Thread by @Auth0Lab

.@dschenkelman's chat with @juanrossi, a Senior Platform Security Manager at @Mercadolibre. Join us to know more about their Authorization challenges and how they tackled them.

Join here twitter.com/i/spaces/1yNGa…

https://twitter.com/dschenkelman/status/1417982590296920064

#Authorization and #Authentication are too critical to have everyone learning and implementing them from scratch. With more tens of thousands of employees, @Mercadolibre needed to create a solution that is easy to use and can be implemented in any language and tech stack

They also needed to solve for an important problem that touches on #AuthN and #AuthN: how to handle delegation of permissions, where a user can act on behalf of another user.

They have thousands of applications.

Having each service had to do it's own authorization raised some issues:
* requires maintaining every implementation to prevent vulnerabilities
* improvements & new features rely on modifying implementations by many teams
* visibility is hard

A centralized solution that is standardized within the company & shared by multiple systems alleviates many of these issues

* Create an token and send it to applications.
* Applications request decision from the policy agent.

Downsides: higher latency, single point of failure

> Downsides: higher latency, single point of failure

Bundling the AuthZ agent into sidecars improves latency and performance.

Side-note: This article from the @netflix tech blog might be interesting to people following along:

netflixtechblog.com/edge-authentic…

AuthZ question and logic "if user has this permission, allow otherwise deny" implemented in #Rego and evaluated on a framework based on #OPA

Rego allowed them writing #AuthZ decisions and use regex, loops, etc.. It is a complex language with a learning curve.

Benefit of #Rego and #OPA:
* Framework is pretty good on the optimization side where policies are indexes
* policies evaluated in microseconds

Because of it's complexity and steep learning curve, asking the whole company (thousands of employees) to learn #Rego was not practical

They needed to create abstractions that make it as simple as possible to implement #AuthZ

Q: How do you know if a team is using an #AuthZ anti-pattern
A:
* Hard to police
* Educate. New system in place for only a few months, work is still underway to document and answer most questions
* Push people away from writing their own #Rego solution
* Consistent approach

They have policies stored on S3, sidecars pull the information every minute, and update in memory if changed.

Checks prevents people from deploying policies to production without approval.

While building their solutions, they focused on having a generic solution that can handle permissions and can answer any #Authorization question.

Resilience and low-latency were also important

Pragmatism is important.

They did not focus on having the most performant and scalable solution from day one.

* test hypothesis early
* build a system that performs correctly
* iterate from there

That was it!

Recording of the discussion will be up in the next few days

Thanks to @juanrossi from @MercadoLibre for joining us and sharing his insight & knowledge into #AuthZAtScale, the challenges he and his team are facing, and his thoughts on how they are approaching them

If you didn't manage to catch the chat yesterday, fear not! The recording is now up. You can find it here 👇

https://twitter.com/dschenkelman/status/1418343485057507335?s=20