https://github.com/thomasdarimont/custom-opa-spicedb

OPA Authzed experiments
https://github.com/thomasdarimont/custom-opa-spicedb

Last synced: about 2 months ago
JSON representation

OPA Authzed experiments

• Host: GitHub
• URL: https://github.com/thomasdarimont/custom-opa-spicedb
• Owner: thomasdarimont
• License: apache-2.0
• Created: 2022-10-12T22:26:48.000Z (almost 2 years ago)
• Default Branch: main
• Last Pushed: 2024-03-11T10:02:29.000Z (7 months ago)
• Last Synced: 2024-06-21T02:18:38.137Z (3 months ago)
• Language: Go
• Size: 46.9 KB
• Stars: 13
• Watchers: 3
• Forks: 2
• Open Issues: 1
• Metadata Files:
  • Readme: readme.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-spicedb - thomasdarimont/custom-opa-spicedb - Third-party Open Policy Agent plugin to query SpiceDB (Developer Tools / Third-party Tools)

README

        
Custom Open Policy Agent with prototypical support for Authzed

---

This experiment adds support for querying relations from [Authzed](https://authzed.com/) / [SpiceDB](https://github.com/authzed/spicedb) via GRPC to check resource level permissions

as custom builtin commands for [Open Policy Agent](https://www.openpolicyagent.org/).

Currently only one command is supported:

```

authzed.check_permission("SUBJECT", "PERMISSION", "RESOURCE_ID") -> bool

```

# Build

Note this example uses Go 1.19

```

go get

go build

```

# Demo

> Start authzed demo environment

```

docker compose -f demo/docker-compose.yml up -d

```

> Run custom Open Policy Agent with authzed plugin enabled

```

./custom-opa-spicedb run \

  --set plugins.authzed.endpoint=localhost:50051 \

  --set plugins.authzed.token=foobar \

  --set plugins.authzed.insecure=true

```

> Query relations against authzed

> See the [example RBAC schema](./demo/schema-and-data.yml) for reference.

```

> authzed.check_permission("user:tom", "view", "document:firstdoc")

true

> authzed.check_permission("user:tom", "edit", "document:firstdoc")

true

> authzed.check_permission("user:fred", "edit", "document:firstdoc")

false

> exit

```

> Stop demo environment

```

docker compose -f demo/docker-compose.yml down

```