The right feature at the right place: the example of authorization
summary
Starts from a Spring Boot app with Spring Security enforcing a salary-access rule (Alice can see her salary, Bob his and Bob’s direct reports), then extracts that authorization into Open Policy Agent using Rego bundles and static data, and puts enforcement at the edge with Apache APISIX so API gateway returns a boolean allow/deny. Demo has flaky Docker and bundle tooling, admits duplicated hierarchy data and Rego rough edges, but the OPA+APISIX setup successfully centralizes auditable policies outside application code.
AI-written summary · about
chapters (9)
- 0:00Introduction to auditable security
- 2:44Authorization in Spring Security
- 5:37Live coding demo begins
- 10:35Introducing Open Policy Agent
- 13:10Policy as code with Rego
- 16:17Moving authorization out of code
- 19:41Authentication with API6
- 22:16Final demo and results
- 24:06Future of auditable security
related talks
37mMake your security policy auditable
25mMake Your Security Policy Auditable
27mSecurity-by-construction: How to weave authorization into modern app stacks using Open Policy Agent
32mImplementing Authorization
16mDistributed application level RBAC with OPA
32mOPA: So What Does the Policy Do?
48mBeyond Entitlements for the Cloud Native
31mDeploying Policy-as-Code with Readable Rego Policies, and Open Policy Agent