Exploring Best Practice for Implementing Authn and Authz in a Cloud-Native...
summary
Dives into concrete design and a live demo integrating Keycloak + OPA/OpenFGA for cloud‑native authn/authz, showing access tokens issued by Keycloak, NGiNX delegating to PDP, and PDP responses allowing or denying requests. Recommends PDP/PEP separation, compares ABAC vs. ReBAC with OPA and OpenFGA examples, and demonstrates dynamic attribute provisioning via a Keycloak SPI. Covers workload identity and token exchange (RFC 8693) for multi‑service and multi‑domain scenarios.
AI-written summary · about
chapters (9)
- 0:00Authentication and authorization
- 2:27Implementing authn and authz
- 8:28Auth trends
- 11:44Designing auth systems
- 16:19Workload authentication
- 17:23Authorization architecture
- 25:19Keycloak and OPA/OpenFGA
- 29:45Live auth integration
- 41:23Summary
related talks
32mAuthz as a Dev Workflow: Architecting Better Cloud Native Apps
25mModernizing Authorization for Cloud Native Applications Using OpenFGA
09mNavigating the Identity Abyss in the AI‑Native Era
42mDesign Patterns for OPA and Cloud Native Authorization
31mDelegate Authentication and a Lot More To Keycloak With OpenID...
39mSecure Authorization for Agentic AI in Multi-Domain Environments
30mAuthZEN in Practice: Standardizing Authorization for Cloud Native Platforms and Agents
26mFine-Grained User Authorization for Kubernetes with OPA and LDAP