Identiverse AuthZEN Interop Demo

See https://hackmd.io/@oidf-wg-authzen/identiverse-2025-interop for updated details and instructions.

Scenario

The next interoperability demonstration will focus on the Search API (Draft 03).
https://openid.github.io/authzen/

Description

We have a basic web app that allows users to get access to records.

Records have metadata associated with them:

• owner
• department
• status (draft, published, archived)

Users have metadata associated with them:

• username
• role
• department

We have the following basic rules:

• a user can view a record they own
• a user can view any record in their department
• a manager can view a record
• any user can edit a record they own
• a manager can edit a record in their department
• a user can delete a record they own

Users

Define sample users here

Sample User Data

[
	{
		"name": "alice",
		"role": "manager",
		"department": "Sales"
	},
	{
		"name": "bob",
		"role": "employee",
		"department": "Legal"
	},
	{
		"name": "carol",
		"role": "contractor",
		"department": "Legal"
	},
	{
		"name": "dan",
		"role": "manager",
		"department": "Finance"
	},
	{
		"name": "erin",
		"role": "employee",
		"department": "Finance"
	},
	{
		"name": "felix",
		"role": "contractor",
		"department": "Accounting"
	}
]

See also github (interop\authzen-search-demo\data\users.json)

Data (Items)

Sample records are defined in interop\authzen-search-demo\data\records.json

Sample Records

Demo App

The Demo App is a simple UX that has 3 options:

1. User search (who can view record X?)
2. Resource search (which records can Alice view?)
3. Action search (what action can Alice do on record X?)

The Demo App lets the end-user choose the record identifier and action. The Demo App lets the end-user choose the PDP endpoint. The Demo has a button called "Search" which, when clicked, sends the AuthZEN search request to the backend and gets a response back and visualizes it on-screen.

Conformance Tests

Once the sample data is defined, we can write the conformance tests.

Conformance Payloads

App Hosting

• Investigate either Axiomatics, Hexa, or David B's personal GCP
• Each PDP needs to handle their own data store given the search response contains the data
• The 'Demo App' is just a glorified, stateless, PEP

Participants & Schedule

• Confirmed: Axiomatics (David), Cerbos (Alex O), Ping (via David H), SGNL (Atul), PlainID (Vladi), Permit.io (Gabriel), Thales (Cyril), AWS (Jeff), IndyKite (Alex B), EmpowerID (Patrick), Apache KIE (Elie), WSO2 (Hasintha), Topaz (Omri)

Schedule

• April 16th
  • Use case defined
  • Sample data defined
  • Conformance tests defined
• May 2nd
  • Demo app is up and running
• May 19th
  • Participants have run through the conformance tests

On-site logistics

• TBD

Assignments

• Demo app & sample data: @davidbrossard

  • Host the demo app
    • Jeff will see if AWS can host the demo app
  • Vladi will help with the backend development
  • Create conformance test
  • Manage the config file with compliant implementations
  • Alex O also offered to work on this

• Participant outreach: @gerryatstrata

• On-site logistics: TBD

• Liaison with OpenID (Marketing, etc):

• Clone datasheet and produce new one

  • Remove todo app and add search use case: TBD

• Vladi, David H, and Atul also asked what they could do to help