Overview

Authorization is the process of determining whether a user is allowed to perform an action. In the context of Frontier, authorization is the process of determining whether a user is allowed to perform an action on a resource. This is done after the system has already confirmed that user has proven their identity (authentication).

Frontier authorization is based on the Role Based Access Control (RBAC) model. In RBAC, access is granted to users based on their roles. A role is a collection of permissions that can be assigned to a user. Permissions determine what actions are allowed on a resource. When a role is assigned to a user, the user is granted all the permissions that the role contains.

In the Frontier, several key components and concepts come into play for authorization of user request to access resources. Let's first look into how a normal user request flow with Frontier will look like.

sequenceDiagram
    participant User
    participant App
    participant Frontier
    participant SpiceDB
    %
    User->>App: Request Resource
    App->>Frontier : Authenticate User
    Frontier->>App: User Authenticated
    %
    Note over Frontier,User: Assuming user is authenticated <br/> Now check if user is authorized to access the resource
    alt Case A: User Unauthorized
        App->>Frontier : Check User is Authorized
        Frontier ->>SpiceDB: Check API
        SpiceDB->>App: Invalid Permission
        App-->>User: Return Permission Denied
    else Case B: User Authorized
        App->>Frontier : Check User is Authorized
        Frontier->>SpiceDB: Check API
        SpiceDB->>App: Valid Permission
        App-->>User: Return Resource
    end

SpiceDB is Authzed's open source Google Zanzibar inspired permission system which is capable of answering the question like

does <User> have <permission> on <resource>?

Permissions are defined as relationships between Users and resources. A User can be a user, a group, or any other entity that needs to be granted permissions. A resource can be a file, a database, or any other object that needs to be protected.

The SpiceDB permissions system works by first creating a permissions schema that defines the relationships between Users and resources. The relationships between resources and Users used for permissions checks are stored within SpiceDB's data store. The schema is then used to create a graph of permissions, where each node in the graph represents a User or resource, and each edge in the graph represents a permission.

When a permission check is performed, SpiceDB traverses the permissions graph to determine whether the User has the required permission to access the resource.