By Matthew Tyson
Software Architect, CSO |
Auth0’s OpenFGA project is an open source effort that undertakes to provide a universal authorization solution. FGA stands for “Fine Grained Authorization,” a granular approach to authorization modeling that is flexible enough to handle almost any imaginable use case.
Read on for an introduction to the OpenFGA project.
Authentication is concerned with who and authorization with what. Authentication answers the question: who are you? Authorization answers the question: given who you are, what can you do?
Both of these are essential areas of cybersecurity, but of the two, authorization presents the more demanding architectural challenge. That is because authorization deals with more complexity and far more data points.
Authorization has to track a whole range of permissioned entities, like URLs and business objects, as well as access types like view, create, and edit. Not only that, it must also deal with granting and revoking permissions to these objects. Therefore, it is responsible for determining not just who has access to what, but who has permission to control permissions, the hierarchy of control between organizations and individuals.
Anyone who has dealt with these things knows just how messy it can become. Tracking and applying permissions is a thorny problem, and it’s one that you can’t sidestep or cut corners on. The difficulties only multiply the larger the system becomes. Simple scalability begins to become a real challenge in the face of millions of permissions checks against billions of entities.
Defining a generalized system to handle such requirements—one that is flexible enough to deal with the variety of in-the-world requirements, but still reliable, secure, and performant—is a substantial undertaking, but one that promises major benefits to enterprise. Beyond making authorization more standard and eliminating the need to rebuild it per-application, such a system would enable more streamlined cross-application authorization communication. Furthermore, concentrating authorization into a single, well-tested system offers security improvements.
Google’s Zanzibar project (whitepaper) describes such a universal authorization layer. It incorporates a number of technological ideas to achieve the performance and availability goals of the system, and it offers a fairly developer friendly application programming interface (API) for interacting with it. In particular, it delivers a universal domain-specific language (DSL) for describing users, groups, roles, and access control lists (ACLs) for expressing permissions.
Auth0 (now part of Okta) took up the challenge of delivering a system based on Zanzibar’s ideas in a reusable way with its upcoming Fine Grained Authorization SaaS. Auth0 FGA essentially creates a remote API with which any app can integrate to obtain a universal permissions service. Auth0’s Matias Woloski describes it as a high-performance and flexible authorization microservice that you don’t have to build and run yourself. This allows application developers to offload much of the complexity in authorization to the remote service, while retaining control over most data in-house.
Although this is a good model for many use cases, Auth0 has taken the further step of open sourcing its FGA core as the OpenFGA project (GitHub repo). This is a significant move on a couple fronts. For one, it represents a major commitment to open source by Auth0. For the other, it contributes an enormous amount of know-how and capability to the OSS community. Once the community has its hands on things, it tends to elaborate and expand upon them in unexpected ways.
In its announcement of the move, Auth0 gives several reasons and among them are the desire to encourage an active community that will support adoption, integration with technology-specific tooling, and the systemic improvement of security in the industry. It does indeed appear we are looking at a big enterprise-open-source partnership win here.
Woloski outlines Auth0’s strategy, saying that by “open sourcing it, we let developers embed this component in their own infrastructure. Once they feel comfortable, they can decide to let us run it for them as a service with additional enterprise features, or keep using the open source version. We are committed to maintaining it in the long term.”
The core of the project is the permission engine itself, a standalone server that can handle the authorization requests. The OpenFGA server is modular with respect to data storage, and currently you can choose between an in-memory datastore or PostgresSQL. The ability to run the server on owned infrastructure is a key benefit, as some compliance situations demand it. This server is fundamentally an HTTP API allowing for defining permission models, and querying/modifying them.
The server is written in Go and can be built from sources for those interested in contributing, but most end users will deploy the binaries or Docker image. Quickstart for running on localhost via Docker is here.
Being based on the Zanzibar architecture, the OpenFGA server is built with an eye to scaling and availability. Of course, that depends greatly on the underlying infrastructure.
“Zanzibar implementations are heavily optimized to answer if a user can perform an action on a resource in a scalable way. OpenFGA is not an exception,” says Woloski. “When using the Auth0 FGA implementation, Auth0 will own the infrastructure and make sure it is highly scalable and available. OpenFGA users will be responsible for operating the service on their infrastructure, so the scalability/availability characteristics of the service will depend on it.”
Once the server is running, you can set up a client in your application based on the stack you are using—currently, software development kits (SDKs) exist for Node, Go and .NET. The client allows you to interact with the server API in an idiomatic way.
The first task is to define a store on the server, the root level container object for holding the auth information, much like a database within a database management system (DBMS). The store is then configured with the authorization model, analogous to the schema in a database.
Once you have the server up, a client installed and a store provisioned, you can define the model by issuing a request using JSON. For example, using the Node client, a simple data model is configured as in Listing 1. (This is from the Auth0 quick start).const { authorization_model_id: id } = await fgaClient.writeAuthorizationModel({ "type_definitions": [ { "type": "document", "relations": { "reader": { "this": {} }, "writer": { "this": {} }, "owner": { "this": {} } } } ]});
OpenFGA also supports a DSL for modeling. The same model in the DSL is in Listing 2.type document relations define reader as self define writer as self define owner as self
At this time it’s not usable with the in-code SDKs, but you can convert between the two and get a visualization using the OpenFGA sandbox here. (You can also use the SyntexTransformer node library). The DSL and visualizer are great for refining models. You can see the simple model from Listings 1 and 2 as seen in the modeler, Figure 1.
Figure 1. Simple auth model in designer (Click image to view full-size)
Tuples are an association among three entities: a user, a relationship, and an object. They express the instances of things within the data model. You can create a tuple in the designer in the lower lefthand pane. For example: owner: alice, relationship: reader, object: document:z.
With the relationship defined, you can query using the query parser at the bottom of the screen, for example: who is related to document:z as reader. This will appropriately return the alice user as in screen 2.
Figure 2. Returning the readers on document:z (Click image to view full-size)
All relationships are modifiable via the code client. This gives you an extraordinary amount of power for controlling authorization from within your application, including self-referential granting and revoking of authority based on groups and roles.
The docs (also now open source) cover a great deal of further ground and use cases including using openID and the specifics of securing resources like URLs.
[ Learn how to find the right testing tool for Okta, Auth0, and other SSO solutions and read our interview with Auth0’s Matias Woloski | Sign up for CSO newsletters! ]Matthew Tyson is a founder of Dark Horse Group, Inc. He believes in people-first technology. When not playing guitar, Matt explores the backcountry and the philosophical hinterlands. He has written for JavaWorld since 2007.
Copyright © 2022 IDG Communications, Inc.
Copyright © 2022 IDG Communications, Inc.
If you’re on a Galaxy Fold, consider unfolding your phone or viewing it in full screen to best optimize your experience.
Credit Cards
Banks
Brokers
Crypto
Mortgages
Insurances
Loans
Small Business
Knowledge
Taking content and document management from the physical world to the digital is a necessity. This may sound like an enormous undertaking, but document management systems make this transfer much more efficient. Choose the right solution, and your organization can make the digital leap quickly and easily.
Cluttered file cabinets are so yesterday. To keep your organization secure and operating efficiently, you must migrate data and digitalize your documents. The right document management system makes all the difference for easy and intuitive document storing, sharing, and editing.
But like a Cinderella slipper, there is no one-size-fits-all system. You can choose from many excellent document management solutions, each fulfilling different specialties. What will work best for you depends on your business needs, budget, and the features you want. Keep those in mind as your browse our top picks below!
DocSend is known for its ease of use and integration capabilities. There’s no confusing back end architecture, as DocSend syncs easily into your existing framework. It syncs with other common platforms such as Microsoft Office or Google, so you can use DocSend to share files internally and store data directly from your desktop.
It keeps information secure with customizable permissions. For example, you can require email verification or set visibility access to expire after a certain amount of time.
DocSend has a small learning curve. Plans start at $10/month per user, placing DocSend in a mid-range price point compared to other systems.
Customized share permissions protects your data. Image source: Author
Bloomerang is a donor management system with extensive options for record-keeping and an array of supporting features that can help nonprofits who don’t want to build a stack of different tools. This platform is great for tracking all the important information you need to know about donors, volunteers, and other supporters.
Besides creating in-depth constituent records, Bloomerang empowers you with reporting features that help you make sense of the data. You can choose from tons of report templates or use their step-by-step process to build your own report. Because Bloomerang is cloud-based, you can always pull the most up-to-date entries or specify specific date ranges.
When it comes to donor communications and engagement, you can create and manage both email and direct mail letters. Bloomerang comes with a variety of letter and email templates to cover all the most common nonprofit needs. Their Twitter Listening Hub is a clever bonus feature, allowing you to dip your toes into social media monitoring.
For startups or small nonprofits, Bloomerang’s website integration features can empower you to collect important details (and donations). You can create forms in Bloomerang and embed them on your own website. Then all the information collected goes right into your database. More mature organizations, however, might need greater flexibility or more advanced functionalities from their donation pages.
With many pricing tiers (all of which include unlimited users), Bloomerang software can work with any budget. But the many tiers, based on number of records and file storage, could be a hassle for rapidly growing organizations. Bloomerang’s free tier and special small shop pricing might be just what a budding nonprofit founder needs.
Box excels at the basics: uploading and sharing documents and editing files online. It sets up basic workflows, much like task managers available in organization apps, so you can track document edits, progress, views, etc.
You can create multiple logins for internal use or share files with external guests. You can extend editing permissions to select guests.
Speaking of sharing, Box makes it easy. Click the dots beside a document’s name to access tools to download a document or create a direct link for sharing.
Each link can have customized access, ranging from basic viewing to editing abilities.
Box options make sharing simple. Image source: Author
If you want free document management software, Box offers a $0 plan for solo users. From there, the first paid option is still affordable, starting at $5/month per user, for 3-10 users.
M-Files follows a unique, straightforward principle and classifies information by the “what” of its content rather than the “where” of its folder storage, resulting in more intuitive document storage and searching. You are likely to find the document you want much more quickly.
It also uses autosave to ensure that content is not lost as you are updating and editing, and background updates keep everything current.
M-Files centralized storage offers a dynamic view of your entire organization. Content is automatically organized by type and associations, so you can search for what you need with a high-level view into storage.
Find what you’re looking for when you can search by content by type without rummaging through folders. Image source: Author
eFileCabinet keys on efficiency, with a streamlined system, focused around a central solution. It is a one-stop-shop for digital document management, providing easy document archiving, data migrations, and ongoing maintenance.
eFileCabinet is an excellent choice for small and medium businesses because of its easy setup and straightforward interface.
eFileCabinet uses an open API (application programming interface), which means you can connect with your current office system, alleviating a lot of integration headaches.
Just drag and drop files from your desktop into the app, and they are automatically uploaded to eFileCabinet’s library.
Save time and desktop space by uploading simply with Sidekick. Image source: Author
You can also audit a file’s history with an open admin view, or create custom links for doc tracking to keep tabs on who has accessed which files and when.
Ademero Content Central is a highly customizable platform with many useful features and an easy-to-use interface. Besides handling storing and file sharing basics, Ademero Content Central is known for its zonal recognition capabilities.
It uses optical character recognition (OCR) to scan and populate predetermined areas of documents, saving you a lot of time.
It also developed QCards. QCards are like document cover pages produced internally in Ademero Content Central with barcodes. They are used to quickly identify the document type being created (or uploaded), and the crucial fields a user has added.
QCards store information in barcodes to manage data more efficiently. Image source: Author
If your system needs to do more than simply store and send out documents, Ademero Content Central has premade templates you can use.
Its centralized storage system searches for documents, both stored (master copies) and edited (revised as a team or by individuals). Pricing starts at $35/month per user.
Microsoft SharePoint file management software integrates seamlessly with your Microsoft software. You can customize its look and incorporate your company’s branding.
SharePoint works well for co-authors, allowing many people to work in a document at once, and you can extend guest access.
Most external links are “view only” shares, but some plans let you offer other abilities to people outside your organization.
Set up customizable guest accesses and permissions from the settings dashboard. Image source: Author
Pricing is reasonable, starting at just $5/month per user and going up to $20/month per user. The base option gives you an ample 1 TB of storage, so you shouldn’t run out of space.
Each software option must meet a few basic criteria to be considered a top choice.
Sensitive information and confidential documents are par for the course with data storage, so every option must be secure. Each software option should be encrypted and have other security options such as assigned permissions, password-protected links, two-factor authentication, etc.
Collaboration is one of main reasons for using document management software. Since files are shared among teams and companies, they must have editing abilities to match.
A document management system is unsuitable if it can’t be integrated with your existing software. A good system fits into the day-to-day of your workforce and makes your life easier, not harder.
Going digital comes with plenty of benefits that staying offline simply can’t provide.
History reporting shows you who accessed files, when they opened them, and what was changed. Looking at revision history protects original data while logs provide user accountability.
With paper files, you risk something being misplaced, stolen, mishandled. Digital files have encrypted security and are much easier to access by those with the right credentials while being hidden from other users.
Whether it is a proposal, a contract, or a flyer, if multiple people need to touch a file at some point, it’s going to be faster via digital workflows than any other method. With all necessary authors having access in one place, tasks can be completed efficiently.
Rose Wheeler is a seasoned writer and content manager with more than 15 years of experience. She specializes in content related to digital marketing, small business, personal finance, and CMS. Her work has appeared on sites such as Selz, The Cheat Sheet, and Swaay. When she’s not working with her awesome clients, Rose enjoys cooking, playing games and curling up with a good book.
We’re firm believers in the Golden Rule, which is why editorial opinions are ours alone and have not been previously reviewed, approved, or endorsed by included advertisers. The Ascent does not cover all offers on the market. Editorial content from The Ascent is separate from The Motley Fool editorial content and is created by a different analyst team. The Motley Fool has a Disclosure Policy. The Author and/or The Motley Fool may have an interest in companies mentioned.
The Ascent is a Motley Fool service that rates and reviews essential products for your everyday money matters.
Copyright © 2018 – 2022 The Ascent. All rights reserved.
September 22 2022
Although Microsoft Dynamics ERPs offer robust capabilities, sometimes organizations realize they have specialized requirements not covered by their out-of-the-box solution. When that happens, they can turn to third-party solutions to ensure that their ERP system will meet their needs.
MSDynamicsWorld (MSDW) and ERP Software Blog have partnered to bring you a series of Financial Management Tools Showcase events on October 4,5, and 6. These virtual events are designed for finance-focused Dynamics GP, Dynamics 365 Business Central (NAV), and D365 Finance (AX) users and consultants interested in new and innovative ISV solutions that boost performance and broaden their digital capabilities. Each of the three sessions will focus on tools for a specific product. Join all three or choose the best fit.
Over the three sessions you will see demos from eleven unique vendors, each with their own expertise and specialized products that have a proven record of adding measurable value to your Microsoft Dynamics ERP. We asked our expert presenters for a sneak preview of the information attendees can expect to take away from the event. Here is what they told us:
Avalara – Tax (Finance/BC/GP)
Bluefort – Subscription Technology (Finance)
DATABASICS – Timesheets & Expense Reporting (Finance)
Dynamic Budgets – Budgeting, Forecasting, and Reporting (BC/GP)
ERP Connect Consulting – Auto Create Dimensions Tool (BC)
HighRadius – AR/Collections (Finance)
Metafile Information Systems – Document Management (Finance)
Nolan Business Solutions – Cash Management Solutions (GP)
PairSoft – AP Automation (BC/GP)
Prophix – Corporate Performance Management (GP)
Paymate Software – HR, Payroll (BC)
Don’t miss this opportunity to supercharge the financial management capabilities of your Dynamics ERP system.
If you can’t make it, register anyway to get access to the recording.
If you are attending Community Summit in Orlando, Florida, on Oct 13-16, stop by and visit these MSDW/ERP Software Blog Financial Tools Showcase presenters.
Anya Ciecierski has worked in sales and marketing in the Microsoft Dynamics channel since 1999. In 2009 she co-founded ERP Software Blog and CRM Software Blog then added ERP Cloud Blog, now the largest group blogs in the space. These sites encourage collaboration between 150 Dynamics partners across the world and educate more than 90,000 readers each month. Anya is committed to the idea of “using the power of the group” to benefit the community as a whole. She also leads the Channel Marketing Academy, a project to connect marketing professionals to share ideas.
Anya Ciecierski has worked in sales and marketing in the Microsoft Dynamics channel since 1999. In 2009 she co-founded ERP Software Blog and CRM Software Blog then added ERP Cloud Blog, now the largest group blogs in the space. These sites encourage collaboration between 150 Dynamics partners across the world and educate more than 90,000 readers each month. Anya is committed to the idea of “using the power of the group” to benefit the community as a whole. She also leads the Channel Marketing Academy, a project to connect marketing professionals to share ideas.
More about Anya Ciecierski