# Spike

![screencast](./screencast.webm)


1. Twirp + GRPC (authz)
  * idp (headless): provide a thrift/grpc endpoint that is the equivalent of `Ability.allowed?(subject, permission, resource)`
  * gitlab
2. OpenID Connect (authn) + OAuth (authz)
  1. idp (with login pages)
  1. gitlab
3. API Gateway: using golang reverse proxy and one of the new policy dsl's
4. OPA agent style side car process using declarative policy

## Identity Provider (SAML IdP)

This is a tiny SAML Identity Provider for testing out interactions with
a SAML Service Provider

1. Start the server:

    $ ruby ./bin/idp

1. Use `http://localhost:8282/metadata.xml` as your SAML IdP Metadata url.

## Service Provider (SAML SP)

This is a tiny SAML Service Provider for testing out interactions with a SAML Identity Provider (IdP)

1. Start the server:

    $ ruby ./bin/sp

1. Use `http://localhost:8283/metadata.xml` as your SAML SP Metadata url.