Ladon
Dev tools
access control library
SHOW HN2017
158points
25comments
#237of 2,242 in 2017
Top 11%of 2017 by points
How HN took it
DebatedReal support and real criticism
3 positive, 3 neutral or asking, 1 mixed, 4 critical, out of 11 comments about the project. Thread score -0.10.
Idea: 2 for, 4 againstDesign: 1 for, 0 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Good idea to have a reusable access control framework
From 2 comments
Definitely going to be looking more into this. I am just about to start a project that needs ACLs, and I was surprised to find that I was going to have to write a solution…
caipre on HNAfter implementing an ACL system with permissions inheritance for child nodes, I'm of the opinion that it's not really something that can be written by humans efficiently. Not to…
zackmorris on HN
Objections
IAM-style policies are complex and easy to misconfigure
From 3 comments
"fine-grained access control in complex environments" Oh that sounds... "...is inspired by AWS IAM Policies." Oh god no. My day to day work is debugging IAM polices that have…
posnet on HNIt almost always comes down to complexity. The inclusion of boolean logic in the policies is the root cause. Specifically, having not resources, or not principals and their…
posnet on HNJust to give an example of the pain that can be caused by NotAction in practice: https://www.reddit.com/r/aws/comments/3recc9/this_iam_policy_did_not_do_what_i_thought/ This…
schlarpc on HN
Simple in-code permission registries may be enough
From 1 comment
I use a much smaller solution than this which just registers a list of permissions in memory of the form: role x can perform action y on resource z and then offers checks like…
grey-area on HN
Requests
Support LDAP for user storage
From 1 comment
LDAP is still the industry standard for storing user data, please support that.
softwarelimits on HN
Questions
Are there comparable established libraries?
From 1 comment
Definitely going to be looking more into this. I am just about to start a project that needs ACLs, and I was surprised to find that I was going to have to write a solution…
caipre on HN
Alternatives named
gorbac
From 1 comment
We are using https://github.com/mikespook/gorbac right now, which works well for us. But we do not have any multi tenant requirements.
weitzj on HN
Custom in-memory role-permission checks
From 1 comment
I use a much smaller solution than this which just registers a list of permissions in memory of the form: role x can perform action y on resource z and then offers checks like…
grey-area on HN