Authentication verifies a user's identity, while authorization determines what actions that verified user is allowed to perform.
As a product grows, simple role checks escalate into complex, hardcoded logic for packaging, regions, enterprise features, and compliance, creating a maintenance bottleneck.
In a microservices architecture, authorization logic must be re-implemented and maintained across multiple services, languages, and teams, increasing complexity and risk.
Decoupling authorization logic into a central, policy-based service separates it from application code, enabling independent evolution and management.
Deploying the authorization service as a sidecar in Kubernetes co-locates it with your application for low-latency checks while keeping the logic centralized.
Decoupling provides centralized logic, language agnosticism, and consistent audit trails, but requires managing an additional service and potentially learning a new DSL.
Cerbos is an open-source, self-hosted authorization service that implements the decoupled, policy-based approach for managing complex permissions.
The discussion covers implementing authorization at different OSI layers, ensuring changes are tested, identifying complexity, and handling compromised credentials.
32:16Anderson Dadario & Denys Vitali
45:19Reinhard Kugler
29:31Adam Larter
29:34Reto Kaeser
58:19Michael Koppmann
33:20Aarno Aukia
06:04Halil Özkan
40:38Anna Bacher
Jobs that call for the skills explored in this talk.
Peter Park System GmbH
München, Germany
SMG Swiss Marketplace Group
Canton de Valbonne, France
GULP Information Services GmbH
Cosonic GmbH