summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authormo khan <mo@mokhan.ca>2025-07-07 15:53:58 -0600
committermo khan <mo@mokhan.ca>2025-07-07 15:53:58 -0600
commit1e60109014c82b1223a65cfcf4e47b956131359c (patch)
tree130627a50603501ffcc51f42213f00475a224b1b
parentfa214052891a8d54121b216879cad8a761608c92 (diff)
docs: remove unnecessary slides
-rw-r--r--share/man/README.md164
1 files changed, 3 insertions, 161 deletions
diff --git a/share/man/README.md b/share/man/README.md
index 779b37d2..4a373cc6 100644
--- a/share/man/README.md
+++ b/share/man/README.md
@@ -420,31 +420,7 @@ when {
---
-## Slide 13: Benefits of This Architecture
-
-### 1. **Separation of Concerns**
- - Envoy handles auth complexity
- - App focuses on business logic
- - Policies managed separately
-
-### 2. **Security**
- - OAuth secrets never reach app
- - Token validation at edge
- - Consistent policy enforcement
-
-### 3. **Performance**
- - Early request rejection
- - No auth overhead in app
- - Local authzd = low latency
-
-### 4. **Flexibility**
- - Easy to add new auth methods
- - Policy changes without app changes
- - Gradual migration path
-
----
-
-## Slide 14: Demo Scenarios
+## Slide 13: Demo Scenarios
### Scenario 1: Unauthenticated Access
```bash
@@ -472,94 +448,7 @@ curl -H "Cookie: id_token=expired" http://localhost:10000/dashboard
---
-## Slide 15: Cedar Policy Language
-
-### Why Cedar?
-
-- **Simple** - Easy to read and write
-- **Fast** - Optimized for authorization decisions
-- **Safe** - Prevents common policy mistakes
-- **Auditable** - Clear decision logs
-
-### Example: Group-based Access
-```cedar
-permit(
- principal,
- action == Action::"view",
- resource == Resource::"admin_panel"
-)
-when {
- principal.groups.contains("admins")
-};
-```
-
-### Example: Time-based Access
-```cedar
-permit(principal, action, resource)
-when {
- context.current_hour >= 9 &&
- context.current_hour < 17 // Business hours only
-};
-```
-
----
-
-## Slide 16: Debugging Authorization
-
-### Envoy Access Logs
-```json
-{
- "app": "envoy",
- "path": "/dashboard",
- "method": "GET",
- "response_code": "401",
- "duration": "5",
- "ext_authz_status": "denied"
-}
-```
-
-### Authzd Decision Logs
-```json
-{
- "level": "INFO",
- "message": "Processing HTTP request",
- "method": "GET",
- "path": "/dashboard",
- "decision": "Deny",
- "diagnostics": {
- "reason": "No matching permit policy",
- "policies_evaluated": ["policy0", "policy1"]
- }
-}
-```
-
----
-
-## Slide 17: Migration Strategy
-
-### Phase 1: Parallel Running
-```
- +----------+
- +--->| Rails | (existing auth)
- | +----------+
- Browser -----+
- | +----------+
- +--->| Envoy | (new auth)
- +----------+
-```
-
-### Phase 2: Gradual Cutover
-- Start with read-only endpoints
-- Move non-critical paths
-- Finally migrate sensitive operations
-
-### Phase 3: Full Migration
-- Remove auth code from Rails
-- Rely entirely on edge authorization
-
----
-
-## Slide 18: Key Takeaways
+## Slide 14: Key Takeaways
1. **Authorization at the edge** is more secure and performant
@@ -573,54 +462,7 @@ when {
---
-## Slide 19: Questions & Discussion
-
-### Architecture Questions
-- How does this compare to Rails + Devise?
-- What about API authentication?
-- How do we handle service-to-service auth?
-
-### Implementation Questions
-- How complex can Cedar policies get?
-- What's the performance impact?
-- How do we test authorization rules?
-
-### Migration Questions
-- Which services should adopt this first?
-- How do we maintain backwards compatibility?
-- What's the rollback strategy?
-
----
-
-## Appendix A: Running the Demo
-
-### Local Development
-```bash
-# Terminal 1: Start the services
-make run
-
-# Terminal 2: Watch the logs
-make logs
-
-# Terminal 3: Test requests
-curl -v http://localhost:10000/
-```
-
-### Docker Deployment
-```bash
-# Build the image
-make build-image
-
-# Run everything
-docker run -p 10000:10000 \
- -e OAUTH_CLIENT_ID=xxx \
- -e OAUTH_CLIENT_SECRET=yyy \
- sparkle:latest
-```
-
----
-
-## Appendix B: Resources
+## Appendix A: Resources
### Documentation
- Envoy ext_authz: https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/ext_authz_filter