We are prototyping the intergration of kratos/keto/oathkeeper to our auth stack. Actually we user

remote_json

to call keto to allow access based on API method and path pattern, it work beautifully, now I need to implement access rule per entity id, what's the best way to do it ? Keto check api allow only one tuple to be checked, so I will need kind of a proxy API to check the API access tuple and the entity id access rule ... or is it better to delegate the entity based id check to the backend API ? Thanks for your help

what do you mean by "access rule per entity id"? what is an entity in your case? and what kind of check did you get to work already?

HI Patrick, by ex, if a User access POST /api/product/{productId}/publish I need to validate that the method and the path is allowed for the User (currently works), then I need to check if Product ID is allowed for the current user (basically I need to check if the product is attached to a Team of the current user internally (those informations are all into Keto)

hm, why don't you use the permissions in keto instead of making two calls? so similar to

class Product implements Namespace {
  related: {
    owner: (Team | User)[]
    viewer: (Team | User)[]
  }

  permits = {
    publish: (ctx) => this.related.owner.includes(ctx.subject),
    edit: (ctx) => this.related.owner.includes(ctx.subject),
    view: (ctx) => this.related.owner.includes(ctx.subject) || this.related.viewer.includes(ctx.subject),
  }
}

then you have to select the right permission depending on the path and method, basically by having multiple access rules, one for each permission

- id: product-publish
  match:
    methods: [POST]
    url: "/api/product/<.*>/publish"
  authorizer:
    handler: remote_json
    config: # with the publish permission
- id: product-view
  match:
    methods: [GET]
    url: "/api/product/<.*>"
  authorizer:
    handler: remote_json
    config: # with the view permission
- id: product-edit
  match:
    methods: [PUT, POST]
    url: "/api/product/<.*>"
  authorizer:
    handler: remote_json
    config: # with the edit permission

I will try this, and let you know how it work for us. Thanks a lots for your help, and your awesome software, really like to work with kratos, keto and oathkeeper.

Nice, glad to help