
4:15
that will be assigned a Kate's 2022 in Seattle in October so
4:20
hopefully I will get to meet some folks there as well and
4:23
then we'll be at the Tain conference at least that's what
4:25
we're planning on in San Francisco in November
4:29
potentially doing some more podcasting and talking with
4:32
interesting folks in the identity world and sort of kind
4:35
of covering that event and ya doing that kind of thing.
4:38
So I think that's a great segue to lead into our guest, who is
4:42
from OCTA. We'll get to that.
4:44
His name is Andreas. I gr he's the product and
4:47
Engineering leader with OCTA. Welcome to the show Andreas.
4:52
Thank you, chef and Jean. Very happy to be here with you
4:54
today. Hopefully, I didn't butcher your
4:57
last name, too bad. I tried to try to try to get as
5:00
right as I can. But you're also joining us from
5:03
a country. We have not yet.
5:04
Spoken least. I haven't ordered way.
5:06
So thank you for joining us from the the southern hemisphere as
5:09
well. One of the things that we like
5:11
to get into when we have a guest on.
5:13
For the first time is to really kind of learn the origin story.
5:16
How do people get into identity kind of helped set the context
5:20
of kind of your perspective? And And how you approach things.
5:23
So I think that maybe to kick off this conversation before we
5:27
get to our main topic, which is going to be around fine, grains,
5:29
authorizations or fga. Tell us a little bit about your
5:33
identity back story. How did you get into its into
5:36
this field? Is it something that you chose
5:38
or did the identity World? Choose?
5:40
You okay. Yeah.
5:41
So I mainly work in companies that build developer tools to
5:45
become a pro products in the past and so that's my main
5:49
background and they always work in.
5:51
Those kind of companies and the and five years ago, I had the
5:55
opportunity to join dog's ear. I knew both co-founders one
5:59
information Tina, which is very close to your work, both from
6:02
Argentina, but one of them was working with us and then I have
6:07
a chance and I'll see you had that interesting blend of being
6:10
a company that Target developers, but also working,
6:13
but identity. So I kind of got to identity by
6:17
the development tools are the relevant product.
6:21
World and and I quickly got into the core of zero.
6:26
So building the log in and MFA flows as a product manager.
6:30
So I had to get up to speed pretty quickly.
6:33
I've been working this domain for almost six years already.
6:36
So yeah, that's my journey to Italy, and in the last few
6:41
months, I moved to work on the authorization side.
6:44
And that is what campus brings us here today and I dress, I
6:49
have to give a shout out to My pastor, who is your colleague
6:54
from actor and by the way, for anybody who's listening, he's is
6:58
a great follow on LinkedIn, and he'd be more than happy.
7:01
I think to connect with just about anybody, but he introduces
7:06
to you and introduce this idea of something that you're working
7:10
on, F G, A fine-grained access. Our fine-grained authorization,
7:16
and authorization is such a big topic and identity and access
7:21
management. Judgment.
7:22
And it's something that people tend to get into as they are
7:25
further along in their Journey. So what I thought we could
7:29
basically start out with was kind of a 101, you know, talking
7:33
about what is authorization. And then one is fine, grained,
7:37
authorization, sounds good. So it's basically going to use
7:42
authentication and authorization.
7:44
So let's start by talking about both authentication.
7:47
In general, is to tries to prove that you are.
7:52
Specific person right in general.
7:54
They kind of, you kind of prove that you are specific person by
7:57
logging into a site. But basically, what you're
7:59
proving is that the convention that you still have access to
8:02
the same credentials that you use when you register for that
8:06
site, right? So if I had a phone number a
8:08
password email I still have it and I can still provide it as a
8:12
proof that I'm the sick person who logged in the encourages to
8:16
the site. So authentication authorization
8:20
of the other side is More. What are the things that you can
8:24
do once you login to that site, right?
8:27
So the permissions the actions that I can perform can I perform
8:31
this specific actionable specific page or resource or
8:34
document that is more about authorization.
8:36
The permissions you have your system.
8:38
The, for example, that now Twitter, you some people can
8:43
reply to specifically, right? So depending of how you treat,
8:46
you can say, all the people who are mentioned can reply to the
8:49
street when I login. To Twitter and we authorized or
8:53
not to reply to a tweet depending on those authorization
8:56
policies that Twitter specify in their application with find a
9:03
notarization. It's in general, when you or the
9:07
initial ways, we implemented authorization in the industry.
9:11
Where course training, mainly role-based Access Control, when
9:17
you basically decide that. Yeah, this is specific.
9:21
We can perform these actions and the actions are very generic.
9:25
Like, for example, post a tweet or deleted, tweet, right?
9:29
And but it was not posses not possible with role-based access
9:33
to specify things like a only. The people who were mentioned in
9:37
the Tweet. Can we fight between?
9:39
Because it's not enough to say the role you have to order to
9:43
decide if you can perform the action or not, right?
9:46
So depending on how groundwater the permissions that you need to
9:50
specify in your system, you You might need to implement
9:52
fine-grained authorization model or a coarse grater.
9:55
Authorization model like role-based Access Control.
9:59
Yeah, now that's a great introduction.
10:02
One of the things that I find is that, you know, sometimes people
10:06
get tripped up on, you know, how to use a term.
10:10
So, the term rolls gets used by so differently by so many
10:15
different folks, and so many different contacts.
10:17
Sometimes this product specific sometimes is You know, the
10:22
generic term of roles. So you know, using that one term
10:26
differently. But then there are other
10:27
situations where you have two different terms but they get
10:32
confused or used in place of one another.
10:36
And for me that's the term authorization and entitlements
10:42
and I'm wondering if you kind of help us differentiate between
10:44
those two terms. Actually this interesting
10:48
because you mentioned this question in our previous
10:52
conversations and I say it's hard to explain, right?
10:56
So I was trying to try to think a little about how to explain it
10:59
and the because at the end of the day it's they are very
11:02
related. So entitlements are the things
11:06
that the traits of the properties that the user has and
11:11
based on that, you defined, if the user is authorized to the
11:14
perform an action or not, right? For example, the fact that I
11:17
belong to a role is an entitlement.
11:20
The fact that From a user, can perform this actually they
11:23
belong to that role that is authorized and authorization
11:26
code, right? And in general, entitlements can
11:30
come from two places. One of a kind of?
11:32
Yeah, the themes that you are allowed to roles is an
11:35
entitlement, but can only be can also be like a, you are, you're
11:38
using a B2B sus product, you're using like the basic tier, the
11:43
basic tier can only use some features, okay.
11:47
That's also an entitlement, right?
11:48
The features that I can use as a users of the Product.
11:52
So, there's a lot of things that can that feel like they fit the
11:56
profile of that user, that are properties of the use of that
11:59
can be, then used for making authorization decisions.
12:03
Yeah, here we have a similar question that we did an episode
12:06
on similar in style which was what's the difference between
12:10
digital identity and identity and access management?
12:14
And it's like you know it's actually a deeper answer and
12:19
everybody answers it a little bit.
12:21
Ali and for me with the entitlements, in the
12:23
authorizations, like entitlements are the data and
12:30
authorization is the enactment of that data and you know, I
12:34
made up that term enactment and then what I realized was you
12:37
know, the terms are very important and I kind of thought
12:41
back when was thinking about authorization to the exact Kamal
12:46
standard, right? I mean that was like that.
12:49
Was it for authorization back. In the day and everybody thought
12:53
like okay that's the shift that's going to take place.
12:57
I wonder really what ever happened with exact Moses still
13:01
important are people still you know, does it have a future?
13:05
So that's my first question. My second question is, you know
13:09
what I liked about exact Mo was that it defined certain roles
13:14
within authorization. So you had your policy decision
13:18
Point, your policy enforcement point, So, if you think about
13:22
it, those are are very important.
13:24
Like we're, we're in the chain, are you deciding whether or not
13:29
an authorization should succeed? Where are you enforcing that?
13:33
Do you want to do that from a central location or within the
13:36
application? For example, policy
13:39
Administration point. So all of those different roles
13:43
have, you know, exact definitions.
13:46
I'm wondering when it comes to like the fine-grained
13:50
authorization or An authorization in general.
13:53
Are those roll names even relevant anymore?
13:56
And then, you know, I know, I'm asking a lot of questions.
13:59
All combined into one question here, but, you know, I think we
14:02
just need to know about this. Like the I am practitioner level
14:06
like, what do I actually need to know?
14:08
This isn't really like the developer podcast but like, if
14:11
I'm somebody who's implementing, I am systems.
14:14
What is it about these Concepts that are still relevant today.
14:19
But the so I will Sandeep. Into identity when accessible
14:23
happens. So I don't know what are the how
14:27
it began to become a think I can.
14:30
It fair based on the context. So the moment most of the
14:36
industry was building XML based specifications for everything,
14:39
right? And and, and certainly helps to
14:44
Define specification for doing attribute based access control.
14:48
That was it, something still very relevant right doing
14:51
achieving Basics control, and there wasn't a standard way of
14:54
doing it. So excitable specification, try
14:58
to feel that boys, and I think that's why it's important to to
15:02
Define standard that he had killed people amend this in a
15:05
way that is interoperable and, and that companies can use
15:09
consistently across different vendors in.
15:12
I haven't seen picking it up a lot of steam.
15:15
So there's there's a few companies that implemented that,
15:19
but if they didn't become Real standard that is widely adopted
15:24
by. It is a regular standard but
15:26
it's dot divided of industry and the.
15:29
And, and right now, for example, in 0dr, we are implementing
15:33
motorization products that are not using such as a way to
15:37
specify permissions and the industry they're having other
15:41
approaches. There's a product called open
15:43
policy, Asian that is very successful in managing
15:46
permissions for for infrastructure things, right?
15:50
Yes, that That defines policies in a different way and it has
15:53
become like a de facto standard for defining.
15:56
Authorization policy is not context and the, and it's not
15:59
using exactly, right? So, so from that perspective, I
16:03
think it's is that was an interesting attempt by the
16:06
industry, but we didn't pick up enough or they have enough spare
16:13
an option to to be significantly less relevant.
16:16
Today, that's my personal opinion, the in the Like, the
16:22
different enforcement different enforcement Point decision
16:26
points that exactly Define those concepts are still relevant.
16:30
So, there's a place where you need to enforce your physician
16:34
policy and it can be in the application can be in an API
16:37
Gateway, and then, whatever you decide you can be in an API
16:41
proxy. So it'll be a different places
16:44
where you can decide where you want to call the code.
16:49
That is going to enforce the policy.
16:51
Right based on to decide if the user can log in or not, right?
16:54
So you have elected enforcement point, which is, yeah, if I'm
16:58
building application in the chat with just with code, I will be
17:02
at the beginning of my API implementation, right?
17:05
That is the case. I will be checked if the
17:07
provision in the users permission to perform the action
17:11
about, then you have the decision point, which will be
17:14
okay if I'm using an external eyes for Lizzie.
17:16
And Jane, I will call at that moment, a different service that
17:20
is going to tell me. That is the use of company from
17:22
the actual amount that will be the only decision point for him
17:26
and that if I'm building an application with without an
17:29
externalized addition policy Engine with vision point is
17:34
going to be also in cold right? I wanted right myself like after
17:39
in the same routine that I'm checking the user can perform an
17:41
action, I'm going to ask you to use a positive role, right?
17:44
And that will be the decision party will be in code so it can
17:47
be different places depending on how you want to architect your
17:51
And other Concepts, they are our Administration.
17:54
There, only thing ministration point.
17:55
If you are using a product that policies are not in cold, you
17:59
need a way to manage those. Right?
18:02
That's still the case, right? If you using any service to
18:07
manage to manage your voltage protection policies, you need a
18:10
way to meet and to manage them right before we see a nutrition
18:13
point, and then you have the policy information point, you
18:17
need data to make those decisions, all right?
18:19
Who's going to get that data? Okay, that's to all of those
18:23
Concepts still exist in a simple app.
18:26
They can be all in the code, right?
18:28
But in more sophisticated architecture where you want to
18:31
decouple those things. Yes, those are going to be in
18:33
the in different services that can manage sometimes all of them
18:38
together, sometimes one for each of these points, right?
18:42
You may have a tool to - fall into the nailer to do to handle
18:46
the data and another to handle the decision and, and the so
18:49
yeah. DB still relevant and useful.
18:53
To reason about how authorization is implemented on
18:56
a protected in the system. Yeah.
18:58
So when you're putting together that architecture diagram of how
19:02
you're doing authorization those terms and kind of identifying,
19:07
those points are so important. Yeah, have a kind of a long
19:12
history in the access management side if I and kind of thinking
19:17
about how a lot of access management systems Worked, you
19:21
know, pre-op. Today's right.
19:23
So, it was that were coals and site minders.
19:26
And the most commonly used integration pattern was you
19:32
would install an agent. A filter on your web server,
19:37
your Java server or your is server for example and it would
19:44
filter requests every HTTP request and those systems became
19:49
good at Kind of coarse-grained authentication which was that
19:53
the level of you know, this subdirectory or you know,
19:57
basically using your L filtering like you either have access to
20:02
it or you don't which kind of led me to my next question,
20:07
right? Because that's not the way
20:08
applications are built today at, all right, through there,
20:12
primarily using open ID, connect or summer, using sam'l, but it's
20:18
still ultimately. Order to get to that that level
20:22
of fine-grained authentication or authorization.
20:26
I should say, is generally, passing data to the application.
20:31
And the enforcement point is that the application Level, I'm
20:35
wondering with fine-grained authorization, you know, is it
20:39
dependent on any of the specific authentication Technologies or,
20:48
you know, like sam'l or Nid connect like is f, g, a
20:53
required, requiring one or one of those standards to ride on
21:00
top of and then ultimately is the data that's coming from fga
21:06
taking over any of the like decision point or enforcement
21:10
point, or is it still coming back to the application to
21:13
enforce? Okay, this person has access to
21:16
this button, I'm going to show them the button.
21:20
Cetera. Okay, so when we talk about ABC,
21:24
a there are kind of two main ways of implementing a ga one is
21:30
called a buck attribute based access control.
21:33
And the other one is called agree.
21:34
Back relationship based at this control and in both cases, what
21:39
you end up relying to is on an identifier that you get from
21:46
whatever way you ended up knowing the into the application
21:48
if you are using On ivp. Who do I?
21:51
DC, you're going to get subject from the ID token or the access
21:55
token, and you want to use that as the user ID, right?
21:58
And then you're going to, for example, if you use a back, a
22:02
bike is activates as a control and you're going to probably
22:05
required data from your database to decide if the user can
22:09
perform an action. So let's say you want to
22:12
approve. You have an endpoint that you
22:14
want to approve if a user can verify for you.
22:19
So kind of An expense report, right?
22:21
So the usage standpoint is approved to support.
22:24
You need to check that the user has permission to do that.
22:27
You will need to know if the user can directly see if expense
22:31
report, not any extension cord to do that.
22:33
You need data, are you need to know?
22:35
For example, is the, the person who submitted the expense report
22:40
is, is a direct report of the person, who is approving.
22:45
So that could be a huge skate, right?
22:46
So I can only approve expense reports from my direct reports.
22:49
Need to check if the in the submitted of that expense report
22:53
is a direct report from the user that is submitted, I've proven
22:57
it. So the to do that, I go to the
23:00
database, I get the data and the and then I decide if I want to
23:04
let the user approve, the expense or not, you know, that I
23:08
get the user ID that I got from the ID token.
23:10
And I go to my bed, I use and find if that user ID is the
23:15
manager of the submitter of the report.
23:17
And if that's the case, then I let him go.
23:20
So from that perspective is I'm you doing fighting for position
23:24
and relying on whatever user ID was provided to me, that's fine.
23:29
There are other ways to implementing regulation with
23:31
like relationship based Access Control those.
23:34
The, their active products try to do that today and mostly
23:38
inspired the implementation by Google called Google design
23:42
similar. So, Google's published a paper,
23:44
how they did their internal authorization service which was
23:48
called groups and simmer. The We got works, is you
23:51
specified relationship between different entities.
23:54
So you can say this user is the manager of this under user, this
24:01
user it was the submitter of this country port and their use
24:05
the user ID is that were provided by your IDP, right?
24:08
So in any case you are bound to specific authentication method,
24:12
you can use any way to authenticate and still do fine
24:16
game creation with a vac or with relation babe.
24:20
Three back, right? So both work does the
24:22
application development need to be developed with fga in mind,
24:27
or can you take an application that was developed previously
24:31
and integrated into an f g? A based framework, if you think,
24:36
especially as a generic term then and let's say you are you
24:41
have an application built with role-based Access Control,
24:44
right? And then you have this is an
24:46
area where you want to approve the expense on If the user
24:52
disapproving, it is the manager of Gregor submitted a report.
24:58
The you can just do an extra query in that method, right?
25:04
And and then then you're going to have funding for Education,
25:07
okay? So find Reference Station is
25:09
kind of, I don't rely just on role-based data.
25:14
I I need to know data about the specific resource.
25:18
I'm Changing or an actin on to make a decision.
25:22
So from that perspective, it can be usually most role-based
25:26
interpretations today, end up doing some kind of a back
25:29
because at some moment, they need to make a decision about
25:34
the specific resource of the Pacific record that the user can
25:36
access, okay? So from that perspective, is
25:40
there's nothing to change and it's it's a way to gradually go
25:44
from role-based access to attribute based access by adding
25:48
more queries on your product. Now, if you want to build a more
25:51
sophisticated instrumentation of attribute based access control
25:54
and you want to do, for example, a policy based Access Control
25:58
where the definition of that access policy is subsiding
26:02
product at some of the code then, yes, you would need to
26:06
architect your application differently.
26:07
The find operation policy somewhere else in an external
26:11
tool or product, right? And then from your code, call
26:15
those policies that implies. Yeah.
26:17
You can do that gradually. But it's a Change on your
26:20
application. And that, if you are using a
26:23
product that is relationship based access control, the weight
26:27
loss product works, is that they need the data of how users are
26:31
related between themselves and with the different entities to
26:34
make a decision. So, you know, so you need to put
26:38
all push all the data from your existing systems into those FCA
26:43
stores, so then they can make the decision, right?
26:46
If you that, and that is that also, Quite see ya thinking with
26:51
that way because requires a lot of work to get all the data in
26:55
that system, to then be able to call it and that we low latency
26:59
from your endpoints, right? I think that's where it's so
27:03
data. Dependent sounds like to me and
27:04
you can feel free to educate me on this, but I think of things
27:08
like our back P. Back a back.
27:12
We talked with K back, knowledge base with indication you
27:15
mentioned reback, relationship based authentication, which
27:18
maybe is the same sort of thing. We settled on a acronym for it,
27:22
but the underlying pinning for all this is the quality of the
27:26
data and the amount of data to be able to make those sorts of
27:29
decisions. Judging by the name
27:32
fine-grained, you know, authorization, I'm assuming that
27:35
we need to have a lot of, you know, metadata to be able to
27:38
make these sorts of decisions. You mentioned the ability to
27:43
make these decisions and more real-time format, which I think
27:45
is kind of where the direction of a back typically goes.
27:49
We know about, A lot of struggles that organizations
27:51
have with our back and trying to get roles implemented from your
27:55
perspective. Where do you see f g a kind of
27:58
fitting into that world of you know, organizations.
28:01
They say they want to be role-based Access Control.
28:03
Okay, great. And then they realize how hard
28:05
it is and they sort of like stumble through it in the maybe
28:07
they settle on attribute based access control is fga.
28:12
Basically taking attribute based Access Control to the next level
28:17
by having just more. To be able to make those
28:20
decisions. Or does it fit somewhere else
28:22
within that sort of that ecosphere, of different
28:25
authorization models? Yeah, so just to clarify their
28:29
interview. So attribute based access
28:31
control is at GA, okay? So, because it's not coarse
28:35
grain in the sentence of all only talking about the roles
28:39
you. When you talk about an
28:40
attribute, then the ultimate can be as like fine grained as the
28:44
specific document. So you have a permission for a
28:47
specific document, you can build that with a bat.
28:50
Fermentation, right? If you want to use a VGA with re
28:54
re re re back implementation relationship-based, then the
28:58
Reebok ancient, we will need all the data to make the decisions.
29:02
So maybe explain a little more, how that Reebok works and
29:06
decency. Work mode works to this to make
29:09
more sense. So the way through Google had a
29:12
problem back in the in the think they did this initially for
29:17
Google+, which I It's probably early 2010, 2012, something
29:24
around the date, right? And they decided they want to
29:26
build an externalized, Sprite to manage population, and they end
29:30
up building service that they use for all products in Google.
29:34
So each time you share a document in Google with specific
29:38
person, you are writing a feel at beta, some data into the
29:41
Sunset Bar annotation and why what it needed to do that for
29:47
two reasons. First, they wanted to have a
29:49
consistent isn't way to define a manage authorization across
29:54
Google for all products. In most cases, what happens
29:58
today is like a URL to a company.
30:00
There are 10 20 teams they need to build for ization.
30:03
They do it all your different way and the and in this case,
30:06
what we will say is we want a consistent way, same apis, same
30:10
thing where you thinking for all of our teams, okay?
30:13
And and then, they also needed to scale for Google Docs and so
30:19
each time you Of P permission to someone that if someone else
30:22
wants to access the document that needs to be very fast, very
30:25
low latency High availability, right?
30:28
So we need to build product that help doing that.
30:32
The issue with a back is that in a but you need to go and get the
30:35
data yourself. And it's usually happens in your
30:38
existing transactional databases, right?
30:41
So I want to know who is the manager of the this user need to
30:45
be two. Adjoining some table, right?
30:48
Check the expense report data. I'll look at the expense report
30:51
tail and the and make you thinking for World up, like a
30:54
service calls, another service, we could go to another service.
30:57
Each of those areas need to do the same.
30:59
Sometimes the same database queries, something different,
31:02
sometimes the different services, that adds a lot of
31:04
latency, a lot of potential points of failure, like any of
31:09
those Services down, there is very low impact that API call.
31:14
So, what Google said is to be able to make those decisions in
31:19
a way. That is scalable, no, latency
31:22
and reliable. We need the data.
31:24
So we cannot rely on the developers.
31:27
Only Kermit people who's implementing this, go and get
31:29
the data. At the moment of evaluation, we
31:32
need to have the data before. So, what they Define, it's a
31:35
model where you provide to us and see our store.
31:39
Tuples that basically say this user is a member of the strong
31:44
this user can write this document.
31:46
This role can write this document and things like that,
31:49
right? This group can write this file
31:51
into this folder so they are policies, permissions that you
31:55
assigned to different entities into different resources.
31:59
And based on that when you need to ask can chef at this document
32:03
it will say yes or no yes or no, depending on the folder, they
32:07
were comedy is the group you are the road, you have the
32:10
organization, you belong to things, right?
32:13
And that so that is that I could be like, a bit
32:15
relationship-based, FC, a model and which is the That I'm
32:20
working on in after and the and then there's a few people trying
32:24
to build the same kind of intimidation, right?
32:27
Which is trying to solve that problem and that problem
32:30
requires the data and then one of the problems of people
32:33
amending a solution like this is that you need to get all the
32:36
data into the store which might be challenging depending on your
32:40
architecture, your project. It sounds like what you're
32:44
describing to me. Sounds awful lot like a
32:47
Knowledge Graph essentially. Yes, and building a centralized
32:50
repository of all this data is that the is that the gist of
32:54
this? Is there needs to be some sort
32:55
of Central master database, table, graph, whatever
33:01
technology, right, as being blockchain, as much as I hate to
33:03
use that word, right? We're all this data is basically
33:07
stored centralized kept up to date and then leveraged as the
33:13
Of source for these sorts of decisions when it comes to
33:17
authorization is that? Yes, and accurate way to portray
33:20
it. Yes.
33:21
And I need to know that we need all the data, right?
33:24
We just need the minimal data possible to make this analysis
33:28
of decisions. For example, recognition know,
33:31
back, when I need to know this document ID is is in this folder
33:36
ID, right. I don't need to know the content
33:39
of the document, the title document, nothing else, right?
33:42
So chefs there. The IDS of the relate of the
33:45
entities and how they are related with right and the and
33:50
with that you can make good decisions in a way that is very
33:53
fast. Scalable glorious event.
33:55
And there's so that that is what what?
33:58
And that is kind of the the new kid on the Block right over, how
34:01
to build authorization today and what what, what is a lot of
34:05
companies are trying to implement this after Google, did
34:08
it? There were a lot of other
34:11
companies that try to do similar things.
34:13
We like, BRB Expedia car that they are all, give their all
34:17
flavors of something. It is and that's what kind of
34:20
gave up gave us kind of more certainty to try to follow this
34:25
path because it seems like a it was a good path to take.
34:29
And that the challenge for us was that we need wanted to build
34:31
access product, right? So it's not a product that
34:33
you're going to put Bill itself and host inside your company,
34:36
that is tuned for your specific scenario.
34:39
We need the product that you bring any wood, could use and
34:42
anywhere could Define the their own entities and relationships.
34:47
A lot of the use cases that you just described and even kind of
34:50
the companies that have gone down this path are
34:52
consumer-focused, is that really sort of the intention for f g.
34:57
A is it is it more of a consumer-focused sort of
35:00
approach. You did talk about some
35:02
potential you know use cases inside a little calm like
35:05
Enterprise use cases. But I don't know if most
35:08
Enterprises are to the maturity level.
35:10
At this point to be able to have the the number quality of
35:16
attributes. Get to make some of these
35:17
decisions. I guess where do you see sort of
35:20
like the main use case for fga at this point?
35:23
Yeah. So We've been talking to a lot
35:26
of companies and that is that you want to do and something
35:30
that is and most of the use cases are B2 Visa scenarios.
35:34
If you think about the B2B SAS, it's interesting because you
35:37
need, when you start your first version of a B2B such product,
35:42
you probably don't have like a we have an admin role and a user
35:46
role and and that's enough for be 1, right?
35:50
And after that application involves and you start getting
35:53
more sophisticated customers, there are Ask you for more
35:56
sophistication, how you manage permissions together, right?
36:00
So, first time I asked you, I want Rose.
36:02
Then I ask, you know, I want to actually Implement find an
36:05
authorization, which is the producers can access different
36:08
specific documents, and folders depending on who they are and
36:11
things like that, right? So and so in our view, every B2B
36:17
sales company will eventually need to implement finding
36:20
authorization in the products because that's what customers.
36:25
Their Enterprise customers are asking them, right?
36:28
And and the initially maybe the smaller customers want when they
36:31
want to go kind of Upstream in the cotton, the size of the
36:35
companies they are requiring, those kind of permissions.
36:39
So so yes. So we see a lot of a lot of
36:43
opportunity there for me to be such companies to implement
36:46
cyclization and also like a initially in inevitably such
36:51
product. By definition, you have like a
36:54
one attribute Which is their tenant of the customer right
36:58
that that the Sailor Gates information, right?
37:01
So if you're an admin of an organization, you cannot see
37:04
data from another organization, right?
37:07
So that is already a biker, a little fine-grained in the sense
37:11
that is, you cannot model that just withdrawals.
37:13
You need to also have at least one attribute, which is the
37:16
organization that the user belongs to write to filter data
37:19
depending on that. And then and then it gets more
37:22
complex like a, you want to be the team.
37:25
Teams like a have people, which I have two folders and then they
37:28
want to share documents with with themselves with different
37:30
permissions. So it gets more complex in a lot
37:33
of those p2b scenarios and product like this.
37:36
Kind of makes sense and dryer cycle.
37:40
Oh my God, I just couldn't help. I mean, we're on audio only
37:43
podcast but we have our cameras on couldn't help, but notice you
37:47
have a shirt on this as open f, g a, and you talk to us a little
37:53
bit about what that is. I'm assuming that's part of your
37:56
mission in life at the moment, so Co and milk.
38:03
I'll tell you, it was acquired by October and couple of years
38:05
ago and the end at the moment, we were building a product for
38:09
solving find an authorization and the 0, it has more the
38:14
developer brand. And so we ended up naming our
38:18
initial project out 0ga, even if it was already part of vodka.
38:23
And then and and then we decided to open source it.
38:27
Okay, so right now I'm working in my mission in life is to
38:31
products one. Is called oxidative GA and
38:34
another one that is called open up.
38:36
See a opening gav open source version 2.0 GPA.
38:39
We use open appreciated peeled also York, CA and the and the
38:45
and the goal is that. Yes, we we want to be able to
38:48
open a ga with the industry. We think that a product like,
38:52
this is gonna be very important moving forward for building
38:56
authorization. And in, in all of these cases
39:00
we've been discussing and And we think the company like, OCTA can
39:05
with the right Partners can make this reality.
39:07
Like, having a de facto standard of implementing finalization is
39:12
relationship based Access Control way.
39:14
And so, and we think the way to do that is through open source,
39:18
and, but we have customers that want to also buy managed service
39:24
that they don't need to maintain the need to operate that.
39:27
They make sure the security is taken care of by that the
39:31
compliance is ticking. Heroes are those kind of things
39:34
and for that, we are still going to have a cloud version of a
39:37
product that you can use without costing it yourself.
39:41
Now, let's create a mini, no pictures, had a big impact on
39:44
our industry over time and you know, it's good to see that that
39:48
spirit is still kind of alive and well.
39:51
Yes, and let's see row and Uncle, both have been
39:54
contributing to open source for a while.
39:56
But we it's his first time in that.
39:58
We kind of launch product that is complete core of the product
40:01
is open source. Right, we have a lot of holes,
40:04
open source, libraries and things that you can use with
40:06
alter or at 0 but never kind of met product that was built that
40:11
way. So it's pretty exciting to met
40:13
expected. so, if I were to look into the knowledge graph of
40:25
Andreas. What would I find as the go-to
40:28
karaoke song for you going to end things?
40:31
On a lighter note here. So this is my way of tying it
40:34
back together. I'm thinking of the fine grains,
40:37
you know authorization that says hey Andre is is about to perform
40:41
karaoke. Here is the song that he's going
40:44
to perform. Yeah.
40:46
So it's fun because karaoke songs tempting to be like our
40:49
songs, everyone everybody knows and likes to seeing and are fun
40:53
and I usually don't like to sing.
40:55
Songs are more like a like to sing a song I like and so my
41:00
go-to song is down the road from Bruce Springsteen and the area
41:06
when I see it in your way nobody knows it and you know a lot of
41:09
people so it's not as fun and the when I sing it in New Jersey
41:14
that is more time. But by Kim.
41:17
What's your your go-to for karaoke?
41:20
I mean I have to admit like the hardest part about doing a
41:24
podcast. It is listening to the podcast
41:27
once in a while and hearing my own voice.
41:29
So it doesn't get any better when I do karaoke and someone
41:33
thinks a video of it and I'm like, oh my god did I really get
41:37
up and sound like that? But, you know, a few shots of
41:42
whiskey, or whatever. It takes to get up there on that
41:45
stage. So if I'm with Denise, my
41:48
girlfriend seems too nice if I'm with her, we like to do Kid,
41:53
Rock duet with Sheryl Crow, picture.
41:59
And so, that's our go-to for when were together.
42:03
Now, if I do a solo, it's going to be terrible.
42:05
No matter what, but I like anything by ZZ Top.
42:11
And I also like poison, so any anything within their catalog?
42:18
But it's just a lot of just sounds like a lot of screaming.
42:20
Jeff, it's not good. So what I'm there with Denise, I
42:24
tried pick a Song, where the male part is very short and the
42:27
female part is the dominant part.
42:30
And so that's kind of what we've settled on what about you have?
42:34
Probably, I mean, that's probably the way to go because
42:37
she's like a professional singer.
42:38
So, yeah, oh yeah, yeah. No, I mean, nobody, who's there
42:43
at the bar or whatever they were doing in the karaoke yet wants
42:47
to hear me, they bub when she sings.
42:49
It's like oh, you know people start coming up to her and
42:52
asking her to do duets with them.
42:54
I'm like, okay. I'm here.
42:55
I'm here. I'm with you on the voice thing.
43:01
II. Do not have a voice for singing.
43:03
You could argue. I don't have a voice for talking
43:04
either but I still have some how to do it.
43:07
I think for me it's probably, you know, I like to go back to
43:11
my guys at Queen and Duke Bohemian Rhapsody Grant you
43:15
know. It is something that I generally
43:19
only perform after severe and you variation.
43:22
That's just saying which is a very rare Occurrence for me and
43:26
I will absolutely sing every part of that song, including all
43:30
the highs and the lows and everything.
43:32
Now I said saying I didn't say sing well, so I just kind of
43:35
make that stipulation out there that it is unlikely that anyone
43:39
will ever witness this and it is probably for their own benefit
43:42
that they do not. But that that's my go-to would
43:44
be Bohemian Rhapsody by Queen. Well at least you picked a short
43:48
song. Yeah exactly.
43:50
For long. The pain for everybody.
43:52
Yeah. That's what I actually like the
43:55
It's like putting you into the system like yeah, we don't have
43:58
that song that's like Stairway to Heaven, right?
44:01
You don't go into the guitar store and start playing that.
44:05
That's right. A bird or something like that
44:07
Andres. You've been very generous with
44:08
your time and I want to make sure you can get on with your
44:10
with your day here. Before we wrap things up, you've
44:14
educated it myself. And hopefully others all about f
44:19
g, a and sort of where it fits within the, the identity and
44:21
access management ecosphere. Are there any final?
44:25
Thoughts or takeaways that you'd like to get out there for the
44:27
folks who are listening that want to either get more
44:29
information about or things that they should be thinking about
44:31
when it comes to fga? Yeah, so I would recommend them
44:36
to Google about Google about Google sansevieria and because
44:42
it's kind of it seems to be becoming like a popular way to
44:46
implement authorization in general and it has like a diss
44:50
to great things which is a way to do find reforestation.
44:55
And also way to have a centralized way to manage
44:58
organization in the company, right?
45:01
And both things are very valuable in the so I hope and I
45:07
think that the next few years, this will become a thing.
45:10
And other people are going to be like, trying to implement the
45:14
requirement in this model. So it might be a good thing to
45:18
start learning about it. Right.
45:21
And and I'll have a link in our show notes to open fda.gov which
45:26
looks like a pretty good website for folks who are interested in
45:28
want to get more involved with sort of what it is.
45:31
Learn more about. It is in addition to Googling,
45:34
it is weird to say Google. Google's and Zanzibar, it sounds
45:36
like a double negative. But here we are Jim.
45:39
How about yourself? Any final thoughts from
45:41
fine-grained authorizations or, you know, singing Melodies with
45:47
your girlfriend. Nothing else, home singing?
45:50
Yeah. Great.
45:50
Topic today, very informative hopefully somewhat entertaining
45:54
for folks. Just a reminder about the
45:57
webinar coming up in a couple weeks and hopefully we can we
46:02
can tweak those numbers and get a few more people to attend.
46:05
It's on the 22nd at 1 p.m. and will have a note to a note in
46:11
the show notes link to the to the podcast or I'm sorry the web
46:16
fire and finally a shot out to Mike.
46:19
Thanks a lot. Not for hooking us up with
46:22
Andreas because if it's a great guest today, thank you.
46:26
Andre has anybody who wants to link up with me on LinkedIn?
46:32
I'm very open and networking and I dries.
46:35
I would assume you are as well. Yes.
46:39
All right. If you kind of, you kind of
46:40
spell my name. Yuri, be able to find me a link.
46:43
Yeah, or well, we give me the show notes.
46:46
I will definitely have a link to your LinkedIn profile in our
46:49
show notes. People can check, I doubt
46:51
there's always links for Jim and I hate, you know, we're always
46:53
happy to connect with folks that are out there.
46:55
I'll have links to whole bunch of stuff.
46:56
Basically will have Andres our LinkedIn.
47:00
I'll have a link to open fda.gov will have a link to the webinar
47:04
that Jim is doing. It's called MFA tried to fix
47:07
passwords but how do we fix em, f a great sexy title.
47:11
I'm sure Jim will deliver and things like that.
47:14
So I think with that, we'll go ahead and leave it for this
47:18
week. You can check us out on the web,
47:20
I done to you. The center.com we're on Twitter
47:22
at idea. See podcast and yeah thanks
47:26
everyone for listening and we'll talk with everyone in the next
47:28
one. Thanks for listening to the
47:34
identity at the center podcast. If you like what you heard,
47:36
don't forget to subscribe and visit us on the web and identity
47:40
at the center.com.