diff options
| author | mo khan <mo@mokhan.ca> | 2025-07-07 15:53:58 -0600 |
|---|---|---|
| committer | mo khan <mo@mokhan.ca> | 2025-07-07 15:53:58 -0600 |
| commit | 1e60109014c82b1223a65cfcf4e47b956131359c (patch) | |
| tree | 130627a50603501ffcc51f42213f00475a224b1b /share/man | |
| parent | fa214052891a8d54121b216879cad8a761608c92 (diff) | |
docs: remove unnecessary slides
Diffstat (limited to 'share/man')
| -rw-r--r-- | share/man/README.md | 164 |
1 files changed, 3 insertions, 161 deletions
diff --git a/share/man/README.md b/share/man/README.md index 779b37d2..4a373cc6 100644 --- a/share/man/README.md +++ b/share/man/README.md @@ -420,31 +420,7 @@ when { --- -## Slide 13: Benefits of This Architecture - -### 1. **Separation of Concerns** - - Envoy handles auth complexity - - App focuses on business logic - - Policies managed separately - -### 2. **Security** - - OAuth secrets never reach app - - Token validation at edge - - Consistent policy enforcement - -### 3. **Performance** - - Early request rejection - - No auth overhead in app - - Local authzd = low latency - -### 4. **Flexibility** - - Easy to add new auth methods - - Policy changes without app changes - - Gradual migration path - ---- - -## Slide 14: Demo Scenarios +## Slide 13: Demo Scenarios ### Scenario 1: Unauthenticated Access ```bash @@ -472,94 +448,7 @@ curl -H "Cookie: id_token=expired" http://localhost:10000/dashboard --- -## Slide 15: Cedar Policy Language - -### Why Cedar? - -- **Simple** - Easy to read and write -- **Fast** - Optimized for authorization decisions -- **Safe** - Prevents common policy mistakes -- **Auditable** - Clear decision logs - -### Example: Group-based Access -```cedar -permit( - principal, - action == Action::"view", - resource == Resource::"admin_panel" -) -when { - principal.groups.contains("admins") -}; -``` - -### Example: Time-based Access -```cedar -permit(principal, action, resource) -when { - context.current_hour >= 9 && - context.current_hour < 17 // Business hours only -}; -``` - ---- - -## Slide 16: Debugging Authorization - -### Envoy Access Logs -```json -{ - "app": "envoy", - "path": "/dashboard", - "method": "GET", - "response_code": "401", - "duration": "5", - "ext_authz_status": "denied" -} -``` - -### Authzd Decision Logs -```json -{ - "level": "INFO", - "message": "Processing HTTP request", - "method": "GET", - "path": "/dashboard", - "decision": "Deny", - "diagnostics": { - "reason": "No matching permit policy", - "policies_evaluated": ["policy0", "policy1"] - } -} -``` - ---- - -## Slide 17: Migration Strategy - -### Phase 1: Parallel Running -``` - +----------+ - +--->| Rails | (existing auth) - | +----------+ - Browser -----+ - | +----------+ - +--->| Envoy | (new auth) - +----------+ -``` - -### Phase 2: Gradual Cutover -- Start with read-only endpoints -- Move non-critical paths -- Finally migrate sensitive operations - -### Phase 3: Full Migration -- Remove auth code from Rails -- Rely entirely on edge authorization - ---- - -## Slide 18: Key Takeaways +## Slide 14: Key Takeaways 1. **Authorization at the edge** is more secure and performant @@ -573,54 +462,7 @@ when { --- -## Slide 19: Questions & Discussion - -### Architecture Questions -- How does this compare to Rails + Devise? -- What about API authentication? -- How do we handle service-to-service auth? - -### Implementation Questions -- How complex can Cedar policies get? -- What's the performance impact? -- How do we test authorization rules? - -### Migration Questions -- Which services should adopt this first? -- How do we maintain backwards compatibility? -- What's the rollback strategy? - ---- - -## Appendix A: Running the Demo - -### Local Development -```bash -# Terminal 1: Start the services -make run - -# Terminal 2: Watch the logs -make logs - -# Terminal 3: Test requests -curl -v http://localhost:10000/ -``` - -### Docker Deployment -```bash -# Build the image -make build-image - -# Run everything -docker run -p 10000:10000 \ - -e OAUTH_CLIENT_ID=xxx \ - -e OAUTH_CLIENT_SECRET=yyy \ - sparkle:latest -``` - ---- - -## Appendix B: Resources +## Appendix A: Resources ### Documentation - Envoy ext_authz: https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/ext_authz_filter |
