I think it is more of a if you are not there right now, and won't be able to respond, I am not going to write it all to wait for an answer later. I think most people want to make sure someone is there to respond before committing to a conversation.
You are overlooking a very simple fact in your comment. Cerbos is open source and has an Apache2 license. Therefore most of your points are irrelevant:
* No one needs to pay
* No need for a company to be around for the next 100 years.
Keycloak handles both authentication and authorization and they are tightly coupled. Cerbos solely focuses on authorization and is capable of integrating with any authentication method that is already existing in your application.
Built-in logging is definitely one of the main benefits. However, the following are also other major benefits of using a service like Cerbos:
* By running as a standalone service, any part of your application stack (in any language) can make consistent authorization checks
* Support for most major programming languages via SDKs
* Infinite scalability via serverless functions or sidecar deployment model
* GitOps enabled policy development and deployment via a full testing suite for ci/cd pipelines.
* Full audit trails of every decision made and how they were derived.
* Simple human readable YAML policies
* Ability to have different policies for different environments and ability to have canary deployments
You can find more about all of the benefits and features on our product page[0]
Sorry about that and thank you for bringing it to our attention. As you might imagine we spend a lot of time on that site and did not notice the option to reject is not available. We will action this very soon.
Auth is actually a combination of two things: authentication and authorization.
Whatever you do, please do not build either by yourself. It always starts simple and it is guaranteed to get more complex than anyone is willing to maintain (unless you have a dedicated security engineering team)
There are many providers for each. Authentication is about the user's identity and where they belong in the organization (directory), and authorization is about what they are allowed to do based on their identity, role, and attributes.
Cerbos[0] is an open-source authorization solution which integrates with many identity providers to enable your product to implement fine grained permissions. We have integrated with the most popular authentication providers and they can be found on our ecosystem page[1]
Cerbos also has an out-of-the-box integration with Prisma[2] which enables you to fetch only those records that the user has permissions to from your data store - one of the most tricky parts of implementing authorization.
Whatever solution you end up going with, please save yourself some time and do not re-invent the wheel!
Disclaimer: I work on Cerbos [0] (an alternative to OPA based authorization systems focusing on RBAC/ABAC) to deliver enterprise-grade access management for any application.
There is another alternative approach to policy-as-code: policy-as-configuration. At Cerbos we believe that for most use cases, using a full programming language is too much work and creates problems such as being hard to comprehend and work with (because it's a completely different language with its own idiosyncrasies) and being too open-ended (thus making it easy to write lots of very complicated code with surprising side effects and performance issues). The rules for your authorization policies can be human readable for those developers who cannot spend lots of time learning a whole new programming language, and is independent of any particular language, architecture or tech stack.
We’ve built and open sourced Cerbos trying to make the deployment and management of an authorization service as simple as possible while configuration rules as flexible as possible. While doing so, we also achieved response times that are faster than OPA.
Thanks for explaining the problem space so well and referring to Cerbos[1] as contextual solution.
We had to build these systems in the past so many times and we were tired of reinventing the wheel. With Cerbos we aim to turn this problem space into configuration rather than code and enable enterprise-grade access management for any application.
Cerbos is an open source enterprise-grade access management service for any application.
We are building a decoupled authorization service for those who do not want to reinvent the wheel when it comes to user permissions, authorization, RBAC, ABAC etc.
We are looking for an experienced dev-rel manager to join our globally remote team. You will be in charge of creating and executing a developer relations communication strategy and engaging with developers, suggest solutions, and produce accessible technical content.