from Hacker News

Show HN: RBAC for your REST API in 2 minutes

by ogazitt on 3/1/22, 3:31 PM with 12 comments

  • by troydavis on 3/1/22, 3:56 PM

  • by ogazitt on 3/1/22, 3:32 PM

    Authorization is a must-have for every application, but most teams have to build it from scratch. The Open Policy Agent [0] is a good place to start for creating an OSS-based solution, but you still need to build a lot of stuff yourself.

    The Aserto playground [1] lets you import your REST service’s openapi.json spec and automatically generates a permissions for each operation. You can assign these permissions to one or more roles (viewer, editor, admin, or create your own). Export the project to get your OPA policy for your REST service.

    You can also try it out with the Petstore API [2]. Click the “Start Tour” button for a guided tour.

    Would love feedback on how to make this better!

    [0] https://openpolicyagent.org

    [1] https://aserto.com/playground

    [2] https://petstore3.swagger.io/api/v3/openapi.json

  • by itsronenh on 3/1/22, 3:55 PM

    Do package names have to match API routes? Can I create a policy that is shared by multiple endpoints?

  • by yodon on 3/1/22, 6:44 PM

    Does your k8s sidecar approach work with https://dapr.io sidecars?

  • by rschwabco on 3/1/22, 3:59 PM

    What can I do with policies I create in this playground?