flâneur

ABAC on SpiceDB: Enabling Netflix’s Complex Identity Types | by Netflix Technology Blog | Netflix TechBlog

netflixtechblog.com · 2,126 words · saved by 1 readers

The authorization team at Netflix recently sponsored work to add Attribute Based Access Control (ABAC) support to AuthZed’s open source Google Zanzibar inspired authorization system, SpiceDB. Netflix required attribute support in SpiceDB to support core Netflix application identity constructs. This post discusses why Netflix wanted ABAC support in SpiceDB, how Netflix collaborated with AuthZed, the end result–SpiceDB Caveats, and how Netflix may leverage this new feature. Netflix is always looking for security, ergonomic, or efficiency improvements, and this extends to authorization tools. Google Zanzibar is exciting to Netflix as it makes it easier to produce authorization decision objects and reverse indexes for resources a principal can access. Last year, while experimenting with Zanzibar approaches to authorization, Netflix found SpiceDB, the open source Google Zanzibar inspired permission system, and built a prototype to experiment with modeling. The prototype uncovered trade-offs

Authorization Distributed Systems Security Software Architecture ABAC on SpiceDB: Enabling Netflix’s Complex Identity Types Netflix Technology Blog 9 min read · May 19, 2023 -- 1 Listen Share By Chris Wolfe , Joey Schorr , and Victor Roldán Betancort Introduction The authorization team at Netflix recently sponsored work to add Attribute Based Access Control (ABAC) support to AuthZed’s open source Google Zanzibar inspired authorization system, SpiceDB . Netflix required attribute support in SpiceDB to support core Netflix application identity constructs. This post discusses why Netflix wanted A

related reading