Security

Security in software development.

Access Control

Solutions and engines:

• Authelia [github] - open-source authentication and authorization server and portal fulfilling the identity and access management (IAM)…
• Cerbos - open source, decoupled access control for your software:
  • Filtering data using authorization logic,
  • Cerbos’s Secret Ingredients: Protobufs and gRPC.
• Open Policy Agent - open source policy engine:
  • Partial Evaluation,
  • Write Policy in OPA. Enforce Policy in SQL..
• OPAL - administration layer for Policy Engines,
• Oso:
  • Filter Data,
  • Why Authorization is Hard.
• OpenFGA.
• SpiceDB - an open-source, Google Zanzibar-inspired database for FGA.
• Zanzibar:
  • What is Google Zanzibar?,
  • Understanding Google Zanzibar: A Comprehensive Overview.

Documentation of other systems:

• JIRA:
  • How do Jira permissions work?
• Google Drive:
  • https://developers.google.com/drive/api/guides/manage-sharing
  • https://developers.google.com/drive/api/v3/reference/permissions
  • https://developers.google.com/drive/api/guides/ref-roles

Glossary, related terminology and concepts:

• FGA - Fine Grained Authorization,
• ABAC - attribute based access control,
• ReBAC - relationship-based access control.
• Reverse Indexing - query resources user has access to.

Other:

• https://goauthentik.io/
• https://www.reddit.com/r/selfhosted/comments/191879o/authentik_and_authelia_does_it_matter/?rdt=56913
• https://www.permit.io/blog/mac-dac-rbac-and-fga-and-access-control