Hacker News Reader

Comment by emreb | Hacker News Reader

CEO of Cerbos here - we'd love to hear about the other headaches everyone has faced. Authorization as we know it, isn't core to anyone's roadmap and we want to make it as easy as possible to meet the all the crazy requirements.

We are building out examples of how to solve common use cases which you can find on https://cerbos.dev/

View on HN

Will you build integration libraries or SDKs for the common programming languages and flows? In my case I'm with C# and use the dependency injection to get an instance of a service that verifies the user requests.

We are working through the priority list of SDKs. You can find them all on https://github.com/cerbos/

Node, Java and Go are already available and other languages are coming very soon.

The architecture image on Cerbos makes it look like you pull stateful attributes from the primary sources (AD?). That doesn’t seem like it will scale well compared to cache or stateless designs.

What TPS do you support? Response latency?

Cerbos is stateless by design and was in fact born out of our experience of running services that handled 100k+ RPS with millisecond latency. It does not pull any data from other external sources, rather all the information required to make a decision is passed in the call to check if a request is authorized. Cerbos makes decisions based on the policies and the context provided at the request time. In most cases, the context is already in the services making the check. (it knows which user/principal and the resources that are being accessed).

Because Cerbos makes decisions based on contextual data, caching is not very straightforward to implement. Response times are pretty good even without caching. We are constantly working on trying to find ways to make things quicker all the time and that may or may not involve caching.

We are working on producing a reproducible and realistic benchmark for public consumption. In our internal tests, the 95th percentile response times have been always under 10ms. Of course, this depends a lot on how complex the policies are and how much data there is to process.

Reply on news.ycombinator.com