{"id":21273050,"url":"https://github.com/embesozzi/apisix-authz-openfga","last_synced_at":"2025-07-11T06:32:46.724Z","repository":{"id":246594669,"uuid":"820129941","full_name":"embesozzi/apisix-authz-openfga","owner":"embesozzi","description":"APISIX plugin for integration with OpenFGA platform for FGA","archived":false,"fork":false,"pushed_at":"2024-12-13T11:50:49.000Z","size":24,"stargazers_count":12,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-04-06T01:12:09.104Z","etag":null,"topics":["access-control","apisix","apisix-plugin","authorization","fga","oauth2","openfga"],"latest_commit_sha":null,"homepage":"https://embesozzi.medium.com/mastering-access-control-implementing-low-code-authorization-based-on-rebac-and-decoupling-pattern-f6f54f70115e","language":"Lua","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/embesozzi.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-06-25T21:34:24.000Z","updated_at":"2025-01-22T18:10:04.000Z","dependencies_parsed_at":"2024-11-21T09:12:06.282Z","dependency_job_id":"10bc52ea-a648-4f32-8d8f-3202b25d2ab3","html_url":"https://github.com/embesozzi/apisix-authz-openfga","commit_stats":null,"previous_names":["embesozzi/apisix-authz-openfga"],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/embesozzi/apisix-authz-openfga","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/embesozzi%2Fapisix-authz-openfga","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/embesozzi%2Fapisix-authz-openfga/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/embesozzi%2Fapisix-authz-openfga/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/embesozzi%2Fapisix-authz-openfga/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/embesozzi","download_url":"https://codeload.github.com/embesozzi/apisix-authz-openfga/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/embesozzi%2Fapisix-authz-openfga/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264747946,"owners_count":23657936,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["access-control","apisix","apisix-plugin","authorization","fga","oauth2","openfga"],"created_at":"2024-11-21T09:11:58.604Z","updated_at":"2025-07-11T06:32:46.719Z","avatar_url":"https://github.com/embesozzi.png","language":"Lua","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Apache APISIX Plugin Authorization OpenFGA for FGA\n\nThis directory contains a plugin to integrate [OpenFGA](https://openfga.dev/) with [Apache APISIX](https://apisix.apache.org/) to perform API authorization based Relationship-Based Access Control (ReBAC).   \nRefer to the FGA-based Zanzibar Platform for more information on [OpenFGA](https://openfga.dev/).\n\nThis plugin will:\n\na. Identifies the user based on the access token received, which means that the API is using OAuth 2.0 as one of the authorization protocols.\n\nb. Checks whether the user meets the defined relationship criteria with the object by invoking the **authorization check** endpoint — if a single authorization check is required — or the **authorization batch check** — if multiple authorization checks are needed — provided by the OpenFGA platform.\nBased on the result:\n- Authorizes access to the upstream service when the OpenFGA authorization checks evaluate successfully.\n- Responds with 403 Forbidden if the OpenFGA authorization checks fail.\n- Responds with a 500 Internal Server Error in case of an unexpected error.\n\nIt also supports the discovery of the Store and Authorization model in the OpenFGA Platform if those attributes are not specified in the plugin configuration.\n\n## Configuration\n\n### Attributes\n\n| Name                      | Type     | Required | Default            | Description                                    |\n|---------------------------|----------|----------|-------------------|------------------------------------------------|\n| host                      | string   | True     |                   | OpenFGA Base URL                               |\n| store_id                  | string   | False    | (*) Discovery     | OpenFGA Store ID                               |\n| authorization_model_id    | string   | False    | (*) Discovery     | OpenFGA Authz Model ID                         |\n| ssl_verify                | boolean  | False    | False             | Verify SSL certificate                         |\n| timeout                   | integer  | False    | 3000              | Timeout in milliseconds (min: 1, max: 60000)  |\n| keepalive                 | boolean  | False    | False             | Enable keepalive for connections               |\n| keepalive_timeout         | integer  | False    | 60000             | Keepalive timeout in milliseconds (min: 1000) |\n| keepalive_pool            | integer  | False    | 5                 | Keepalive pool size (min: 1)                   |\n| [check](#check-attributes)| object   | True     |                   | Check configuration for authorization          |\n\n### `check` Attributes\n\n| Name          | Type          | Required | Default | Description                                              |\n|---------------|---------------|----------|---------|----------------------------------------------------------|\n| condition     | string        | True     | AND     | Condition type: `AND` or `OR`                           |\n| [tuples](#tuples-object-attributes) | array         | True     |         | List of authorization tuples                            |\n\n### `tuples` Object Attributes\n\n| Name         | Type     | Required | Default   | Description                                     |\n|--------------|----------|----------|-----------|-------------------------------------------------|\n| user_id      | string   | True     |           | User ID (Format `claim::{claim-name}`)          |\n| user_type    | string   | False    | user      | User Type                                       |\n| relation     | string   | False    | assignee  | Relation of the user to the object              |\n| object_type  | string   | True     | role      | Type of the object, e.g., `role`                |\n| object_id    | string   | True     |           | ID of the object                                |\n\n(*) Discovery: The plugin performs discovery to obtain the store and authorization ID based on the defined OpenFGA Platform.\n\n## Installation\n```\ngit clone https://github.com/embesozzi/apisix-authz-openfga\ncd apisix-authz-openfga\ncp apisix/plugins/authz-openfga.lua /usr/local/apisix/lua/apisix/plugins\n```\n\n## Modify configuration, add plugins\nModify the configuration file /usr/local/apisix/conf/config.yaml and add it authz-openfga to plugins.\n\n```yaml\n   - authz-openfga\n```\n\nAnd also enable the plugin cache:\n\n```yaml\nnginx_config:\n    http_configuration_snippet: |\n    ...\n\n    # authz-openfga  plugin\n    lua_shared_dict authz_openfga_authorization_model             1m; # cache for discovery metadata documents\n```\n\n# Use Cases\nThe use cases are explaing in the following medium article:\n\n- [Mastering Access Control: Implementing Low-Code Authorization Based on ReBAC and Decoupling Pattern](https://embesozzi.medium.com/mastering-access-control-implementing-low-code-authorization-based-on-rebac-and-decoupling-pattern-f6f54f70115e)\n- [Building Scalable Multi-Tenancy Authentication and Authorization using Open Standards and Open-Source Software](https://medium.com/@embesozzi/building-scalable-multi-tenancy-authentication-and-authorization-using-open-standards-and-7341fcd87b64)\n\n\n# Other edition of the Plugin\nFor more features, check the Enterprise Edition maintained by [TwoGenIdentity](https://twogenidentity.com)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fembesozzi%2Fapisix-authz-openfga","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fembesozzi%2Fapisix-authz-openfga","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fembesozzi%2Fapisix-authz-openfga/lists"}