Is spicedb planning for openid authZen compliance ?

[gberche-orange]

Hi,

I have a similar question to https://linen.authzed.com/t/26975721/hello-can-i-know-if-spicedb-is-following-or-hoping-to-follow

Esala Mapa 02/17/2025, 6:47 AM
Hello, Can I know if spiceDB is following or hoping to follow AuthZen work group's specifications for authorization API ?https://openid.net/specs/authorization-api-1_0-02.html#name-introduction

Searching for openid or authzen in the https://github.com/authzed org does not yet return results.

Thanks in advance for your help

[jzelinskie]

Hi there!

So far there's no official support in SpiceDB for any of the work being actively developed by the authzen working group.
I'd be interested in hearing about your use case because we haven't really gotten any requests for this in the past.

It'd be pretty simple to build a proxy around SpiceDB to serve API results in the authzen format as an experiment and if there's demand perhaps it could be built into SpiceDB itself. However, AFAICT there is little traction behind authzen and the folks leading the group have now shut down their authorization company: https://www.aserto.com/blog/the-final-chapter-for-aserto

[gberche-orange]

Thanks for your feedback and perspective.

I'd be interested in hearing about your use case because we haven't really gotten any requests for this in the past.

Like most standards, use case for authZen at my company is portability among ReBAC engine implementations, and potentially interoperability/exchanges of ReBAC models and datasets among applications. This is still an early interest in my company that will become more precise as ReBAC adoption grows.

The working group charter details some other use-cases and goals at https://openid.net/wg/authzen/

As I understand, the current draft specs focuses on the ReBAC engine API https://openid.github.io/authzen/ (as an alternative to implementation specific apis like OpenFGA REST API, spice db REST API to GRPC api) but does not yet standardize the model format (as an alternative to OpenFGA configuration language or spice db schema language), or an export format for the relationships (as an alternative to spice db backup format in apache avro containers or openfga internal db format (see https://github.com/orgs/openfga/discussions/432) or potentially auth0 fga backup/restore support)

However, AFAICT there is little traction behind authzen and the folks leading the group have now shut down their authorization company: https://www.aserto.com/blog/the-final-chapter-for-aserto

I won't be able to comment on the authZen adoption, and contribution diversity beyond aserto. I see regular meetings from https://hackmd.io/@oidf-wg-authzen, active contributions at https://github.com/openid/authzen/graphs/contributors

I also see some plans for authZen compliance by auth0 fga/openfga:

• https://openfga.dev/blog/fine-grained-news-2025-02

Sam Bellen will participate in the Gartner IAM EMEA event demoing OpenFGA interoperability with the AuthZen standard.

• Allowing a PDP to specify Application id in a multi-Application/PEP to PDP environment openid/authzen#164 (comment)

In OpenFGA we support multiple 'stores', which can be used for multiple environments or tenants. Currently we are using the store_id as part of the AuthZen base url.