Hi guys, is there anybody who has successfully built something like an AWS IAM inspired permission management model with the Keto OPL? Currently trying to implement that and finding it hard to grasp how it could be done, there are some things that might not be possible like precedence of effects (explicit

deny

denies all other

allow

effects and things like that). Also it seems like the subject-set rewrite relations are not “visualized” in any of the keto expand commands which makes it difficult to follow the logic sometimes.

hey thanks for all the feedback, actually a lot of the things are know issues: • https://github.com/ory/keto/issues/1060 • https://github.com/ory/keto/issues/292 • the empty subject set relations are already fixed but not yet released to prod • did the errors persist or was it only temporary? I will try to trace them in our monitoring

Thanks for getting back! Hope you had a nice weekend. Yeah, I saw those existing issues after I posted here, sorry about that. Unfortunately the errors did indeed persist, and I’m facing new ones. It’s a bit puzzling, tbh, I feel like there shouldn’t be any. I have this namespace configuration now which is accepted by the editor in the frontend. I’m still playing around to come up with something like AWS IAM to get a feel for keto.

import { Namespace, SubjectSet, Context } from "@ory/keto-namespace-types"

class User implements Namespace { }

class Group implements Namespace {
  related: {
    member: (User | Group)[]
  }
}

class Project implements Namespace {
  related: {
    access: (User | Group)[]
  }
}

class Role implements Namespace {
  related: {
    principal: Project[]
  }
  permits = {
    can_assume: (ctx: Context) => this.related.principal.traverse((p) => p.related.access.includes(ctx.subject))
  }
}

class Policy implements Namespace {
  related: {
    allow: Role[]
  }
  permits = {
    allow: (ctx: Context) => this.related.allow.traverse((r) => r.permits.can_assume(ctx))
  }
}

class ResourcePolicy implements Namespace {
  related: {
    trust: (User | Group)[]
  }
}

class S3ResourceType implements Namespace {
  related: {
    create: Policy[]
    write: Policy[]
    read: Policy[]
  }

  permits = {
    can_create: (ctx: Context) => this.related.create.traverse((p) => p.permits.allow(ctx)),
    can_write: (ctx: Context) => this.related.write.traverse((p) => p.permits.allow(ctx)),
    can_read: (ctx: Context) =>
      this.related.read.traverse((p) => p.permits.allow(ctx)) ||
      this.related.write.traverse((p) => p.permits.allow(ctx))
  }
}

class S3Resource implements Namespace {
  related: {
    instance: S3ResourceType[]
    write: ResourcePolicy[]
    read: ResourcePolicy[]
  }
  permits = {
    can_write: (ctx: Context) =>
      this.related.instance.traverse((i) => i.permits.can_write(ctx)) ||
      this.related.write.traverse((rp) => rp.related.trust.includes(ctx.subject)),
    can_read: (ctx: Context) =>
      this.related.instance.traverse((i) => i.permits.can_read(ctx)) || 
      this.related.read.traverse((rp) => rp.related.trust.includes(ctx.subject)) ||
      this.related.write.traverse((rp) => rp.related.trust.includes(ctx.subject))
  }
}

I deleted all relation tuples and now I’m trying to add new ones, but I run into segmentation faults with no interpretable error message: This is my rbac_`tuples.json` with relation tuples for the above configuration:

[
  {
    "namespace": "Group",
    "object": "ops",
    "relation": "member",
    "subject": {
      "namespace": "User",
      "object": "hans"
    }
  }
]

And I get this error message:

❯ keto relation-tuple create rbac_tuples.json
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x4be0b79]

goroutine 1 [running]:
<http://github.com/ory/keto/ketoapi.(*RelationTuple).ToProto(...)|github.com/ory/keto/ketoapi.(*RelationTuple).ToProto(...)>
        /project/ketoapi/enc_proto.go:55
<http://github.com/ory/keto/cmd/relationtuple.transactRelationTuples.func1|github.com/ory/keto/cmd/relationtuple.transactRelationTuples.func1>(0xc000321b80, {0xc0002cc2a0, 0x1, 0x1?})
        /project/cmd/relationtuple/delete.go:49 +0x5f9
<http://github.com/spf13/cobra.(*Command).execute(0xc000321b80|github.com/spf13/cobra.(*Command).execute(0xc000321b80>, {0xc0002cc280, 0x1, 0x1})
        /go/pkg/mod/github.com/spf13/cobra@v1.5.0/command.go:872 +0x694
<http://github.com/spf13/cobra.(*Command).ExecuteC(0xc000321400)|github.com/spf13/cobra.(*Command).ExecuteC(0xc000321400)>
        /go/pkg/mod/github.com/spf13/cobra@v1.5.0/command.go:990 +0x3bd
<http://github.com/spf13/cobra.(*Command).Execute(...)|github.com/spf13/cobra.(*Command).Execute(...)>
        /go/pkg/mod/github.com/spf13/cobra@v1.5.0/command.go:918
<http://github.com/spf13/cobra.(*Command).ExecuteContext(...)|github.com/spf13/cobra.(*Command).ExecuteContext(...)>
        /go/pkg/mod/github.com/spf13/cobra@v1.5.0/command.go:911
<http://github.com/ory/keto/cmd.Execute()|github.com/ory/keto/cmd.Execute()>
        /project/cmd/root.go:74 +0x96
main.main()
        /project/main.go:25 +0x69

As for the

keto check

command with the userser rewrite example namespace configuration I still get that error from above:

❯ keto check User:Patrik view File private
Could not make request: rpc error: code = Unimplemented desc = unexpected HTTP status code received from server: 404 (Not Found); transport: received unexpected content-type "application/json"
Error: rpc error: code = Unimplemented desc = unexpected HTTP status code received from server: 404 (Not Found); transport: received unexpected content-type "application/json"

OK, I will take a look into those now as they seem pretty critical 😅

lovely, thank you

I'd recommend the Ory CLI btw: https://github.com/ory/cli it also has the keto subcommands

thank you for investigating! Sorry about that last one…

Haha no worries, the error is really misleading there

Hey, I found something else, added a comment here: https://github.com/ory/keto/pull/657

There were some breaking changes, mostly with naming you should use v1alpha2

thanks for the hint 🙂 I’m now building a grpc client based on the grpc client the keto cli uses, then I want to test the behaviour of my OPL namespace config. So far so good, but I came across this disclaimer here and I am a bit puzzled as to what experience you made here to warrant it: https://www.ory.sh/docs/keto/guides/access-control-list-design-best-practices I can only imagine it’s a performance issue, but traversing the DAG, starting from a object to be checked, should scale linearly with its depth no?

we are still working on a good benchmark and recommend to bench keto with your model if you encounter performance issues, please reach out so we can come up with improvements

hi Patrik, I just bumped into the nested traverse issue as well, I think it’s a pretty essential feature to make multiple hops of traverse. Is there any update/ETA on this issue? https://github.com/ory/keto/issues/1131