Lightning fast, global scale authorisation service without the overhead of (yet another) modeling language.
Sentium is an authorisation service for securing your applications and services using zero trust1 fine-grained access control (FGA).
We designed Sentium to be as powerful and scalable as Zanzibar — Google’s Consistent, Global Authorization System yet simple enough to start using without the overhead of having to learn a new modeling language or a policy syntax.
There are other open-source (and commercial) authorisation services, some are inspired by Google Zanzibar while others tend to offer policy-as-code solutions. But these solutions require learning a new modeling language or a policy syntax creating unnecessary complexities.
Using an authorisation service shouldn't come with a requirement to be an expert in building and maintaining authorisation models or policies. It should be as easy as using an API.
Sentium lean on well known API design principals to provide an authorisation service that's easy to integrate, quick to master and flexible enough to handle complex requirements.
- Schema-less fine-grained access control (FGA)
- Zero-trust, least privilege architecture (ZTA)
- Predictable constant time authorisation checks (O(1))
- Strongly consistent with no cache
- Cloud native at global scale2
- ABAC, RBAC & ReBAC (with constraints)
- Multi-tenancy support, if you need it
- Not just authorisation checks, list users, resources a user can access and users with access to a resource
- First class treatment for listing endpoints with pagination and limits to handle large datasets
- Built using the fastest gRPC server implementation3
- CMake (>= 3.23)
- Protobuf (>= 3.15)
- libpq
- PostgreSQL (or PostgreSQL protocol compatible server)
❯ cmake -B .build -G Ninja \
-DCMAKE_BUILD_TYPE=Release \
-DPostgreSQL_ADDITIONAL_VERSIONS=16 \
-DSENTIUM_ENABLE_COVERAGE=OFF
❯ cmake --build .build --target sentium
❯ psql --dbname=postgres
psql (16.1)
Type "help" for help.
postgres=# create user sentium;
CREATE ROLE
postgres=# create database sentium owner sentium;
CREATE DATABASE
❯ psql --username=sentium --dbname=sentium < db/schema.sql
❯ PGDATABASE=sentium PGUSER=sentium ./.build/bin/sentium
Listening on [127.0.0.1:8080] ...
❯ grpcurl \
-import-path proto \
-import-path ./.build/_deps/googleapis-src \
-proto proto/sentium/api/v1/principals.proto \
-plaintext \
localhost:8080 sentium.api.v1.Principals/Create
{
"id": "cn7qtdu56a1cqrj8kur0"
}
❯ grpcurl \
-import-path proto \
-import-path ./.build/_deps/googleapis-src \
-proto proto/sentium/api/v1/authz.proto \
-plaintext \
-d '{
"principal_id": "cn7qtdu56a1cqrj8kur0",
"resource_type": "documents",
"resource_id": "65bd28aaa076ee8c8463cff8"
}' \
localhost:8080 sentium.api.v1.Authz/Grant
{}
❯ grpcurl \
-import-path proto \
-import-path ./.build/_deps/googleapis-src \
-proto proto/sentium/api/v1/authz.proto \
-plaintext \
-d '{
"principal_id": "cn7qtdu56a1cqrj8kur0",
"resource_type": "documents",
"resource_id": "65bd28aaa076ee8c8463cff8"
}' \
localhost:8080 sentium.api.v1.Authz/Check
{
"ok": true
}
❯ grpcurl \
-import-path proto \
-import-path ./.build/_deps/googleapis-src \
-proto proto/sentium/api/v1/principals.proto \
-plaintext \
localhost:8080 sentium.api.v1.Principals/List
{
"principals": [
{
"id": "cn7qtim56a1cqrj8kurg"
},
{
"id": "cn7qtdu56a1cqrj8kur0"
}
]
}
❯ grpcurl \
-import-path proto \
-import-path ./.build/_deps/googleapis-src \
-proto proto/sentium/api/v1/resources.proto \
-plaintext \
-d '{
"principal_id": "cn7qtdu56a1cqrj8kur0",
"resource_type": "documents"
}' \
localhost:8080 sentium.api.v1.Resources/List
{
"resources": [
{
"id": "65bd28aaa076ee8c8463cff8",
"type": "documents"
}
]
}
❯ grpcurl \
-import-path proto \
-import-path ./.build/_deps/googleapis-src \
-proto proto/sentium/api/v1/resources.proto \
-plaintext \
-d '{
"resource_type": "documents",
"resource_id": "65bd28aaa076ee8c8463cff8"
}' \
localhost:8080 sentium.api.v1.Resources/ListPrincipals
{
"principals": [
{
"id": "cn7qtdu56a1cqrj8kur0"
}
]
}
- fmt - For string formatting.
- googleapis - For annotations to help with gRPC/JSON transcoding.
- googletest - For tests.
- grpcxx - For the gRPC server.
- libpqxx - For PostgreSQL connections.
- libxid - For globally unique IDs.
- Thanks to @kw510, @neculalaura and @td0m
for their contributions on the
gatekeeper
branch.
Footnotes
-
Scalability depends on underlying PostgreSQL protocol compatible database scalability. ↩