blob: 0460fe39cbbcce2e3373bd329b1a0f490138d4e5 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
|
## Experiments
### Twirp + gRPC (AuthZ)
This experiment exposes a gRPC endpoint that aligns with the [`Ability.allowed?(subject, permission, resource)`][1] interface from GitLab's declarative authorization logic.
It demonstrates a headless authorization service that provides a low-latency decision point for other services to verify permissions.
Actors in this experiment:
* Headless authz service: A facade over GitLab’s existing declarative policies.
* API (Resource Server in OAuth terms): A slimmed-down GitLab REST API that delegates authorization decisions to the authz service.
### SAML, OIDC, OAuth
This experiment showcases how a separate authx service can handle both authentication and authorization using standard protocols:
* SAML & OIDC for authentication
* OAuth for authorization
Actors in this experiment:
* Authx service: Acts as a SAML Identity Provider and an OAuth Authorization Server.
* API: A slimmed-down GitLab REST API.
### API Gateway
This experiment explores a stateless authorization mechanism by integrating a policy DSL (such as [Casbin][3]) into a reverse proxy.
Authorization decisions are made early in the request pipeline based on HTTP request headers and body content.
### Sidecar Process
This experiment demonstrates a sidecar approach for making authorization decisions within an nginx process.
Inspired by [Open Policy Agent][4] deployments. This experiment:
* Uses lua bindings in nginx to connect to a local client process.
* The client process proxies requests to a gRPC based policy decision service.
[1]: https://gitlab.com/gitlab-org/gitlab/-/blob/e1f6db024561e35462ac8d9f54b8f9678f6ed6ee/app/models/ability.rb#L73
[3]: https://casbin.org/
[4]: https://www.openpolicyagent.org/
|
