How to move your RBAC into Ory
summary
Migrated a brittle legacy RBAC into Ory stack using Keto (ORY's implementation of Zanzibar) plus Kratos/Hydra/Oathkeeper, rebuilt code after a failed C attempt, and ended up with programmatic role creation, tenant isolation by prefixing tenant IDs, and short-lived caches for session checks. Faced surprises: one-per-model permissions caused role bloat, frontend and timezone staffing gaps slowed rollout, and backward compatibility still requires rewriting older services. User migration used scripts and a CSV import; system now enforces permission checks like “can write confidential files” rather than role checks.
AI-written summary · about
chapters (10)
- 0:00Introduction to RBAC
- 1:35Legacy RBAC challenges
- 3:21Introducing Ory Keto
- 4:03How not to migrate to Ory
- 6:51How to migrate to Ory
- 9:19Multi-tenancy in Ory
- 10:22Custom roles and permissions
- 12:49Avoid role hierarchies
- 13:11Sharing code and resources
- 13:58Q&A: Transitioning users
related talks
23mRe-Engineering: Ory Kratos and Ory Keto in production
25mImplementing the Ory stack at Padis
18mRunning Ory on a 30M users platform
22mCustomizing Ory Keto with global-scale data sharing requirements
19mHow TIER IV Replaced Identity Server with Ory
25m Introducing the Ory Network
18mEmpowering no code application development using Ory Kratos and Ory Keto
30mKubernetes RBAC at scale without losing your sanity