Our users are web developers, and a prominent and adjacent pain point for our users is authorization. Developers typically implement two independent solutions for authentication and authorization. Offering AuthN and AuthZ in a single solution is something we’ve been thinking about for the last few years.
Quick primer, authentication is knowing who the user is, and authorization is knowing what the user has access to. A physical analogy: A person enters a building. Authentication means reading their ID card and knowing that the person’s name is John. Authorization means knowing which floors, offices, and files John has access to.
With increasing privacy and data complexity, companies like Netflix[1], Slack[2], and Airbnb[3] have built out their own complex authorization systems.
To build our user roles product, we started with a first principles approach of covering authorization use cases using scripting languages such as XACML and OPA. But looking at existing solutions built by talented teams like Oso[4], Aserto[5], Cerbos[6], Strya[7], we realized that while these were powerful solutions, they were often overkill for most early to mid-stage companies (especially on the B2C side).
We went back to the drawing board, reached out to our users and after dozens of conversations, we realized that most authorization needs require the ability to
1. Assign and manage roles and permissions
2. Store roles in the DB and session tokens to make it readable on the frontend and
3. Protect APIs and websites based on these roles and permissions.
And so, we built user roles – a simple RBAC authorization service that focuses on the balance between simplicity and utility. It doesn’t cover many complex cases and we’re not looking to displace any of the authorization incumbents. But you can add AuthN and AuthZ using a single solution, quickly.
In the near future, we’ll be launching an admin GUI where you can manage your users and their roles with a few clicks.
We’d love for you to try it out and hear what additional functionality you’d like to see. What are your favorite authentication providers and what do they get right?
- [1]: https://conferences.oreilly.com/velocity/vl-ca-2018/cdn.orei...
- [2]: https://slack.engineering/role-management-at-slack/
- [3]: https://medium.com/airbnb-engineering/himeji-a-scalable-cent...
- [4]: https://www.osohq.com/
- [5]: https://www.aserto.com/
- [6]: https://cerbos.dev/
- [7]: https://www.styra.com/