Clojurians Log v2

@lepistane, I spent the better half of 2024 implementing https://authzed.com/spicedb at https://cloudafrica.net/, which I regard as the most faithful open-source implementation of Google Zanzibar (which powers YouTube, Gmail & GDrive). Out of that work came https://github.com/theronic/eacl: a situated https://en.wikipedia.org/wiki/Relationship-based_access_control authorization library based on SpiceDB, built in Clojure and backed by Datomic. It directly addresses the problem of fine-grained hierarchical permissions: • Source: https://github.com/theronic/eacl • Rationale: https://eacl.dev/ • EACL Version 6.1 offers sub-millisecond performance and has replaced SpiceDB at CloudAfrica, without the syncing pain. Refer https://x.com/PetrusTheron/status/1996344248925294773. (I am the author.)

At All Street - we use Auth0 for authenticating users and lookup user purchases in Stripe for authorisation. This is probably overkill for most usecases. Some of our internal tools use Basic Auth which can work fine for internal users and demos.

I guess it depends on your requirements. I’d externalize authentication to something like Okta, Auth0, Keycloak, etc. Authorization, Open Policy Agent. Although I might be biased 🙂

Authorisation could be as simple as fields in your user database or a config file or permissions - doesn't have to be an external managed service.

Yep, depends largely on whether it’s a distributed application on being built, or a monolith.

Problem with external managed auth service is price. Ours started as free and has risen to $400 per month - for effectively the same thing. For that amount it would have been better to go for internal auth from the start.

There are many open source providers for external authentication though.

Yup - we'll consider options at some point. When we started using it we weren't expecting it to shoot up as much.

There is a nice Clojure wrapper for Keycloak that you may wanna check out. https://nextjournal.com/schmudde/keycloak-environment

https://github.com/jgrodziski/keycloak-clojure

And there is Friend - older and Buddy - most used for new stuff https://github.com/coast-framework/coast/blob/master/docs/authentication.md

Author of https://github.com/jgrodziski/keycloak-clojure here feel free to ask anything! I find Keycloak efficient and battle-tested at runtime, authentication is very easy as it follows OAuth2/OIDC and it’s just some redirect mechanisms and token verification. Keycloak deals with all the authentication workflow very easily. The https://www.keycloak.org/docs/latest/authorization_services/index.html is exhaustive but imho worth the effort only for extensive needs. Role-based access control is easy to setup in Keycloak (as the source of truth of roles granted to identity) and for enforcement in application it depends of the lib you use but it’s easy to setup with Yada or with a ring-middleware (look at keycloak-clojure doc for details on that or msg me). For authorization the topic is wide but some newcomers in that field seems interesting : https://www.aserto.com , https://github.com/Permify/permify, https://www.openpolicyagent.org/ but don’t have first hand experience…

https://github.com/anderseknert/clj-opa

(I work on the OPA project 🙂)

Thanks everyone! I will check all of these.

@lepistane fyi v6.1 has https://github.com/theronic/eacl/commit/d2f722ff508a5f31ec28986ecd5630f8f83edc5f with caching of permission paths (10-20x perf. improvement) Note that the cache is currently only evicted at startup, so if you change permission schema at runtime you'll need to clear the cache by calling evict-permission-paths-cache! until eacl/write-schema! lands with support for a subset of SpiceDB schema syntax (requires quite a bit of validation & diffing to create/delete relations as needed).