6 / 7 Authorization: RBAC, ABAC & Policy

Two Groups Deep

A Zanzibar-style authorization service holds this namespace config and these relation tuples.

namespace "doc" {
  relation "parent" { }
  relation "editor" { _this }
  relation "viewer" {
    union {
      _this
      computed_userset { relation: "editor" }
      tuple_to_userset { tupleset: "parent", computed_userset: "viewer" }
    }
  }
}

doc:q3-plan#parent@folder:finance
doc:q3-plan#editor@23
folder:finance#viewer@group:analysts#member
group:analysts#member@group:interns#member
group:interns#member@7
group:interns#member@11

What does Check(doc:q3-plan#viewer@7) return, and by what path?

A

Allowed, but only through computed_userset: doc:q3-plan#editor@23 folds editor into viewer, and 7 inherits it as a member of the same group as 23.

B

Allowed. tuple_to_userset on parent reaches folder:finance#viewer, whose member is the userset group:analysts#member, which contains the userset group:interns#member, which contains user 7.

C

Denied. No tuple names user 7 anywhere under doc:q3-plan, and userset rewrite expands only relations defined on the object being checked.

D

Denied. group:analysts#member@group:interns#member is not a legal tuple, because a userset may appear on the left of @ or the right, not both.