How Netflix Is Solving Authorization Across Their Cloud [I] - Manish Mehta & Torin Sandall, Netflix

How Netflix Is Solving Authorization Across Their Cloud [I] - Manish Mehta & Torin Sandall, Netflix
Since 2008, Netflix has been on the cutting edge of cloud-based microservices deployments. In 2017, Netflix is recognized as one of the industry leaders at building and operating “cloud native” systems at scale. Like many organizations, Netflix has unique security requirements for many of their workloads. This variety requires a holistic approach to authorization to address “who can do what” across a range of resources, enforcement points, and execution environments.
In this talk, Manish Mehta (Senior Security Software Engineer at Netflix) and Torin Sandall (Technical Lead of the Open Policy Agent project) will present how Netflix is solving authorization across the stack in cloud native environments. The presentation shows how Netflix enforces authorization decisions at scale across various kinds of resources (e.g., HTTP APIs, gRPC methods, SSH), enforcement points (e.g., microservices, proxies, host-level daemons), and execution environments (e.g., VMs, containers) without introducing unreasonable latency. The presentation includes a deep dive into the architecture of the cloud native authorization system at Netflix as well as how authorization decisions can be offloaded to an open source, general-purpose policy engine (Open Policy Agent).
This talk is targeted at engineers building and operating cloud native systems who are interested in security and authorization. The audience can expect to take away fresh ideas about how to enforce fine-grained authorization policies across stackthe cloud environment.
About Manish Mehta
Manish Mehta is Senior Security Software Engineer at Netflix, Los Gatos, CA. He has designed and developed solutions around secure bootstrapping, authentication (service and user), and authorization for cloud-native infrastructure. His professional interests and expertise are cyber security in general, and specifically in security solutions anchored in cryptography. He holds M.S. and Ph.D. in Computer Science from Univ. of Missouri - Kansas City and has authored several research and conference publications.
About Torin Sandall
Torin Sandall is the technical lead of the recent open source Open Policy Agent (OPA) project. He has spent 10 years as a software engineer working on large-scale distributed systems projects. Prior to working on the Open Policy Agent project, Torin was a senior software engineer at Cyan Inc. (acquired by Ciena Corp.) where he designed and developed core components of their SDN/NFV platform such as modelling languages as well services for resource orchestration and topology discovery. Torin has recently given talks on policy-related topics in Kubernetes at ContainerDaysPDX and LinuxCon Beijing as well as the Kubernetes Community Meeting and the Kubernetes SF meetup.
Join us for KubeCon + CloudNativeCon in Barcelona May 20 - 23, Shanghai June 24 - 26, and San Diego November 18 - 21! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.

[@brainoverflow98]

And I'm here trying to solve the Authorization problem by myself as a undergraduate! This is a whole different story.

[@jasontruter7239]

I've implemented microservice authorization using opa and serverless in AWS. Custom authrorizer is the location where I decode a JWT token and verify authorization.

[@sahilroyal8939]

You are genius Jason

[@FINSuojeluskunta]

The explanation of how it ties in with data is vague. Say I have a database with all of my pets and their owners in it. Doesn't make sense to do this via http request because most authorization requires a database call if it's not something simple stored in the jwt and the only way I see this working is if we send it a list of owners in the request. However, it seems nice for microservices without network roundtrips.

[@andrewstark917]

so technically if I want to bind a few billions of users who can edit this post, I have to add them manually to OPA rule dataset to bind it? So from server we send the current user id and OPA check if passed id is among manually bound billions of ids? It will take dozens of years to fill them manually, or insane of traffic to pass on each request

[@BradleyWeston92]

Great talk! Just a few questions what stops an application posing itself as a different app name? What verifies a user is a certain user and not another user, example just a token that is validated before the requests gets to the service?

[@aditya234567]

All that comes in authentication

[@mukuz]

Signed JWT

[@user-yh8hl9wy9b]

We are awlays speaking about Authorization for a single resource, Get Employees/123 Update Employees/123, what about Get List Employees or search operation... how this pattern will act ? Thanks

[@sksjdfl]

I am question , when the authorization of each user changed in example , the role of user in group is exprised or new policy of business was changed the permissions , how you resolve the changed in OPA and updating the permissions in JWT payload or other shared memories of authorizaton server. I assume in case realtime in hight rate request of client

[@danielpops]

The jwt payload should ideally not carry any authorization information

[@ranajitjana4030]

is it open sourced yet? Nice stuff

[@srikumarks]

Authorization applies to resource access as well as information access. Does OPA cover situations where role R is permitted to access resource X except for the F field that the service sends in its response? One answer would be to author the service to separate out such "sensitive" information as a resource .. but that may not always be possible, especially retrospectively. For example, a customer support app may want to retrieve a customer's information but not have permission to read bank account number. If the "customer info" service clubs all of that .. we'll want to restrict the response to a subset.

[@79sajidzaman]

One solution is to separate services altogether, If you separate services for different roles this could solve it.

[@satyachillale]

How do you scale when you have 100s of millions of users ? Can the auth agent store so much of data in memory ?

[@irasychan]

database sharding can be a great help on that

[@sksjdfl]

@@irasychan how cant update the authorization of regular user

[@ChengZhao]

Is this similar to what Istio does?

[@natecoffing2591]

Perhaps when Istio is able to run across legacy apps and microservices