Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

<@U05K84CE6PL> can you explain why this is necessary? I dont follow the logic here:
“The only part I am unhappy about this is, for every user, we would have a “self” relationship inserted to the relationships_tuple table, which would have the same subject and object.”

Thank you Thomas for getting back to us. Let's say, we have two users with ids "abc123" and "abc456",  My initial solution (1) is, let them visit /abc123/projects and /abc456/projects to view their respective projects. And we would perform a keto check on the {user-id} part of the path, so that user abc123 can only access /abc123/projects but not /abc456/projects. In that situation, "abc123" is more of a resource rather a subject, hence we would have to use a reflexive mapping to map to the subject I guess. I could totally be missing something here. Also, would you say making the path simply /projects, and we can somehow grab the user id implicitly? I'm not sure how that should be implemented in a self-hosted Oathkeeper, Kratos and Keto setup.