Implementing a Multi-Tenant, Relationship-Based Authorizatio...
summary
Minder replaces a custom, database-backed authorization system with OpenFGA, moving users/groups/roles into a declarative model that supports hierarchical permissions and five roles, cutting auth code roughly half the code. Authorization checks run via gRPC middleware calling OpenFGA’s check API, with a batch migration that pushes tuples and optional in-memory caching for low latency. Tests run with the OpenFGA tester integrated into go test, and operational tradeoffs include sync/order issues and the bulk check / list APIs.
AI-written summary · about
chapters (22)
- 0:00Multi-tenant auth with OpenFGA
- 1:48What is OpenFGA
- 3:55OpenFGA vs service meshes
- 4:16OpenFGA model and tuples
- 7:26OpenFGA check API
- 9:13Integrating OpenFGA
- 9:34OpenFGA security benefits
- 13:05Consistent auth across microservices
- 14:30Attribute-based auth
- 15:14OpenFGA availability and latency
- 15:57Reducing code complexity
- 17:03Testing authorization models
- 18:05Explaining access decisions
- 19:37OpenFGA trade-offs
- 23:10Running OpenFGA operations
- 24:12User-facing OpenFGA APIs
- 25:15OpenFGA security impact
- 27:26Q&A: Group membership
- 30:04Q&A: Group systems integration
- 32:36Q&A: OpenFGA vs SpiceDB
- 34:43Q&A: Kubernetes auth
- 36:58Q&A: Bulk checks
related talks
25mImplementing Modern Cloud Native Authorization Using OpenFGA
54mFine-Grained Authorization for Modern Applications
25mModernizing Authorization for Cloud Native Applications Using OpenFGA
06mProject Lightning Talk: OpenFGA: The Cloud Native Way to Implement Fine Grained Authorization
37mRole-Based Access Is so Yesterday: Revolutionizing Authorization with Open FGA
33mFine-Grained Policies RBAC with OpenFGA
07mOpenFGA For Agents: Safe Delegation In 5 Minutes- 33mFine-Grained Policies RBAC with OpenFGA