CloudNativeSecurityCon North America 2024

When we built the open source supply chain security platform, Minder, we initially wrote our own database-backed authorization implementation, with the concepts of users, roles, organizations, and groups. This was a lot of code that distracted from our core mission of securing software repositories, but it was critical to get right in a multi-tenant service. In this talk, we’ll explain how we replaced that code with OpenFGA, an open source authorization solution, to implement hierarchical permissions and project relationships. We’ll show how we used OpenFGA’s modeling language to write and test our permissions model, using middleware to perform the authorization check, and additional work you may need to do outside of OpenFGA to better connect with your own identity providers. At the end of this talk, you’ll know enough to decide if OpenFGA is right for you.