How to make ABAC with OpenFGA

[andrea-patricelli]

Hi,

Based on this example I can model ABAC with reBAC.
But how can I build one or more authorization models to fit with use cases where there are more attributes with discrete values involved? For example how can I define rules to make access decisions based on the attributes of an authenticated subject? Am I forced to insert all tuples representing user attributes? Or the only way is to use conditions?

I would like to have the very same thing explained here.

Does OpenFGA really fit with such needs?

[aaguiarz]

Hi @andrea-patricelli

Pure ABAC scenarios is not where OpenFGA shines, but you can model them using the approach you mentioned and the one described here https://github.com/openfga/sample-stores/blob/main/stores/groups-resource-attributes/store.fga.yaml

You'll need to store attributes on OpenFGA or send them as part of the request, depending on the use case.

Do you have a concrete example of what you want to accomplish?

[andrea-patricelli]

Howdy @aaguiarz

thank you very much for the quick answer!

The use case I would like to model is: inside an authentication flow I get some attributes of the authenticated principal, say userType, department, name, surname, etc.
I would like to make an user access if department is dep_01 and userType consultant and name is Bob or starts with B* where userType is a static set of values, but name (and possibly other attributes) could have any value let's say "at runtime".

Moreover (just to add more context) I would like to define several authorization models that involve different attributes, for example in auth model 01 I use department, name and userType, in auth model 02 I would use surname, income and department, etc.

Sample model that you attached is very interesting and passing attributes and defining conditions seems close to my needs. Is there any drawback (performance or kind of forcing) using OpenFGA like that?