Alex Olivier

Un-complicate authorization maintenance

Is your authorization logic a tangled mess of spaghetti code? Learn how to decouple it into a central service and manage permissions as versioned code.

Un-complicate authorization maintenance
#1about 2 minutes

Differentiating between authentication and authorization

Authentication verifies a user's identity, while authorization determines what actions that verified user is allowed to perform.

#2about 15 minutes

How authorization logic evolves into spaghetti code

As a product grows, simple role checks escalate into complex, hardcoded logic for packaging, regions, enterprise features, and compliance, creating a maintenance bottleneck.

#3about 2 minutes

Why microservices exacerbate authorization maintenance issues

In a microservices architecture, authorization logic must be re-implemented and maintained across multiple services, languages, and teams, increasing complexity and risk.

#4about 5 minutes

A modern approach using a decoupled authorization service

Decoupling authorization logic into a central, policy-based service separates it from application code, enabling independent evolution and management.

#5about 8 minutes

Implementing decoupled authorization with the sidecar pattern

Deploying the authorization service as a sidecar in Kubernetes co-locates it with your application for low-latency checks while keeping the logic centralized.

#6about 3 minutes

Evaluating the advantages and disadvantages of decoupling

Decoupling provides centralized logic, language agnosticism, and consistent audit trails, but requires managing an additional service and potentially learning a new DSL.

#7about 1 minute

Using the open source project Cerbos for authorization

Cerbos is an open-source, self-hosted authorization service that implements the decoupled, policy-based approach for managing complex permissions.

#8about 19 minutes

Answering audience questions on authorization best practices

The discussion covers implementing authorization at different OSI layers, ensuring changes are tested, identifying complexity, and handling compromised credentials.

Related jobs
Jobs that call for the skills explored in this talk.

test

Milly
Vienna, Austria

Intermediate

test

Milly
Vienna, Austria

Intermediate

Matching moments

The challenges of embedding authorization in application code
01:51 MIN

The challenges of embedding authorization in application code

Decoupled Authorization using Policy as Code

The challenges of traditional in-code authorization logic
00:15 MIN

The challenges of traditional in-code authorization logic

Keymate – Modern Authorization for Developers

Externalizing authorization with service mesh and API gateways
03:20 MIN

Externalizing authorization with service mesh and API gateways

Keymate – Modern Authorization for Developers

Enhancing applications with observability and authorization
14:08 MIN

Enhancing applications with observability and authorization

30 powerful AWS hacks in just 30 minutes: Boost your developer productivity

Introducing Policy as Code and Open Policy Agent
04:57 MIN

Introducing Policy as Code and Open Policy Agent

Decoupled Authorization using Policy as Code

Enabling developer autonomy with GitOps and CRDs
04:43 MIN

Enabling developer autonomy with GitOps and CRDs

Software Engineering Social Connection: Yubo’s lean approach to scaling an 80M-user infrastructure

Demoing step-up authorization and system architecture
18:42 MIN

Demoing step-up authorization and system architecture

Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue

Enabling developer autonomy with a self-service platform
01:40 MIN

Enabling developer autonomy with a self-service platform

Startup Presentation: Achieving True Developer Self-Service in Kubernetes

Featured Partners

Related Videos

See all videos
Decoupled Authorization using Policy as Code32:16

Decoupled Authorization using Policy as Code

Anderson Dadario & Denys Vitali

Keymate – Modern Authorization for Developers06:04

Keymate – Modern Authorization for Developers

Halil Özkan

Policy as [versioned] code - you're doing it wrong45:57

Policy as [versioned] code - you're doing it wrong

Chris Nesbitt-Smith

Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue23:29

Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue

Deepu

Full-stack role-based authorization in 45 minutes43:12

Full-stack role-based authorization in 45 minutes

Bartosz Pietrucha

Application Modernization Leveraging Gen-AI for Automated Code Transformation41:17

Application Modernization Leveraging Gen-AI for Automated Code Transformation

Syed M Shaaf

Break the Chain: Decentralized solutions for today’s Web2.0 privacy problems29:31

Break the Chain: Decentralized solutions for today’s Web2.0 privacy problems

Adam Larter

Delegating the chores of authenticating users to Keycloak23:42

Delegating the chores of authenticating users to Keycloak

Alexander Schwartz

Related Articles

View all articles
CH
Chris Heilmann
WeAreDevelopers LIVE days are changing - get ready to take part
Starting with this week's Web Dev Day edition of WeAreDevelopers LIVE Days, we changed the the way we run these online conferences. The main differences are:Shorter talks (half an hour tops)More interaction in Q&AA tips and tricks "Did you know" sect...
WeAreDevelopers LIVE days are changing - get ready to take part

From learning to earning

Jobs that call for the skills explored in this talk.