Google Zanzibar Through Our Eyes(authzed.com)
authzed.com
Google Zanzibar Through Our Eyes
https://authzed.com/blog/annotated-zanzibar-launch/
20 comments
I was wondering if you have other examples of a database like SpiceDB, specifically where the database is a "database system" for a very specific use-case (in this case application permissions). Square[1] have described something somewhat similar for accounting.
> SpiceDB is an open source database system for managing security-critical application permissions inspired by Google's Zanzibar paper
[1] https://developer.squareup.com/blog/books-an-immutable-doubl...
> SpiceDB is an open source database system for managing security-critical application permissions inspired by Google's Zanzibar paper
[1] https://developer.squareup.com/blog/books-an-immutable-doubl...
Super interesting! It's interesting to think about what Zanzibar ultimately is: an efficient way to store and traverse graphs to determine an outcome, in this case typically authorization, but ever since I learned of this I keep seeing more and more problems that could be solved this way.
Also I can't decide whether this paper is more interesting or the tech they built to annotate it, I keep thinking of papers I'd want to do this with now.
Also I can't decide whether this paper is more interesting or the tech they built to annotate it, I keep thinking of papers I'd want to do this with now.
Speaking specifically to efficiency, a lot of the efficiency required for practical use cases is hand-waved away as implementation details of the caching layer in Zanzibar paper.
A real go at this with postgres and logical decode could be made though.
A real go at this with postgres and logical decode could be made though.
If you're curious to see a Postgres-based implementation, SpiceDB has a Postgres driver: https://github.com/authzed/spicedb/tree/main/internal/datast...
>an efficient way to store and traverse graphs to determine an outcome ... I keep seeing more and more problems that could be solved this way
Yes! The team over at Authzed keeps seeing this, too!
While SpiceDB is fully embracing its primary use-case for permissions, you could also use it to solve many other problems that boil down to "the existence of a path on a graph". For example, we've considered using it for storing update graphs for automating software updates for our Kubernetes operator[0]
The wonderful Kris Nova has also made this realization and considered SpiceDB for dependency resolution for an init system designed to replace systemd[1].
[0]: https://github.com/authzed/spicedb-operator
[1]: https://docs.google.com/document/d/1dA591eipsgWeAlaSwbYNQtAQ...
Yes! The team over at Authzed keeps seeing this, too!
While SpiceDB is fully embracing its primary use-case for permissions, you could also use it to solve many other problems that boil down to "the existence of a path on a graph". For example, we've considered using it for storing update graphs for automating software updates for our Kubernetes operator[0]
The wonderful Kris Nova has also made this realization and considered SpiceDB for dependency resolution for an init system designed to replace systemd[1].
[0]: https://github.com/authzed/spicedb-operator
[1]: https://docs.google.com/document/d/1dA591eipsgWeAlaSwbYNQtAQ...
I was just skimming over real quick but don’t have to either to read the whole thing. One thing that stood out, is a group can hold another group. So I guess if you had a role like tech support, web development, financial, etc you could make a CEO role that includes the permissions within those other roles? If I am reading that right, never thought about that though. Kinda neat as role reusability.
Yep! Groups can be easily nested under one another by simply creating a relationship between the group's members and the members of another group.
In SpiceDB [0] schema this can be represented like so:
I threw together an example in our playground [1], if you'd like to try it out!
[0]: https://github.com/authzed/spicedb [1]: https://play.authzed.com/s/9D5h9I7mE9mK/schema
In SpiceDB [0] schema this can be represented like so:
definition group {
relation member: user | group#member
}
I threw together an example in our playground [1], if you'd like to try it out!
[0]: https://github.com/authzed/spicedb [1]: https://play.authzed.com/s/9D5h9I7mE9mK/schema
Not only inclusion, but other operators as well, such as negation, so you can say
CanAccessAmericanSecrets = AllSREs - EmployeesInEnemyState
No idea why you are getting downvoted. You are correct. The white paper section 2.3. Talks exactly about that. The namespace configuration pseudo-code show exactly how this is written. Took me over a year to arrive at this conclusion.
Exclusion (and intersection as well) provide for some very powerful computation primitives, with only a slight overhead in performance.
In addition, there is `tupleset_to_userset` [0], which can be thought of as an arrow (which is also how its defined in SpiceDB [1]).
[0]: https://zanzibar.tech/2D0HKhvxH0:0.IoJK1g_7i:4L~ses~0~1 [1]: https://docs.authzed.com/reference/schema-lang#--arrow
In addition, there is `tupleset_to_userset` [0], which can be thought of as an arrow (which is also how its defined in SpiceDB [1]).
[0]: https://zanzibar.tech/2D0HKhvxH0:0.IoJK1g_7i:4L~ses~0~1 [1]: https://docs.authzed.com/reference/schema-lang#--arrow
Yes. The white paper is very brief on details. Some systems in the wild totally miss the fact that a relation userset operation isn’t “include only”. That also applies to tupleset_to_userset.
I was in that misled camp for quite some time. One day it clicked, but only after realizing that the namespace config pseudo-code from section 2.3. IS what defines relationships: https://gruchalski.com/posts/2022-10-22-zanzibar-with-prolog.... Not the fancy object#relation@subject. That’s just the query language.
I was in that misled camp for quite some time. One day it clicked, but only after realizing that the namespace config pseudo-code from section 2.3. IS what defines relationships: https://gruchalski.com/posts/2022-10-22-zanzibar-with-prolog.... Not the fancy object#relation@subject. That’s just the query language.
I love the annotation interface, did you do that all yourself or use a tool? Ty!
I'm actually at the opposite end of the spectrum. I can see how this was beneficial to them when reviewing the document, and if the title was... check out how we collaborate on published journals in our own Google Docs like interface, it would have made sense. But, based on the title I thought they were going to actually explain Google Zanzibar in layman's terms. Not just have a bunch of comments that required you scroll around to figure out what they were even talking about.
I understand your perspective. We've tried to keep this project neutral, so we were hesitant to link to our "What is Zanzibar" blog post[0]. We hoped that the abstract might be good enough for most folks.
One of the features our project supports that could not be done in Google Docs is having multiple sets of annotations. We could add another that assumes you know nothing about the space and helps provide a lot more context.
[0]: https://authzed.com/blog/what-is-zanzibar/
One of the features our project supports that could not be done in Google Docs is having multiple sets of annotations. We could add another that assumes you know nothing about the space and helps provide a lot more context.
[0]: https://authzed.com/blog/what-is-zanzibar/
All custom but fully open source! Code can be found at https://github.com/authzed/zanzibar-annotated
Not only targeting devs with tech-specific content-marketing, but content-marketing with code, too! Nice (:
Your notes immediately crystalized some of the concepts I was still fuzzy on before reading. Awesome!
https://github.com/authzed/zanzibar-annotated is very slick too!
Is there any way to attribute an annotation to a set of authors (sans git history)?
https://github.com/authzed/zanzibar-annotated is very slick too!
Is there any way to attribute an annotation to a set of authors (sans git history)?
Hi! I'm one of the contributors to the project and this was an idea that bounced around during development. Can you create an issue in the repo and add any details you have in mind for how this would work?
https://github.com/authzed/zanzibar-annotated/issues
https://github.com/authzed/zanzibar-annotated/issues
Great work! Keep up the high productivity. Miss playing ping pong in New York together :)
You can go directly to the annotated paper here[0]. It's got all kinds of goodies like the ability to direct link from anywhere and generate OpenGraph previews (e.g. [1]).
Coolest of all, it's entirely open source[2] built on NextJS.
[0]: https://zanzibar.tech
[1]: https://zanzibar.tech/2R50fs-R_n:1i:3u
[2]: https://github.com/authzed/zanzibar-annotated