Zanzibar: Google’s Consistent, Global Authorization System (2019)

Maybe a dumb question on standalone authorization services: does the authorization service end up having a representation for every single object in all of the rest of your datastores? (e.g. every document, every blob of storage, every user in every org).<p>If so, does that become a chokepoint in a distributed microservice architecture? Or can that be avoided with an in-process or sidecar architecture in which a given microservice&#x27;s objects are not separately referenced in auth persistence? If not, how do folks determine which objects to register with the auth service and which to handle independently?

This was talked about 2 years ago on here[0]. This service was also brought up in the discussion[1] of Ory Keto, as it&#x27;s based on Zanzibar.<p>[0] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=20132520" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=20132520</a><p>[1] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26738344" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26738344</a>

There is an Open Source (Go) implementation of &quot;Zanzibar&quot; called Keto [0] that integrates with the rest of the Ory ecosystem. We are actually testing it and looks great so far.<p>[0]: <a href="https:&#x2F;&#x2F;github.com&#x2F;ory&#x2F;keto" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;ory&#x2F;keto</a>

I&#x27;m curious what&#x27;s driving the resurgence in interest authorization infrastructure, particularly the Zanzibar paper. As founder of Oso (<a href="https:&#x2F;&#x2F;www.osohq.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.osohq.com&#x2F;</a>), I have my own opinions, and I think this is a good thing. But would love to hear others&#x27; points of view here.

Here&#x27;s a decent twitter thread (2019) with some background on the project:<p><a href="https:&#x2F;&#x2F;twitter.com&#x2F;LeaKissner&#x2F;status&#x2F;1136631437514272768" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;LeaKissner&#x2F;status&#x2F;1136631437514272768</a>

I&#x27;m currently building an abstracted authorization system for PostgreSQL, and one problem I ran into were timing attacks. Granted, I only had an unoptimised prototype, but querying a table and only checking if the user has permission to read the objects after the fact led to being able to differentiate &quot;no matching object&quot; and &quot;one unavailable matching object&quot;. From skimming the paper, it seems Google use this approach, why are timing attacks not a problem for them? Is it because authorization checks are so fast? Or because they make sure only to query available objects, only using Zanzibar as a final &quot;just in case&quot; guard?

One of the authors is Mike Burrows -- <a href="https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;Michael_Burrows" rel="nofollow">https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;Michael_Burrows</a>

I&#x27;m just wondering if there&#x27;s a one size fits all solution for authz. I spent a few days on a use case : - users have one or several roles ( these are hierarchical ) - there are some objects in the system ( hierarchical too, eg files and folders ) - there are different features available according to a user&#x27;s subscription. I ended up with a 30 lines program which given a set of rules calculates who can access what in less than a millisecond. Does it worth an over-engineered mega system ?

Not to be confused with Uber&#x27;s Zanzibar: <a href="https:&#x2F;&#x2F;github.com&#x2F;uber&#x2F;zanzibar" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;uber&#x2F;zanzibar</a>

Great paper, lots of it got blended into our tech at <a href="https:&#x2F;&#x2F;build.security" rel="nofollow">https:&#x2F;&#x2F;build.security</a>

I’m curious about what their approach is to handle consistency with object creation and deletion in the client service. ie how do clients guarantee that the relevant ACLs are created and destroyed in Zanzibar when clients create and destroy their objects.<p>Destroy can be done asynchronously with durable messaging but asynchronous creation of ACLs is annoying from an api consumer perspective.

Is that a Metal Gear Solid[1] reference?<p>[1]: <a href="https:&#x2F;&#x2F;metalgear.fandom.com&#x2F;wiki&#x2F;Zanzibar_Land_Disturbance" rel="nofollow">https:&#x2F;&#x2F;metalgear.fandom.com&#x2F;wiki&#x2F;Zanzibar_Land_Disturbance</a>

Why did they name it Zanzibar?<p>Zanzibar is an island off the coast of East Africa known for being a place where people traded cotton for enslaved humans.<p>Not sure the connection.

Hmmh, auditing doesn&#x27;t seem to be mentioned in that paper. I&#x27;d think that&#x27;s a mandatory feature of an authorization service.

What is the status of xacml based solutions? Anyone using it?

Should add &quot;(2019)&quot; to the title

How is it not a SPOF?

(2019)<p>(maybe?)

Google stands on it.

It’s so tempting to make some snide remark about it being cancelled.

Interesting choice of name.<p><a href="https:&#x2F;&#x2F;www.researchgate.net&#x2F;publication&#x2F;325605315_The_1964_Zanzibar_Genocide_The_Politics_of_Denial" rel="nofollow">https:&#x2F;&#x2F;www.researchgate.net&#x2F;publication&#x2F;325605315_The_1964_...</a><p>&gt;On the fiftieth anniversary of the atrocious killing and raping of the Arabs of Zanzibar in the wake of the 1964 revolution in the Island, this paper sought to establish that this mayhem was genocide. In light of the almost complete failure to notice this tragedy, the paper pursued critical genocide studies and hidden genocide investigations to argue that this Arab tragedy in Zanzibar has been a denied genocide. Worse still, the paper showed that this genocide is commonly ignored even in studies devoted to bring to memory of hidden genocides life.

Somewhat off-topic I know, but I&#x27;d love to see this extended to some of the features that Sign in with Apple has in terms of private relay.<p>Signing in with Google yields (at a minimum) the e-mail address to the client which means that the list of third parties that have your e-mail (and can therefore spam you at will) is increasing exponentially. It would be great if Zanzibar extended the ACLs to include privacy controls with external services.<p>(Or I&#x27;m misunderstanding and this is only the component for internal Google authentication and not external federation for clients).

I can&#x27;t get over the name because I definitely had a memorable experience going to Zanzibar in Toronto (<a href="https:&#x2F;&#x2F;www.yelp.ca&#x2F;biz&#x2F;zanzibar-toronto" rel="nofollow">https:&#x2F;&#x2F;www.yelp.ca&#x2F;biz&#x2F;zanzibar-toronto</a>) shortly after turning 19.