Authorisation Permission & User model

[ymao2]

Topic

As important part of delivering new Data platform, how to manage the user's access permissions cross different tools and services easily and securely is key part, we are having the trouble to track and manage them, the flow are not very clear for users to follow.

This discussion is to start with building the foundation of model to design a data structure for storing permission information, which can be translated/mapped into actual permission policies for a user.

Thing to consider

The permission model should cover following resources

• Data product
• Data source (maybe on folder level)
• Data schema
• Tools
  • Open Metadata

And models should be relevant easy to be mapped into actual platform or tools's internal policies (Most of them are using popular permission approaches RBAC & ABAC & PBAC etc)

And models should be possible to be implemented on chosen auth platform e.g. auth0 + AAD, AD

[ymao2]

just found out some quite useful and interesting links about authorisation models
solution from auth0 FGA (Open FGA)
https://docs.fga.dev/intro/authorization-and-okta-fga
https://openfga.dev/#quick-start
solution from AWS
https://aws.amazon.com/verified-permissions/

[ymao2]

ReBAC, PBAC and RBAC

[ymao2]

I will bury this discuss as I am going to leave (RIP) , and seems no one interested in it 😄