Access Control List Authorization

[A-Legg]

Hey folks!

I’m looking to add Access Control List authorization in a project and was looking for insight as to how others have approached such an authorization scheme in elixir apps? Looks like there are a few open source libs that provide some portion of the desired functionally that could be built on top of like bodyguard or some others that aren’t production ready like terminator. Has anybody implemented a robust ACL auth scheme that they’ve been super happy when in a production app?

Cheers,
Adam

[A-Legg]

Interesting approach here but feels like a lot of work

How does everyone handle resource level permissions?

I recently implemented access control in a Ruby app. The approach would be similar to how I’d go about it in Elixir. We used an access control list model with a database table per resource. So x_acls y_acls, etc. Each access to the particular object would either verify access with a database lookup, or provide a list query with a join (so data you can’t access isn’t returned). We had various access levels, so used a bit field for that. The implementation was pretty much what you’d expect based …

[sb8244]

Yea, it was definitely a ton of work. I left that company, but my understanding is that maintenance cost is high because of how it touches everything.

The hardest thing is knowing that your application ACLs are in use in all the right place. I don’t think that can be a “trust me” exercise, but rather guaranteed via query validation.

–

I implemented a lighter version of ACLs in my current product. It allows each object to have a string ACL like email::test@test.com or group_id::123. This ACL is stored directly on the record (text array) and is queried against using postgres & operator. Each user has a quick way to resolve all ACLs that apply to them and they’re passed into the queries.

The benefit of the “ACL stored on record” approach is that I can easily mirror the ACLs to another environment (Elasticsearch in my case) and apply the same ACLs in queries there. This translation is difficult if you were using joins or other SQL-specific query methods. The downside is that you wouldn’t want really large ACL entries or the records could get large.