Topaz

Infrastructure

authorization service

SHOW HN2022

Topaz

open-source authorization combining the best of OPA and Zanzibar

github.com

#authorization#zanzibar#open policy agent#rebac#access control

132points
32comments
#459of 2,570 in 2022
Top 18%of 2022 by points

How HN took it

DebatedReal support and real criticism

5 positive, 2 neutral or asking, 1 mixed, 4 critical, out of 12 comments about the project. Thread score +0.08.

Idea: 4 for, 0 againstPerformance: 0 for, 2 againstDocs: 0 for, 1 against

The thread, comment by comment

Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.

positive neutral or mixed critical about another commenter or something else the maker

What HN said

What people liked

  • Good to see an open-source authorization building block based on a robust model

    From 1 comment
    • Great to see an authz app building block based on a robust model as OSS. This is one of those things every app needs but so far most folks were building it in-house (as I can…
      janczukt on HN
  • Exciting to see the code released to the community

    From 1 comment
    • Great work Aserto team. Exciting to see this code released to the community.
      apoland on HN

Objections

  • Adds latency since it runs as a separate service rather than a library

    From 2 comments
    • Yet another golang gRPC authorization framework... That couple of ms response time for a decision could be fine,if you only call a couple of time per request,but its quickly adds…
      renszarv on HN
    • It looks interesting, but I would rather like a package I can import and use locally than running an independent service, because of latency/performance.
      lakomen on HN
  • Unclear technical details on the website and how it differs from OPA API clients

    From 1 comment
    • Congrats on the launch! Combining policy with Zanzibar is super cool and it's great to see the folks in the OPA ecosystem moving in this direction. Most of the novelty of the…
      jzelinskie on HN

Requests

  • Collaborate with SpiceDB or OpenFGA on the graph layer or directory contract

    From 2 comments
    • Both REST and built-ins for OPA have been available for existing projects like OpenFGA[0] and SpiceDB[1]. In case of SpiceDB, the first built-in was actually available in June of…
      jzelinskie on HN
    • Our design approach with Aserto has been to have a single OPA-based decision engine integrated with a built-in directory. So Topaz carries this forward. We do have a gRPC…
      ogazitt on HN
  • Offer an importable library option

    From 2 comments
    • It looks interesting, but I would rather like a package I can import and use locally than running an independent service, because of latency/performance.
      lakomen on HN
    • Both OpenFGA and SpiceDB are also implemented in Go, so they could also easily be included as a library. SpiceDB can even be compiled to WASM!
      jzelinskie on HN

Questions

  • How does it differ from using an OPA API client with SpiceDB and OpenFGA

    From 1 comment
    • Congrats on the launch! Combining policy with Zanzibar is super cool and it's great to see the folks in the OPA ecosystem moving in this direction. Most of the novelty of the…
      jzelinskie on HN
  • Which Zanzibar properties is it inspired by

    From 1 comment
    • Congrats on the launch! Combining policy with Zanzibar is super cool and it's great to see the folks in the OPA ecosystem moving in this direction. Most of the novelty of the…
      jzelinskie on HN

Alternatives named

  • OpenFGA

    From 2 comments
    • Love the growing number of OSS Zanzibar implementations, and congrats to the Aserto team for launching Topaz! Ory Keto's intro video @ SV IAM User Group [0] is worth a watch.…
      rhamzeh on HN
    • Both REST and built-ins for OPA have been available for existing projects like OpenFGA[0] and SpiceDB[1]. In case of SpiceDB, the first built-in was actually available in June of…
      jzelinskie on HN
  • SpiceDB

    From 2 comments
    • Love the growing number of OSS Zanzibar implementations, and congrats to the Aserto team for launching Topaz! Ory Keto's intro video @ SV IAM User Group [0] is worth a watch.…
      rhamzeh on HN
    • Both REST and built-ins for OPA have been available for existing projects like OpenFGA[0] and SpiceDB[1]. In case of SpiceDB, the first built-in was actually available in June of…
      jzelinskie on HN
  • Ory Keto

    From 1 comment
  • Permify

    From 1 comment
    • Love the growing number of OSS Zanzibar implementations, and congrats to the Aserto team for launching Topaz! Ory Keto's intro video @ SV IAM User Group [0] is worth a watch.…
      rhamzeh on HN
  • Oso

    From 1 comment
    • Hey, congrats on the launch! It’s great to see more activity in the authorization domain – a rising tide floats all boats. FWIW I totally see the benefit of having standards and…
      gneray on HN

Category, keywords, summaries and labels on this page were made by AI (Thread Reader v2) and not checked by hand. Each point links to the comments it came from.

Add a badge to your READMEShown on HackerShow
[![Shown on HackerShow](https://hackershow.org/badge.svg)](https://hackershow.org/show/33317597)