Hacker News Reader

Comment by svnpenn | Hacker News Reader

Isn't this just reinventing OAuth?

OAuth already has grant_type and "scope" to cover different devices, flows and permissions.

Um no. The issue is authorization is a million tentacled octopus that reaches into every crevice of your app, and if the app is built out of multiple services, auth reaches into those. The thread someone just linked from yesterday (https://news.ycombinator.com/item?id=28543457) and the article it points to is sales-y but gives a picture of some of the issues.

Author of the article here.

This is a very common question we get. OAuth is great for when the permissions can be modelled as a set of roles/scopes which apply uniformity. Where that breaks down as described in the article is when there needs to be more context involved in the authoriZation - beyond simple roles from your chosen autheNtication provider.

The fact that OAuth isnt mentioned a single time in the article is glaring. You should at least have a paragraph like "why not just use OAuth?" where you answer that question. Otherwise it seems youre avoiding the question on purpose, as these two items are clearly in the same space.

Thanks for the feedback - are are working on adding more comparisons of technologies onto https://cerbos.dev and will certainly make sure to include OAuth

The auth in OAuth stands for authentication. This is authorization.

OAuth is an authorization framework.

Not according to the OAuth 2.0 RFC, which is titled "The OAuth 2.0 Authorization Framework": https://datatracker.ietf.org/doc/html/rfc6749

Reply on news.ycombinator.com