API Gateway Integrations

[aaguiarz]

No description provided.

[dineshkumarsarangapani]

what is expected in api gateway integration? where I can read about this story?

[aaguiarz]

Hi @dineshkumarsarangapani

There are a few related projects already:

https://github.com/openfga/openfga-envoy
https://github.com/k-kahraman/apisix-openfga-authz-plugin
https://github.com/embesozzi/apisix-authz-openfga
https://github.com/zuplo/zuplo/tree/main/examples/openfga

Is there anything specific you are looking to accomplish or learn?

[dineshkumarsarangapani]

Yes, the examples provided works well for accessing single resource in gateway. Is there a pattern for list, sort and filter with gateway?

[aaguiarz]

I don't think the implementations above covered those use cases.

In general, the underlying API will provide a list endpoint, and will return the data sorted. If you want to filter the results based on what the user is authorized to see, you'll need to take one of the approaches described here https://openfga.dev/docs/interacting/search-with-permissions, e.g., for each result returned by the underlying API call the FGA Check API.

[seandlg]

FYI, we have internally developed an OpenFGA-native identity-aware proxy, similar to Ory Oathkeeper. We're planning on open sourcing it soon.