WEBVTT

1
00:00:18.945 --> 00:00:23.405
<00:00:18.945>Now <00:00:19.100>your <00:00:19.256>life <00:00:19.411>and <00:00:19.567>on <00:00:19.722>stage <00:00:19.878>Anderson <00:00:20.033>and <00:00:20.189>de <00:00:20.345>welcome.

2
00:00:24.025 --> 00:00:27.925
<00:00:24.025>And <00:00:24.375>I <00:00:24.724>will <00:00:25.075>mute <00:00:25.424>myself

3
00:00:28.305 --> 00:00:30.325
<00:00:28.305>so <00:00:28.538>the <00:00:28.771>stage <00:00:29.005>will <00:00:29.238>be <00:00:29.471>all <00:00:29.705>yours.

4
00:00:32.015 --> 00:00:35.775
<00:00:32.015>Right? <00:00:32.248>So <00:00:32.481>thank <00:00:32.715>you. <00:00:32.948>Thank <00:00:33.181>you <00:00:33.415>everyone.

5
00:00:35.995 --> 00:00:40.215
<00:00:35.995>Uh, <00:00:36.150>it's, <00:00:36.306>uh, <00:00:36.461>me <00:00:36.617>and <00:00:36.772>Denny. <00:00:36.928>So <00:00:37.083>understand <00:00:37.239>Des <00:00:37.394>thank.

6
00:00:40.955 --> 00:00:42.175
<00:00:40.955>Hi <00:00:41.504>everyone. <00:00:42.053>Uh,

7
00:00:42.755 --> 00:00:44.815
<00:00:42.755>you <00:00:42.910>can <00:00:43.066>start <00:00:43.221>sharing <00:00:43.377>your <00:00:43.532>screen <00:00:43.688>so <00:00:43.843>that <00:00:43.999>we <00:00:44.155>can,

8
00:00:45.085 --> 00:00:46.085
<00:00:45.085>Yeah. <00:00:45.535>So <00:00:45.985>let's

9
00:00:46.085 --> 00:00:50.375
<00:00:46.085>get <00:00:46.365>to <00:00:46.645>the <00:00:46.925>business. <00:00:47.205>So, <00:00:47.485>okay.

10
00:00:50.545 --> 00:00:51.375
<00:00:50.545>Share <00:00:51.292>screen.

11
00:00:59.745 --> 00:01:03.025
<00:00:59.745>Okay. <00:01:01.144>Okay.

12
00:01:03.325 --> 00:01:05.945
<00:01:03.325>So <00:01:03.500>at <00:01:03.675>this <00:01:03.850>point, <00:01:04.025>I <00:01:04.200>assume <00:01:04.375>you <00:01:04.550>are <00:01:04.725>almost

13
00:01:05.945 --> 00:01:07.065
<00:01:05.945>seeing <00:01:06.280>my <00:01:06.616>screen <00:01:06.953>now.

14
00:01:09.275 --> 00:01:12.645
<00:01:09.275>Okay, <00:01:09.508>now <00:01:09.741>I <00:01:09.975>see <00:01:10.208>it. <00:01:10.441>Yes. <00:01:10.675>Alright.

15
00:01:13.785 --> 00:01:16.445
<00:01:13.785>So, <00:01:14.018>hello <00:01:14.251>everyone. <00:01:14.485>Uh, <00:01:14.718>I'm <00:01:14.951>De <00:01:15.185>Vitale.

16
00:01:16.505 --> 00:01:18.005
<00:01:16.505>He <00:01:16.955>is <00:01:17.405>Anderson, <00:01:17.854>daddario,

17
00:01:18.265 --> 00:01:21.045
<00:01:18.265>and <00:01:18.465>today <00:01:18.665>we'll <00:01:18.865>talk <00:01:19.065>about <00:01:19.265>de <00:01:19.465>capital <00:01:19.665>authorization

18
00:01:21.045 --> 00:01:22.165
<00:01:21.045>using <00:01:21.381>policy <00:01:21.717>as <00:01:22.053>code.

19
00:01:22.385 --> 00:01:24.285
<00:01:22.385>Um, <00:01:22.735>we're <00:01:23.085>from <00:01:23.435>Swisscom, <00:01:23.785>uh,

20
00:01:24.585 --> 00:01:26.925
<00:01:24.585>so <00:01:24.818>we'll <00:01:25.051>introduce <00:01:25.285>the <00:01:25.518>company <00:01:25.751>real <00:01:25.985>quick.

21
00:01:27.065 --> 00:01:28.925
<00:01:27.065>Uh, <00:01:27.345>you <00:01:27.625>probably <00:01:27.905>know <00:01:28.185>about <00:01:28.465>Swisscom.

22
00:01:28.955 --> 00:01:31.285
<00:01:28.955>It's <00:01:29.188>a <00:01:29.421>major <00:01:29.655>telecommunication <00:01:29.888>provider <00:01:30.121>in <00:01:30.355>Switzerland.

23
00:01:31.345 --> 00:01:34.365
<00:01:31.345>Uh, <00:01:31.545>we <00:01:31.745>count <00:01:31.945>up <00:01:32.145>to, <00:01:32.345>uh, <00:01:32.545>19,000 <00:01:32.745>employees,

24
00:01:35.385 --> 00:01:37.885
<00:01:35.384>and <00:01:35.559>we <00:01:35.734>are <00:01:35.910>also <00:01:36.085>open <00:01:36.259>Swiss <00:01:36.434>friendly <00:01:36.609>as, <00:01:36.785>uh,

25
00:01:38.145 --> 00:01:39.405
<00:01:38.145>uh, <00:01:38.523>as <00:01:38.901>already <00:01:39.279>mentioned.

26
00:01:39.745 --> 00:01:43.285
<00:01:39.745>Uh, <00:01:39.872>we <00:01:39.999>have <00:01:40.126>a <00:01:40.254>GitHub <00:01:40.381>profile, <00:01:40.508>so <00:01:40.635>you <00:01:40.763>can <00:01:40.890>check <00:01:41.017>on <00:01:41.145>some

27
00:01:43.285 --> 00:01:45.445
<00:01:43.285>of <00:01:43.634>our <00:01:43.985>public <00:01:44.335>repositories <00:01:44.685>there.

28
00:01:46.225 --> 00:01:51.005
<00:01:46.225>And <00:01:46.458>today <00:01:46.691>we'll <00:01:46.925>speak <00:01:47.158>about, <00:01:47.391>um, <00:01:47.625>uh,

29
00:01:51.025 --> 00:01:52.605
<00:01:51.025>the <00:01:51.725>authentication <00:01:52.425>authorization.

30
00:01:52.705 --> 00:01:54.525
<00:01:52.705>So <00:01:53.054>we'll <00:01:53.405>start <00:01:53.755>by, <00:01:54.105>um,

31
00:01:55.035 --> 00:01:57.445
<00:01:55.035>explain <00:01:55.235>why <00:01:55.435>we <00:01:55.634>wanted <00:01:55.835>to <00:01:56.035>make <00:01:56.235>this <00:01:56.435>talk.

32
00:01:57.445 --> 00:02:01.965
<00:01:57.445>Basically, <00:01:57.585>um, <00:01:57.725>we, <00:01:57.865>we've, <00:01:58.005>we've <00:01:58.145>seen <00:01:58.285>that <00:01:58.425>there's <00:01:58.565>a <00:01:58.705>lot <00:01:58.845>of,

33
00:02:02.065 --> 00:02:04.845
<00:02:02.065>uh, <00:02:02.345>authentication <00:02:02.625>methods, <00:02:02.905>uh, <00:02:03.185>out <00:02:03.465>there.

34
00:02:05.145 --> 00:02:08.965
<00:02:05.145>Uh, <00:02:05.272>a <00:02:05.399>lot <00:02:05.526>of <00:02:05.654>standards, <00:02:05.781>a <00:02:05.908>lot <00:02:06.035>of, <00:02:06.163>uh, <00:02:06.290>possibilities, <00:02:06.417>uh, <00:02:06.545>so

35
00:02:08.965 --> 00:02:11.685
<00:02:08.965>that <00:02:09.072>you <00:02:09.180>do <00:02:09.288>not <00:02:09.395>have <00:02:09.503>to <00:02:09.611>roll <00:02:09.718>on, <00:02:09.826>uh, <00:02:09.934>roll <00:02:10.041>out <00:02:10.149>your <00:02:10.257>own, <00:02:10.365>uh,

36
00:02:11.685 --> 00:02:16.085
<00:02:11.685>authentication <00:02:11.860>mechanism, <00:02:12.035>uh, <00:02:12.210>such <00:02:12.385>as <00:02:12.560>SAML <00:02:12.735>of <00:02:12.910>Open <00:02:13.085>Connect

37
00:02:16.105 --> 00:02:18.765
<00:02:16.105>and <00:02:16.385>SSO, <00:02:16.665>various <00:02:16.945>types <00:02:17.225>of <00:02:17.505>SSO.

38
00:02:19.425 --> 00:02:22.365
<00:02:19.425>But <00:02:19.552>we <00:02:19.679>feel <00:02:19.806>that <00:02:19.934>there <00:02:20.061>is <00:02:20.188>like <00:02:20.315>a, <00:02:20.443>a <00:02:20.570>lack <00:02:20.697>of, <00:02:20.825>uh,

39
00:02:22.625 --> 00:02:24.005
<00:02:22.625>of <00:02:23.246>authorization <00:02:23.867>tools.

40
00:02:24.225 --> 00:02:27.565
<00:02:24.225>Uh, <00:02:24.424>and <00:02:24.625>there's <00:02:24.825>only <00:02:25.025>a <00:02:25.225>few <00:02:25.424>of <00:02:25.625>them.

41
00:02:27.745 --> 00:02:30.645
<00:02:27.745>And <00:02:27.872>most <00:02:27.999>of <00:02:28.126>the <00:02:28.254>time <00:02:28.381>it's <00:02:28.508>just <00:02:28.635>about <00:02:28.763>rolling <00:02:28.890>your, <00:02:29.017>your <00:02:29.145>own,

42
00:02:30.785 --> 00:02:32.645
<00:02:30.785>uh, <00:02:31.484>authorization <00:02:32.185>layer.

43
00:02:33.305 --> 00:02:36.005
<00:02:33.305>And <00:02:33.585>some <00:02:33.865>of <00:02:34.145>those <00:02:34.425>are <00:02:34.705>X-A-C-M-L

44
00:02:36.105 --> 00:02:38.085
<00:02:36.105>or <00:02:36.385>as <00:02:36.665>I <00:02:36.945>said, <00:02:37.225>customer <00:02:37.505>implementations.

45
00:02:38.905 --> 00:02:40.085
<00:02:38.905>So <00:02:39.436>what's <00:02:39.967>next?

46
00:02:41.325 --> 00:02:43.385
<00:02:41.325>So <00:02:41.558>basically <00:02:41.791>we <00:02:42.024>have <00:02:42.258>a <00:02:42.491>very, <00:02:42.725>uh,

47
00:02:43.565 --> 00:02:47.105
<00:02:43.565>common <00:02:43.740>setup <00:02:43.915>here <00:02:44.090>when <00:02:44.265>you <00:02:44.440>develop <00:02:44.615>the <00:02:44.790>custom <00:02:44.965>application.

48
00:02:47.525 --> 00:02:50.465
<00:02:47.525>And <00:02:47.700>here <00:02:47.875>for, <00:02:48.050>for <00:02:48.225>the <00:02:48.400>sake <00:02:48.575>of <00:02:48.750>the <00:02:48.925>example,

49
00:02:50.885 --> 00:02:54.105
<00:02:50.885>we <00:02:51.040>have <00:02:51.196>one <00:02:51.351>application <00:02:51.507>with <00:02:51.662>just <00:02:51.818>one <00:02:51.973>feature, <00:02:52.129>which <00:02:52.285>is

50
00:02:54.125 --> 00:02:56.625
<00:02:54.125>to <00:02:54.325>list <00:02:54.525>all <00:02:54.725>the <00:02:54.925>salaries <00:02:55.125>of <00:02:55.325>the <00:02:55.525>employees.

51
00:02:57.685 --> 00:03:00.205
<00:02:57.685>And <00:02:57.885>we <00:02:58.085>have <00:02:58.285>two, <00:02:58.485>uh, <00:02:58.685>types <00:02:58.885>of <00:02:59.085>user.

52
00:03:00.265 --> 00:03:01.285
<00:03:00.265>We <00:03:00.494>have <00:03:00.724>the <00:03:00.953>normal <00:03:01.183>user

53
00:03:01.545 --> 00:03:04.165
<00:03:01.545>who <00:03:01.744>cannot <00:03:01.945>see <00:03:02.144>the <00:03:02.345>list <00:03:02.545>of <00:03:02.744>all <00:03:02.945>salaries.

54
00:03:04.185 --> 00:03:08.045
<00:03:04.185>And <00:03:04.301>we <00:03:04.418>have <00:03:04.535>the <00:03:04.651>admin <00:03:04.768>user <00:03:04.885>who <00:03:05.001>can <00:03:05.118>see <00:03:05.235>the <00:03:05.351>list <00:03:05.468>of <00:03:05.585>the,

55
00:03:08.105 --> 00:03:10.445
<00:03:08.105>the <00:03:08.304>list <00:03:08.505>with <00:03:08.704>all <00:03:08.905>salaries <00:03:09.105>of <00:03:09.304>all <00:03:09.505>employees.

56
00:03:11.115 --> 00:03:12.645
<00:03:11.115>Usually <00:03:11.803>it's <00:03:12.492>done

57
00:03:12.745 --> 00:03:16.485
<00:03:12.745>by <00:03:12.885>checking <00:03:13.025>if <00:03:13.165>the <00:03:13.305>user <00:03:13.445>is <00:03:13.585>one <00:03:13.725>administrator <00:03:13.865>in <00:03:14.005>the <00:03:14.145>code.

58
00:03:16.785 --> 00:03:20.085
<00:03:16.785>So <00:03:17.018>it's <00:03:17.251>embedded <00:03:17.484>in <00:03:17.718>the <00:03:17.951>application <00:03:18.185>logic.

59
00:03:20.785 --> 00:03:24.005
<00:03:20.785>So, <00:03:20.924>uh, <00:03:21.065>as <00:03:21.204>for <00:03:21.345>this <00:03:21.484>example <00:03:21.625>here, <00:03:21.765>uh, <00:03:21.905>those <00:03:22.045>more <00:03:22.185>familiar

60
00:03:24.005 --> 00:03:26.205
<00:03:24.005>with <00:03:24.355>Java, <00:03:24.704>we'll, <00:03:25.055>we'll <00:03:25.405>see.

61
00:03:26.745 --> 00:03:28.885
<00:03:26.745>So <00:03:26.945>you <00:03:27.145>try <00:03:27.345>to <00:03:27.545>list <00:03:27.745>those <00:03:27.945>salaries, <00:03:28.145>but

62
00:03:28.885 --> 00:03:31.485
<00:03:28.885>before <00:03:29.060>you <00:03:29.234>would <00:03:29.410>check <00:03:29.584>if <00:03:29.760>the <00:03:29.935>user <00:03:30.109>is <00:03:30.285>one

63
00:03:31.485 --> 00:03:33.365
<00:03:31.485>administrator <00:03:32.185>or <00:03:32.885>not.

64
00:03:34.545 --> 00:03:37.565
<00:03:34.545>And, <00:03:34.745>uh, <00:03:34.945>what <00:03:35.145>are <00:03:35.345>the, <00:03:35.545>the <00:03:35.745>issues, <00:03:35.945>uh,

65
00:03:37.675 --> 00:03:41.805
<00:03:37.675>when <00:03:37.850>you <00:03:38.025>embed <00:03:38.200>the <00:03:38.375>authorization <00:03:38.550>logic <00:03:38.725>in <00:03:38.900>your <00:03:39.075>application?

66
00:03:43.105 --> 00:03:45.005
<00:03:43.105>We <00:03:43.385>have, <00:03:43.665>uh, <00:03:43.945>three <00:03:44.225>items <00:03:44.505>here.

67
00:03:45.065 --> 00:03:48.965
<00:03:45.065>So, <00:03:45.220>uh, <00:03:45.376>you <00:03:45.531>have <00:03:45.687>a <00:03:45.842>very <00:03:45.998>tight <00:03:46.153>couple <00:03:46.309>application <00:03:46.465>logic.

68
00:03:49.185 --> 00:03:52.045
<00:03:49.185>So <00:03:49.360>to <00:03:49.535>list <00:03:49.710>the <00:03:49.885>salaries <00:03:50.060>with <00:03:50.235>the <00:03:50.410>authorization <00:03:50.585>logic,

69
00:03:52.225 --> 00:03:57.005
<00:03:52.225>so <00:03:52.400>only <00:03:52.575>for <00:03:52.750>admin <00:03:52.924>users, <00:03:53.100>you <00:03:53.275>have <00:03:53.450>auditing, <00:03:53.625>uh,

70
00:03:57.385 --> 00:03:59.725
<00:03:57.385>uh, <00:03:57.584>issues <00:03:57.785>too, <00:03:57.984>because <00:03:58.185>if <00:03:58.385>you <00:03:58.584>have, <00:03:58.785>uh,

71
00:03:59.725 --> 00:04:02.765
<00:03:59.725>in <00:03:59.958>a <00:04:00.191>history <00:04:00.424>genius <00:04:00.658>environment <00:04:00.891>with <00:04:01.125>many,

72
00:04:02.765 --> 00:04:04.885
<00:04:02.765>many <00:04:03.231>different <00:04:03.698>applications, <00:04:04.165>languages,

73
00:04:04.885 --> 00:04:08.005
<00:04:04.885>and <00:04:05.165>frameworks, <00:04:05.445>uh, <00:04:05.725>what <00:04:06.005>happened <00:04:06.285>is

74
00:04:08.005 --> 00:04:11.485
<00:04:08.005>that <00:04:08.180>you <00:04:08.355>have <00:04:08.530>authorization <00:04:08.704>type <00:04:08.880>coupled <00:04:09.055>in <00:04:09.230>very <00:04:09.405>different

75
00:04:12.205 --> 00:04:13.685
<00:04:12.205>languages <00:04:12.649>and <00:04:13.093>frameworks <00:04:13.537>too.

76
00:04:14.105 --> 00:04:16.725
<00:04:14.105>So <00:04:14.244>you <00:04:14.385>don't <00:04:14.524>have <00:04:14.665>a <00:04:14.804>standard <00:04:14.945>way <00:04:15.084>to, <00:04:15.225>to <00:04:15.364>do <00:04:15.505>it.

77
00:04:16.825 --> 00:04:18.885
<00:04:16.825>And, <00:04:17.024>and <00:04:17.224>to <00:04:17.425>bring <00:04:17.625>the <00:04:17.825>visibility <00:04:18.024>from <00:04:18.224>it.

78
00:04:19.585 --> 00:04:23.965
<00:04:19.584>On <00:04:19.712>top <00:04:19.839>of <00:04:19.966>that, <00:04:20.094>we <00:04:20.221>also <00:04:20.348>have <00:04:20.475>operation, <00:04:20.603>uh, <00:04:20.730>uh, <00:04:20.857>issues <00:04:20.984>that

79
00:04:24.025 --> 00:04:25.445
<00:04:24.025>for, <00:04:24.280>for <00:04:24.536>example, <00:04:24.791>when <00:04:25.047>you <00:04:25.303>need

80
00:04:25.445 --> 00:04:27.525
<00:04:25.445>to <00:04:25.795>change <00:04:26.145>the <00:04:26.495>authorization <00:04:26.844>logic.

81
00:04:27.705 --> 00:04:30.605
<00:04:27.705>So <00:04:27.905>now <00:04:28.104>it's, <00:04:28.305>uh, <00:04:28.505>not <00:04:28.705>only <00:04:28.905>the <00:04:29.104>admin

82
00:04:30.705 --> 00:04:33.485
<00:04:30.705>who <00:04:30.905>can <00:04:31.104>see <00:04:31.305>our <00:04:31.505>salaries, <00:04:31.705>you <00:04:31.905>need <00:04:32.104>to

83
00:04:34.005 --> 00:04:37.365
<00:04:34.005>recompile <00:04:34.284>your <00:04:34.565>application <00:04:34.844>and <00:04:35.125>restart <00:04:35.405>it.

84
00:04:39.645 --> 00:04:43.345
<00:04:39.645>So <00:04:39.761>the <00:04:39.878>question <00:04:39.995>is, <00:04:40.111>do <00:04:40.228>we <00:04:40.344>have <00:04:40.461>a <00:04:40.578>better <00:04:40.695>way <00:04:40.811>to <00:04:40.928>do <00:04:41.044>this?

85
00:04:44.125 --> 00:04:47.145
<00:04:44.125>So <00:04:44.280>wouldn't <00:04:44.436>it <00:04:44.591>be <00:04:44.747>nice <00:04:44.902>if <00:04:45.058>we <00:04:45.213>could <00:04:45.369>come <00:04:45.525>with,

86
00:04:47.145 --> 00:04:49.905
<00:04:47.145>with <00:04:47.344>a <00:04:47.544>standard <00:04:47.745>way <00:04:47.945>to <00:04:48.145>apply <00:04:48.344>authorization, <00:04:48.544>uh,

87
00:04:49.905 --> 00:04:52.265
<00:04:49.905>logic <00:04:50.184>regardless <00:04:50.465>of <00:04:50.744>the <00:04:51.025>programming <00:04:51.304>language?

88
00:04:52.935 --> 00:04:56.025
<00:04:52.935>What <00:04:53.110>if <00:04:53.285>we <00:04:53.460>could <00:04:53.635>centralize <00:04:53.810>all <00:04:53.985>these, <00:04:54.160>uh, <00:04:54.335>decisions?

89
00:04:57.205 --> 00:04:59.135
<00:04:57.205>Well, <00:04:57.438>the <00:04:57.671>answer <00:04:57.905>is <00:04:58.138>policy <00:04:58.371>as <00:04:58.604>code.

90
00:04:59.395 --> 00:05:01.935
<00:04:59.395>And <00:04:59.550>today <00:04:59.706>we <00:04:59.861>are <00:05:00.017>gonna <00:05:00.172>introduce, <00:05:00.328>uh, <00:05:00.483>a <00:05:00.639>little <00:05:00.794>bit

91
00:05:01.935 --> 00:05:04.655
<00:05:01.935>what <00:05:02.075>it <00:05:02.215>is <00:05:02.355>and, <00:05:02.495>uh, <00:05:02.635>some <00:05:02.775>of <00:05:02.915>the <00:05:03.055>tools <00:05:03.195>that, <00:05:03.335>uh,

92
00:05:04.655 --> 00:05:07.575
<00:05:04.655>will <00:05:04.810>help <00:05:04.966>you <00:05:05.121>through <00:05:05.277>your <00:05:05.432>journey <00:05:05.588>to <00:05:05.743>have <00:05:05.899>the <00:05:06.054>policy

93
00:05:07.675 --> 00:05:09.415
<00:05:07.675>as <00:05:08.025>code <00:05:08.375>within <00:05:08.725>your <00:05:09.075>software.

94
00:05:09.995 --> 00:05:11.495
<00:05:09.995>So <00:05:10.265>what <00:05:10.535>is <00:05:10.805>policy <00:05:11.075>as <00:05:11.345>code?

95
00:05:11.495 --> 00:05:12.935
<00:05:11.495>Policy <00:05:11.754>as <00:05:12.013>code <00:05:12.272>is <00:05:12.531>a <00:05:12.791>way

96
00:05:12.935 --> 00:05:15.895
<00:05:12.935>to <00:05:13.168>decouple <00:05:13.401>business <00:05:13.635>logic <00:05:13.868>from <00:05:14.101>authorization, <00:05:14.335>uh,

97
00:05:16.405 --> 00:05:19.055
<00:05:16.405>what <00:05:16.638>Anderson <00:05:16.871>just <00:05:17.104>explained, <00:05:17.338>it's <00:05:17.571>basically, <00:05:17.804>uh,

98
00:05:19.405 --> 00:05:21.655
<00:05:19.405>keeping <00:05:19.604>the <00:05:19.804>business <00:05:20.005>logic <00:05:20.205>in <00:05:20.405>the <00:05:20.604>application <00:05:20.804>itself

99
00:05:21.755 --> 00:05:24.695
<00:05:21.755>and <00:05:22.034>concentrating, <00:05:22.315>uh, <00:05:22.594>the, <00:05:22.875>the <00:05:23.155>policies

100
00:05:24.695 --> 00:05:27.455
<00:05:24.695>and <00:05:24.850>all <00:05:25.006>of <00:05:25.161>the <00:05:25.317>rules <00:05:25.472>that, <00:05:25.628>uh, <00:05:25.783>are <00:05:25.939>needed <00:05:26.094>to

101
00:05:28.095 --> 00:05:29.455
<00:05:28.095>actually <00:05:28.707>authorize <00:05:29.318>or,

102
00:05:29.675 --> 00:05:32.375
<00:05:29.675>or <00:05:29.830>to <00:05:29.986>allow <00:05:30.141>a <00:05:30.297>certain <00:05:30.452>access <00:05:30.608>to <00:05:30.763>a <00:05:30.919>certain <00:05:31.075>resource

103
00:05:32.435 --> 00:05:36.335
<00:05:32.435>to <00:05:32.562>users <00:05:32.689>in <00:05:32.816>a <00:05:32.944>central <00:05:33.071>place <00:05:33.198>where <00:05:33.325>you <00:05:33.453>can <00:05:33.580>also <00:05:33.707>share <00:05:33.835>it

104
00:05:36.335 --> 00:05:38.215
<00:05:36.335>with, <00:05:36.614>with <00:05:36.895>others <00:05:37.174>applications <00:05:37.455>as <00:05:37.734>well.

105
00:05:38.875 --> 00:05:41.255
<00:05:38.875>And <00:05:39.002>the <00:05:39.129>nice <00:05:39.256>thing <00:05:39.384>about <00:05:39.511>policy <00:05:39.638>as <00:05:39.765>code <00:05:39.893>is, <00:05:40.020>since <00:05:40.147>it's <00:05:40.275>code,

106
00:05:41.355 --> 00:05:43.255
<00:05:41.355>uh, <00:05:41.530>it <00:05:41.705>can <00:05:41.880>be <00:05:42.055>versioned, <00:05:42.230>it <00:05:42.405>can <00:05:42.580>be <00:05:42.755>tested,

107
00:05:43.715 --> 00:05:45.415
<00:05:43.715>and <00:05:43.995>it <00:05:44.275>can <00:05:44.555>also <00:05:44.835>be <00:05:45.115>generalized.

108
00:05:45.435 --> 00:05:48.335
<00:05:45.435>So <00:05:45.590>your <00:05:45.746>policy <00:05:45.901>can <00:05:46.057>also <00:05:46.212>be <00:05:46.368>applied <00:05:46.523>to <00:05:46.679>multiple <00:05:46.835>applications,

109
00:05:49.275 --> 00:05:51.575
<00:05:49.275>uh, <00:05:49.450>regardless <00:05:49.625>of, <00:05:49.799>of <00:05:49.974>the <00:05:50.150>type <00:05:50.325>of <00:05:50.500>the <00:05:50.674>application

110
00:05:51.575 --> 00:05:53.055
<00:05:51.575>that <00:05:51.841>it <00:05:52.107>is, <00:05:52.374>uh, <00:05:52.640>written <00:05:52.907>in.

111
00:05:53.315 --> 00:05:56.375
<00:05:53.315>You <00:05:53.455>can <00:05:53.594>even <00:05:53.735>have <00:05:53.875>a <00:05:54.015>binary, <00:05:54.155>we'll <00:05:54.295>see <00:05:54.435>it <00:05:54.575>afterwards <00:05:54.715>and,

112
00:05:56.475 --> 00:05:59.285
<00:05:56.475>and <00:05:56.630>simply <00:05:56.786>apply <00:05:56.941>some <00:05:57.097>policies <00:05:57.252>on <00:05:57.408>top <00:05:57.563>of <00:05:57.719>it, <00:05:57.875>uh,

113
00:05:59.395 --> 00:06:02.365
<00:05:59.395>with <00:05:59.674>some <00:05:59.955>customized, <00:06:00.234>um, <00:06:00.515>middle <00:06:00.794>words

114
00:06:02.365 --> 00:06:05.395
<00:06:02.365>or <00:06:03.765>so.

115
00:06:05.395 --> 00:06:08.315
<00:06:05.395>There <00:06:05.511>is, <00:06:05.628>there <00:06:05.745>are <00:06:05.861>a <00:06:05.978>couple <00:06:06.094>of <00:06:06.211>tools <00:06:06.328>that, <00:06:06.445>uh, <00:06:06.561>can <00:06:06.678>be <00:06:06.794>used

116
00:06:08.335 --> 00:06:11.235
<00:06:08.335>to, <00:06:08.490>uh, <00:06:08.646>achieve <00:06:08.801>this <00:06:08.957>goal <00:06:09.112>of <00:06:09.268>having <00:06:09.423>policy <00:06:09.579>as <00:06:09.734>code.

117
00:06:11.415 --> 00:06:14.315
<00:06:11.415>And, <00:06:11.765>um, <00:06:12.115>I <00:06:12.465>actually, <00:06:12.815>two

118
00:06:14.315 --> 00:06:16.555
<00:06:14.315>of <00:06:14.594>them <00:06:14.875>are <00:06:15.155>based <00:06:15.435>on <00:06:15.715>X-A-C-M-L.

119
00:06:16.575 --> 00:06:19.795
<00:06:16.575>So <00:06:16.808>X-A-C-M-L. <00:06:17.041>It's, <00:06:17.275>um, <00:06:17.508>we'll <00:06:17.741>see <00:06:17.974>afterwards.

120
00:06:19.825 --> 00:06:24.045
<00:06:19.825>It's, <00:06:19.952>um, <00:06:20.079>it's, <00:06:20.206>um, <00:06:20.334>policy <00:06:20.461>as <00:06:20.588>code <00:06:20.715>tool <00:06:20.843>that <00:06:20.970>it's <00:06:21.097>used <00:06:21.224>to,

121
00:06:24.385 --> 00:06:26.685
<00:06:24.385>uh, <00:06:24.664>write, <00:06:24.945>uh, <00:06:25.224>policies <00:06:25.505>in <00:06:25.784>XML

122
00:06:27.065 --> 00:06:30.525
<00:06:27.065>and <00:06:27.205>Alpha <00:06:27.344>is <00:06:27.485>a <00:06:27.625>super <00:06:27.765>set, <00:06:27.905>I <00:06:28.045>would <00:06:28.185>say, <00:06:28.325>of <00:06:28.465>X-A-C-M-L,

123
00:06:30.575 --> 00:06:34.365
<00:06:30.575>where <00:06:30.775>you <00:06:30.974>write <00:06:31.175>some, <00:06:31.375>uh, <00:06:31.575>less <00:06:31.775>verbose <00:06:31.974>rules

124
00:06:34.505 --> 00:06:37.885
<00:06:34.505>or <00:06:34.705>less <00:06:34.905>verbose <00:06:35.105>policies, <00:06:35.305>um, <00:06:35.505>in <00:06:35.705>that <00:06:35.905>way.

125
00:06:38.025 --> 00:06:39.725
<00:06:38.025>And <00:06:38.304>then <00:06:38.585>there's <00:06:38.864>open <00:06:39.145>policy <00:06:39.424>agent

126
00:06:39.725 --> 00:06:40.885
<00:06:39.725>that <00:06:40.073>we'll <00:06:40.421>see <00:06:40.769>afterwards.

127
00:06:42.425 --> 00:06:45.325
<00:06:42.425>So <00:06:42.658>A <00:06:42.891>CML <00:06:43.125>is <00:06:43.358>ex <00:06:43.591>extensive, <00:06:43.825>stands

128
00:06:45.325 --> 00:06:47.565
<00:06:45.325>for <00:06:45.604>extensive <00:06:45.885>access <00:06:46.164>control <00:06:46.445>makeup <00:06:46.724>language,

129
00:06:47.665 --> 00:06:49.845
<00:06:47.665>and <00:06:47.898>it's <00:06:48.131>basically <00:06:48.365>an <00:06:48.598>attribute <00:06:48.831>base <00:06:49.065>access

130
00:06:49.845 --> 00:06:51.365
<00:06:49.845>control, <00:06:50.529>uh, <00:06:51.213>aac.

131
00:06:51.985 --> 00:06:53.405
<00:06:51.985>Uh, <00:06:52.411>this <00:06:52.837>doesn't <00:06:53.263>mean

132
00:06:53.405 --> 00:06:56.245
<00:06:53.405>that <00:06:53.638>you <00:06:53.871>cannot <00:06:54.104>implement <00:06:54.338>aback <00:06:54.571>actually, <00:06:54.804>uh,

133
00:06:56.245 --> 00:06:57.365
<00:06:56.245>role-based <00:06:56.749>access <00:06:57.253>control,

134
00:06:57.425 --> 00:07:00.325
<00:06:57.425>but, <00:06:57.600>um, <00:06:57.775>actually <00:06:57.950>you <00:06:58.125>can <00:06:58.300>do <00:06:58.475>it <00:06:58.650>as <00:06:58.825>well.

135
00:07:00.665 --> 00:07:02.245
<00:07:00.665>Uh, <00:07:00.945>it <00:07:01.225>is <00:07:01.505>just <00:07:01.785>more <00:07:02.065>general.

136
00:07:03.345 --> 00:07:05.525
<00:07:03.345>You <00:07:03.500>can <00:07:03.656>write <00:07:03.811>your <00:07:03.967>own <00:07:04.122>X <00:07:04.278>ML <00:07:04.433>policies <00:07:04.589>with <00:07:04.745>that.

137
00:07:05.985 --> 00:07:08.885
<00:07:05.985>And <00:07:06.101>on <00:07:06.218>the <00:07:06.335>right <00:07:06.451>side, <00:07:06.568>we, <00:07:06.685>we <00:07:06.801>can <00:07:06.918>just <00:07:07.035>see <00:07:07.151>a <00:07:07.268>small <00:07:07.385>diagram

138
00:07:08.985 --> 00:07:10.085
<00:07:08.985>of <00:07:09.315>how <00:07:09.645>that <00:07:09.974>works.

139
00:07:10.265 --> 00:07:14.005
<00:07:10.265>So, <00:07:10.440>uh, <00:07:10.615>I <00:07:10.789>don't <00:07:10.965>like <00:07:11.140>this <00:07:11.315>terminology <00:07:11.490>that <00:07:11.664>much,

140
00:07:14.105 --> 00:07:16.605
<00:07:14.105>but, <00:07:14.280>um, <00:07:14.455>it's, <00:07:14.630>it's <00:07:14.805>kind <00:07:14.980>of <00:07:15.155>in <00:07:15.330>the <00:07:15.505>standard,

141
00:07:16.745 --> 00:07:17.805
<00:07:16.745>so <00:07:16.983>we'll <00:07:17.222>stick <00:07:17.460>with <00:07:17.699>it.

142
00:07:18.225 --> 00:07:21.925
<00:07:18.225>Uh, <00:07:18.365>we <00:07:18.505>have <00:07:18.645>a <00:07:18.785>PEP, <00:07:18.925>which <00:07:19.065>is <00:07:19.205>the <00:07:19.345>policy <00:07:19.485>enforcement <00:07:19.625>point,

143
00:07:22.025 --> 00:07:24.445
<00:07:22.025>uh, <00:07:22.180>that <00:07:22.336>is <00:07:22.491>as <00:07:22.647>to <00:07:22.802>be <00:07:22.958>seen <00:07:23.113>as <00:07:23.269>your <00:07:23.424>application.

144
00:07:24.905 --> 00:07:27.525
<00:07:24.905>Uh, <00:07:25.104>in <00:07:25.304>Anderson <00:07:25.505>example <00:07:25.705>was <00:07:25.905>called <00:07:26.104>my <00:07:26.304>application.

145
00:07:27.945 --> 00:07:29.245
<00:07:27.945>So <00:07:28.335>the <00:07:28.725>user <00:07:29.115>tries

146
00:07:29.245 --> 00:07:32.565
<00:07:29.245>to <00:07:29.385>get <00:07:29.525>the <00:07:29.665>record <00:07:29.805>1, <00:07:29.945>2, <00:07:30.085>3 <00:07:30.225>from, <00:07:30.365>from <00:07:30.505>your <00:07:30.645>application.

147
00:07:33.065 --> 00:07:36.005
<00:07:33.065>Uh, <00:07:33.240>your <00:07:33.415>application <00:07:33.590>will <00:07:33.765>in <00:07:33.940>turn <00:07:34.115>ask <00:07:34.290>the <00:07:34.465>PDP,

148
00:07:36.005 --> 00:07:39.405
<00:07:36.005>which <00:07:36.205>is <00:07:36.405>the <00:07:36.605>policy <00:07:36.805>decision <00:07:37.005>point, <00:07:37.205>um, <00:07:37.405>to,

149
00:07:40.225 --> 00:07:42.125
<00:07:40.225>to <00:07:40.400>see <00:07:40.575>whether <00:07:40.750>the <00:07:40.925>users, <00:07:41.100>so <00:07:41.275>in <00:07:41.450>this <00:07:41.625>case,

150
00:07:42.125 --> 00:07:44.085
<00:07:42.125>analyst <00:07:42.325>can <00:07:42.525>view <00:07:42.725>the <00:07:42.925>record <00:07:43.125>1, <00:07:43.325>2, <00:07:43.525>3.

151
00:07:44.945 --> 00:07:46.365
<00:07:44.945>And <00:07:45.200>the <00:07:45.456>PDP <00:07:45.711>will <00:07:45.967>in <00:07:46.223>turn

152
00:07:47.245 --> 00:07:49.245
<00:07:47.245>evaluate <00:07:47.525>some <00:07:47.805>policies <00:07:48.085>using <00:07:48.365>some <00:07:48.645>data.

153
00:07:49.505 --> 00:07:52.245
<00:07:49.505>So <00:07:49.738>evaluate <00:07:49.971>the <00:07:50.205>policies <00:07:50.438>from <00:07:50.671>a <00:07:50.905>PAP,

154
00:07:52.425 --> 00:07:55.445
<00:07:52.425>so <00:07:52.600>policy <00:07:52.775>administration <00:07:52.950>point <00:07:53.125>on <00:07:53.300>the <00:07:53.475>left <00:07:53.650>side, <00:07:53.825>uh,

155
00:07:55.535 --> 00:07:59.405
<00:07:55.534>using <00:07:55.690>some <00:07:55.846>data <00:07:56.001>that <00:07:56.157>is, <00:07:56.312>uh, <00:07:56.468>retrieved <00:07:56.623>by, <00:07:56.779>uh, <00:07:56.934>from,

156
00:07:59.405 --> 00:08:01.245
<00:07:59.405>from <00:07:59.638>external <00:07:59.871>source, <00:08:00.104>such <00:08:00.338>as <00:08:00.571>a <00:08:00.804>database

157
00:08:01.385 --> 00:08:02.965
<00:08:01.385>or <00:08:01.618>a <00:08:01.851>file <00:08:02.085>or <00:08:02.318>something <00:08:02.551>like <00:08:02.784>that.

158
00:08:03.105 --> 00:08:04.725
<00:08:03.105>So <00:08:03.571>that's <00:08:04.038>the <00:08:04.505>PIP,

159
00:08:05.305 --> 00:08:08.125
<00:08:05.305>and <00:08:05.480>then <00:08:05.655>it'll <00:08:05.830>return <00:08:06.005>simply <00:08:06.180>the <00:08:06.355>PDPs <00:08:06.530>role <00:08:06.705>is

160
00:08:08.125 --> 00:08:10.925
<00:08:08.125>to <00:08:08.280>evaluate <00:08:08.436>the <00:08:08.591>policies, <00:08:08.747>given <00:08:08.902>a <00:08:09.058>certain <00:08:09.213>input <00:08:09.369>and <00:08:09.525>return

161
00:08:11.385 --> 00:08:14.645
<00:08:11.385>and, <00:08:11.525>and <00:08:11.664>an <00:08:11.805>output <00:08:11.945>that <00:08:12.085>can <00:08:12.224>be <00:08:12.365>either, <00:08:12.505>uh, <00:08:12.645>allow <00:08:12.784>access

162
00:08:14.645 --> 00:08:16.125
<00:08:14.645>to <00:08:14.911>the <00:08:15.177>resource <00:08:15.444>or <00:08:15.710>deny <00:08:15.977>it.

163
00:08:16.785 --> 00:08:19.525
<00:08:16.785>And <00:08:16.940>once <00:08:17.096>this <00:08:17.251>decision <00:08:17.407>has <00:08:17.562>been <00:08:17.718>made <00:08:17.873>by <00:08:18.029>the <00:08:18.185>PDP,

164
00:08:19.735 --> 00:08:22.565
<00:08:19.735>it'll <00:08:19.890>return <00:08:20.046>the <00:08:20.201>request <00:08:20.357>a <00:08:20.512>delivery <00:08:20.668>response <00:08:20.823>to <00:08:20.979>the <00:08:21.135>PEP.

165
00:08:22.825 --> 00:08:26.605
<00:08:22.825>And <00:08:23.000>the <00:08:23.175>PEP <00:08:23.349>will <00:08:23.525>simply, <00:08:23.700>um, <00:08:23.875>enforce <00:08:24.050>this <00:08:24.224>policy.

166
00:08:26.705 --> 00:08:29.405
<00:08:26.705>And <00:08:26.880>therefore, <00:08:27.055>it'll <00:08:27.229>either, <00:08:27.405>uh, <00:08:27.580>based <00:08:27.755>on <00:08:27.930>decision <00:08:28.104>of,

167
00:08:29.585 --> 00:08:31.405
<00:08:29.585>of <00:08:29.935>the <00:08:30.284>PDP, <00:08:30.635>allow <00:08:30.984>access

168
00:08:31.465 --> 00:08:34.045
<00:08:31.465>or <00:08:31.620>deny <00:08:31.776>access <00:08:31.931>to <00:08:32.087>the <00:08:32.242>resource <00:08:32.398>in <00:08:32.553>this <00:08:32.709>case, <00:08:32.865>uh,

169
00:08:34.385 --> 00:08:35.685
<00:08:34.385>to <00:08:34.677>view <00:08:34.970>record <00:08:35.262>is <00:08:35.554>allowed.

170
00:08:35.705 --> 00:08:39.085
<00:08:35.705>And <00:08:35.832>then, <00:08:35.959>uh, <00:08:36.086>addis <00:08:36.214>is <00:08:36.341>able <00:08:36.468>to <00:08:36.595>view <00:08:36.723>record <00:08:36.850>1, <00:08:36.977>2, <00:08:37.105>3.

171
00:08:41.865 --> 00:08:43.075
<00:08:41.865>There's <00:08:42.228>problem, <00:08:42.591>there's <00:08:42.954>a,

172
00:08:43.395 --> 00:08:46.675
<00:08:43.395>a <00:08:43.550>little <00:08:43.706>problem <00:08:43.861>about <00:08:44.017>X-A-C-M-L, <00:08:44.172>which <00:08:44.328>is, <00:08:44.483>uh, <00:08:44.639>the <00:08:44.795>fact

173
00:08:46.675 --> 00:08:49.195
<00:08:46.675>that <00:08:46.908>at <00:08:47.141>least <00:08:47.375>personally <00:08:47.608>speaking, <00:08:47.841>uh, <00:08:48.074>it's,

174
00:08:49.225 --> 00:08:52.515
<00:08:49.225>it's <00:08:49.380>based <00:08:49.536>on <00:08:49.691>XML, <00:08:49.847>and <00:08:50.002>it's, <00:08:50.158>uh, <00:08:50.313>really, <00:08:50.469>really <00:08:50.625>verbose.

175
00:08:52.515 --> 00:08:54.595
<00:08:52.515>So <00:08:52.689>on <00:08:52.865>the <00:08:53.040>right <00:08:53.215>side, <00:08:53.390>you <00:08:53.564>can <00:08:53.740>see <00:08:53.915>policy

176
00:08:55.125 --> 00:08:57.385
<00:08:55.125>and <00:08:55.475>it's <00:08:55.825>super, <00:08:56.175>super <00:08:56.525>verbose.

177
00:08:57.885 --> 00:09:02.065
<00:08:57.885>Uh, <00:08:58.040>and <00:08:58.196>that's <00:08:58.351>why, <00:08:58.507>um, <00:08:58.662>alpha <00:08:58.818>was, <00:08:58.973>was, <00:08:59.129>was <00:08:59.285>created.

178
00:09:02.095 --> 00:09:04.505
<00:09:02.095>They <00:09:02.270>basically <00:09:02.445>created <00:09:02.620>a <00:09:02.795>language <00:09:02.970>on <00:09:03.145>top <00:09:03.320>of <00:09:03.495>it.

179
00:09:06.435 --> 00:09:09.735
<00:09:06.435>But <00:09:06.574>today <00:09:06.714>we're <00:09:06.854>here <00:09:06.994>to <00:09:07.135>introduce <00:09:07.275>you <00:09:07.415>to <00:09:07.555>open <00:09:07.694>policy <00:09:07.834>agent,

180
00:09:09.795 --> 00:09:11.615
<00:09:09.795>an <00:09:10.145>alternative <00:09:10.495>to <00:09:10.844>XAC <00:09:11.194>ml.

181
00:09:12.195 --> 00:09:15.775
<00:09:12.195>Uh, <00:09:12.335>pol <00:09:12.475>uh, <00:09:12.615>open <00:09:12.755>policy <00:09:12.895>agent <00:09:13.035>is <00:09:13.175>a <00:09:13.315>policy <00:09:13.455>based <00:09:13.595>control

182
00:09:15.995 --> 00:09:17.295
<00:09:15.995>for <00:09:16.385>cloud <00:09:16.775>native <00:09:17.165>environments.

183
00:09:17.555 --> 00:09:18.575
<00:09:17.555>Uh, <00:09:17.861>don't <00:09:18.167>get <00:09:18.473>served

184
00:09:18.595 --> 00:09:21.375
<00:09:18.595>by <00:09:18.735>the <00:09:18.875>name <00:09:19.015>if <00:09:19.155>your <00:09:19.295>company's <00:09:19.435>not <00:09:19.575>cloud <00:09:19.715>native <00:09:19.855>yet, <00:09:19.995>uh,

185
00:09:21.375 --> 00:09:23.295
<00:09:21.375>because <00:09:21.608>open <00:09:21.841>policy <00:09:22.075>agent <00:09:22.308>can <00:09:22.541>be <00:09:22.775>used

186
00:09:23.295 --> 00:09:24.575
<00:09:23.295>for <00:09:23.679>pretty <00:09:24.063>much <00:09:24.447>everything.

187
00:09:25.155 --> 00:09:29.655
<00:09:25.155>Um, <00:09:25.388>so <00:09:25.621>what <00:09:25.855>is <00:09:26.088>open <00:09:26.321>policy <00:09:26.555>agent?

188
00:09:29.685 --> 00:09:32.135
<00:09:29.685>Open <00:09:29.964>policy <00:09:30.244>agent, <00:09:30.525>uh, <00:09:30.805>called <00:09:31.084>opa.

189
00:09:32.485 --> 00:09:36.135
<00:09:32.485>It's <00:09:32.640>an <00:09:32.796>open <00:09:32.951>source <00:09:33.107>software, <00:09:33.262>uh, <00:09:33.418>with, <00:09:33.573>with <00:09:33.729>the <00:09:33.885>goal

190
00:09:36.155 --> 00:09:38.215
<00:09:36.155>of <00:09:36.435>being <00:09:36.714>simply <00:09:36.995>a <00:09:37.275>policy <00:09:37.555>engine.

191
00:09:38.555 --> 00:09:39.615
<00:09:38.555>So, <00:09:38.793>uh, <00:09:39.031>as <00:09:39.270>we've <00:09:39.509>seen

192
00:09:39.615 --> 00:09:43.455
<00:09:39.615>before, <00:09:39.790>uh, <00:09:39.965>the <00:09:40.140>policy <00:09:40.315>engine <00:09:40.490>will <00:09:40.665>simply <00:09:40.840>evaluate, <00:09:41.015>uh,

193
00:09:44.055 --> 00:09:46.215
<00:09:44.055>policies <00:09:44.334>with <00:09:44.614>some <00:09:44.895>data <00:09:45.175>and <00:09:45.454>input

194
00:09:46.235 --> 00:09:49.655
<00:09:46.235>and <00:09:46.390>return <00:09:46.546>an, <00:09:46.701>an <00:09:46.857>output <00:09:47.012>that <00:09:47.168>can <00:09:47.323>be, <00:09:47.479>uh, <00:09:47.635>either

195
00:09:50.255 --> 00:09:52.775
<00:09:50.255>structured <00:09:50.455>data <00:09:50.655>or <00:09:50.855>either, <00:09:51.055>uh, <00:09:51.255>true <00:09:51.455>or <00:09:51.655>false.

196
00:09:53.515 --> 00:09:55.935
<00:09:53.515>And, <00:09:53.795>uh, <00:09:54.074>OPA <00:09:54.355>uses <00:09:54.635>high <00:09:54.915>level

197
00:09:56.155 --> 00:09:58.895
<00:09:56.155>and <00:09:56.329>high <00:09:56.505>level <00:09:56.680>declarative <00:09:56.855>language <00:09:57.030>that <00:09:57.204>it's <00:09:57.380>called <00:09:57.555>rego.

198
00:09:59.675 --> 00:10:03.335
<00:09:59.675>And <00:09:59.802>well, <00:09:59.929>the <00:10:00.056>goal, <00:10:00.184>as <00:10:00.311>we <00:10:00.438>said, <00:10:00.565>uh, <00:10:00.693>policy <00:10:00.820>as <00:10:00.947>code, <00:10:01.074>is

199
00:10:03.335 --> 00:10:05.015
<00:10:03.335>to <00:10:03.568>decouple <00:10:03.801>the <00:10:04.035>policies <00:10:04.268>from <00:10:04.501>your <00:10:04.735>software.

200
00:10:07.205 --> 00:10:09.145
<00:10:07.205>So <00:10:07.555>we'll <00:10:07.905>simply <00:10:08.255>compare, <00:10:08.605>uh,

201
00:10:10.175 --> 00:10:12.225
<00:10:10.175>Okay, <00:10:10.349>we <00:10:10.525>have <00:10:10.699>The, <00:10:10.875>okay, <00:10:11.050>we <00:10:11.224>have <00:10:11.400>an <00:10:11.574>issue

202
00:10:12.225 --> 00:10:13.945
<00:10:12.225>with <00:10:12.458>the <00:10:12.691>presentation, <00:10:12.925>so <00:10:13.158>we'll <00:10:13.391>simply <00:10:13.625>compare.

203
00:10:14.085 --> 00:10:15.745
<00:10:14.085>So <00:10:14.285>we, <00:10:14.485>uh, <00:10:14.685>maybe <00:10:14.885>I <00:10:15.085>can <00:10:15.285>show <00:10:15.485>it.

204
00:10:15.775 --> 00:10:18.145
<00:10:15.775>Okay. <00:10:16.008>Sorry. <00:10:16.241>We'll <00:10:16.475>simply <00:10:16.708>compare <00:10:16.941>the <00:10:17.175>two.

205
00:10:18.365 --> 00:10:22.465
<00:10:18.365>Um, <00:10:18.492>basically <00:10:18.619>the, <00:10:18.746>the <00:10:18.874>thing <00:10:19.001>that <00:10:19.128>you <00:10:19.255>see <00:10:19.383>on <00:10:19.510>the <00:10:19.637>left <00:10:19.765>side

206
00:10:22.465 --> 00:10:25.465
<00:10:22.465>that <00:10:22.640>we <00:10:22.815>see <00:10:22.990>with <00:10:23.165>X-A-C-M-L <00:10:23.340>is <00:10:23.515>basically <00:10:23.690>the <00:10:23.865>same.

207
00:10:25.465 --> 00:10:27.665
<00:10:25.465>So, <00:10:25.931>PEP, <00:10:26.398>the <00:10:26.865>policy

208
00:10:27.805 --> 00:10:30.785
<00:10:27.805>and <00:10:28.038>informance <00:10:28.271>point <00:10:28.505>is <00:10:28.738>basically <00:10:28.971>your <00:10:29.204>application.

209
00:10:31.045 --> 00:10:33.865
<00:10:31.045>Uh, <00:10:31.219>in <00:10:31.395>this <00:10:31.569>case, <00:10:31.745>your <00:10:31.920>application <00:10:32.094>is <00:10:32.270>called <00:10:32.444>servicing

210
00:10:33.865 --> 00:10:35.025
<00:10:33.865>this, <00:10:34.073>uh, <00:10:34.282>on <00:10:34.491>the <00:10:34.700>right <00:10:34.909>side.

211
00:10:35.565 --> 00:10:38.985
<00:10:35.565>And <00:10:35.705>the <00:10:35.845>service <00:10:35.985>will <00:10:36.125>simply <00:10:36.265>make <00:10:36.405>the <00:10:36.545>request <00:10:36.685>to <00:10:36.825>opa, <00:10:36.965>uh,

212
00:10:38.985 --> 00:10:40.705
<00:10:38.985>which <00:10:39.218>is <00:10:39.451>the <00:10:39.685>PDP <00:10:39.918>in <00:10:40.151>this <00:10:40.385>context.

213
00:10:41.605 --> 00:10:45.745
<00:10:41.605>And <00:10:41.721>the <00:10:41.838>PDP <00:10:41.955>opa <00:10:42.071>in <00:10:42.188>this <00:10:42.305>case, <00:10:42.421>uh, <00:10:42.538>will <00:10:42.655>use <00:10:42.771>as <00:10:42.888>a <00:10:43.005>source.

214
00:10:45.925 --> 00:10:49.945
<00:10:45.925>So <00:10:46.064>as <00:10:46.204>PAP, <00:10:46.344>uh, <00:10:46.484>where <00:10:46.625>the <00:10:46.765>policies <00:10:46.905>are, <00:10:47.045>we'll <00:10:47.185>use <00:10:47.324>the,

215
00:10:50.005 --> 00:10:51.185
<00:10:50.005>the <00:10:50.358>policies <00:10:50.713>written <00:10:51.067>in

216
00:10:52.125 --> 00:10:56.105
<00:10:52.125>and <00:10:52.252>as <00:10:52.379>the <00:10:52.506>source <00:10:52.634>of <00:10:52.761>information, <00:10:52.888>it <00:10:53.015>can <00:10:53.143>use <00:10:53.270>some <00:10:53.397>data, <00:10:53.525>uh,

217
00:10:56.335 --> 00:10:58.265
<00:10:56.335>that <00:10:56.568>comes <00:10:56.801>from <00:10:57.035>j <00:10:57.268>in <00:10:57.501>this <00:10:57.735>case.

218
00:10:58.525 --> 00:11:01.385
<00:10:58.525>Uh, <00:10:58.699>the <00:10:58.875>source <00:10:59.050>of <00:10:59.225>those <00:10:59.400>data <00:10:59.574>could <00:10:59.750>be, <00:10:59.925>uh,

219
00:11:01.385 --> 00:11:03.385
<00:11:01.385>either <00:11:01.585>a <00:11:01.785>database, <00:11:01.985>a <00:11:02.185>file <00:11:02.385>in <00:11:02.585>this <00:11:02.785>context,

220
00:11:03.565 --> 00:11:08.265
<00:11:03.565>or, <00:11:03.740>um, <00:11:03.915>even <00:11:04.090>pushed, <00:11:04.265>um, <00:11:04.440>through <00:11:04.615>web <00:11:04.790>books <00:11:04.965>from,

221
00:11:08.265 --> 00:11:09.465
<00:11:08.265>from <00:11:08.805>other <00:11:09.345>servers.

222
00:11:11.175 --> 00:11:15.245
<00:11:11.175>Okay, <00:11:11.454>so <00:11:11.734>lemme <00:11:12.015>start <00:11:12.295>from <00:11:12.574>here.

223
00:11:19.385 --> 00:11:20.595
<00:11:19.385>Okay, <00:11:20.474>so

224
00:11:24.005 --> 00:11:25.785
<00:11:24.005>item, <00:11:25.405>Hmm.

225
00:11:26.255 --> 00:11:31.145
<00:11:26.255>Okay, <00:11:26.395>so, <00:11:26.535>uh, <00:11:26.675>now <00:11:26.814>we <00:11:26.955>are <00:11:27.095>taking <00:11:27.235>from, <00:11:27.375>from <00:11:27.515>our, <00:11:27.655>uh,

226
00:11:31.295 --> 00:11:33.465
<00:11:31.295>initial <00:11:31.645>example, <00:11:31.995>but <00:11:32.344>now <00:11:32.694>instead

227
00:11:33.465 --> 00:11:37.025
<00:11:33.465>of <00:11:33.665>embedding <00:11:33.865>the <00:11:34.065>authorization <00:11:34.265>logic <00:11:34.465>in <00:11:34.665>the <00:11:34.865>application,

228
00:11:37.235 --> 00:11:39.465
<00:11:37.235>we're <00:11:37.515>using <00:11:37.795>the <00:11:38.075>open <00:11:38.355>policy <00:11:38.635>agent.

229
00:11:40.445 --> 00:11:43.665
<00:11:40.445>And, <00:11:40.585>uh, <00:11:40.725>we're <00:11:40.865>going <00:11:41.005>to <00:11:41.145>see <00:11:41.285>exactly <00:11:41.425>what <00:11:41.565>happens <00:11:41.705>in <00:11:41.845>here.

230
00:11:45.575 --> 00:11:49.555
<00:11:45.575>So, <00:11:45.808>first, <00:11:46.041>the <00:11:46.275>code <00:11:46.508>will <00:11:46.741>change <00:11:46.975>slightly.

231
00:11:50.055 --> 00:11:53.525
<00:11:50.055>So <00:11:50.194>instead <00:11:50.334>of <00:11:50.474>having <00:11:50.614>the <00:11:50.755>logic <00:11:50.895>here, <00:11:51.035>we <00:11:51.175>are <00:11:51.314>delegating <00:11:51.454>the,

232
00:11:53.545 --> 00:11:56.005
<00:11:53.545>the <00:11:53.824>authorization <00:11:54.104>logic <00:11:54.385>to <00:11:54.665>OPA <00:11:54.944>client

233
00:11:56.005 --> 00:12:00.245
<00:11:56.005>that <00:11:56.160>we <00:11:56.316>pretty <00:11:56.471>much <00:11:56.627>do <00:11:56.782>in <00:11:56.938>the <00:11:57.093>background, <00:11:57.249>uh, <00:11:57.405>uh,

234
00:12:00.405 --> 00:12:04.005
<00:12:00.405>HTP <00:12:00.579>request <00:12:00.755>to, <00:12:00.930>to <00:12:01.105>the <00:12:01.280>rest, <00:12:01.454>API <00:12:01.630>from <00:12:01.805>opa,

235
00:12:04.135 --> 00:12:07.485
<00:12:04.135>which <00:12:04.290>will <00:12:04.446>return <00:12:04.601>if <00:12:04.757>it, <00:12:04.912>uh, <00:12:05.068>is <00:12:05.223>allowed <00:12:05.379>or <00:12:05.535>not.

236
00:12:08.785 --> 00:12:12.725
<00:12:08.785>How <00:12:08.925>would <00:12:09.064>it <00:12:09.204>work? <00:12:09.344>Uh, <00:12:09.485>is, <00:12:09.625>is <00:12:09.765>in <00:12:09.905>the <00:12:10.045>following <00:12:10.185>way.

237
00:12:12.785 --> 00:12:15.645
<00:12:12.785>We <00:12:12.940>are <00:12:13.096>using <00:12:13.251>and <00:12:13.407>deploying <00:12:13.562>it <00:12:13.718>in <00:12:13.873>the <00:12:14.029>rest <00:12:14.185>mode.

238
00:12:15.985 --> 00:12:18.565
<00:12:15.985>So <00:12:16.185>the <00:12:16.385>OPPA <00:12:16.585>is <00:12:16.785>just <00:12:16.985>a <00:12:17.185>rest, <00:12:17.385>API.

239
00:12:19.105 --> 00:12:21.485
<00:12:19.105>So <00:12:19.338>if <00:12:19.571>you're <00:12:19.805>using, <00:12:20.038>for <00:12:20.271>example, <00:12:20.505>Kubernetes,

240
00:12:21.485 --> 00:12:22.885
<00:12:21.485>it <00:12:21.800>would <00:12:22.115>be <00:12:22.430>a <00:12:22.745>sidecar.

241
00:12:22.985 --> 00:12:26.805
<00:12:22.985>So <00:12:23.125>in <00:12:23.265>another <00:12:23.405>container <00:12:23.545>in <00:12:23.685>the <00:12:23.825>same <00:12:23.965>po <00:12:24.105>for <00:12:24.245>example, <00:12:24.385>uh,

242
00:12:27.205 --> 00:12:28.485
<00:12:27.205>OPPA <00:12:27.493>also <00:12:27.781>has <00:12:28.069>a <00:12:28.357>binary.

243
00:12:29.025 --> 00:12:32.125
<00:12:29.025>So, <00:12:29.199>uh, <00:12:29.375>yeah, <00:12:29.550>uh, <00:12:29.725>don't <00:12:29.900>see <00:12:30.074>that <00:12:30.250>many <00:12:30.425>kids,

244
00:12:32.385 --> 00:12:35.445
<00:12:32.385>but <00:12:32.540>you <00:12:32.696>can <00:12:32.851>also <00:12:33.007>evaluate <00:12:33.162>policies <00:12:33.318>on <00:12:33.473>the <00:12:33.629>comment <00:12:33.785>line.

245
00:12:36.305 --> 00:12:38.845
<00:12:36.305>Uh, <00:12:36.538>it's <00:12:36.771>very <00:12:37.005>good, <00:12:37.238>especially <00:12:37.471>for <00:12:37.704>development.

246
00:12:39.585 --> 00:12:43.565
<00:12:39.585>Uh, <00:12:39.712>and <00:12:39.839>there's <00:12:39.966>also <00:12:40.094>a <00:12:40.221>third <00:12:40.348>option <00:12:40.475>that <00:12:40.603>you <00:12:40.730>can <00:12:40.857>embed, <00:12:40.985>uh,

247
00:12:44.105 --> 00:12:46.405
<00:12:44.105>the, <00:12:44.338>the <00:12:44.571>OPA <00:12:44.805>in <00:12:45.038>your <00:12:45.271>own <00:12:45.505>application,

248
00:12:46.405 --> 00:12:50.925
<00:12:46.405>but <00:12:46.579>as <00:12:46.755>a <00:12:46.930>library <00:12:47.105>to <00:12:47.280>process, <00:12:47.454>uh, <00:12:47.630>the, <00:12:47.805>the,

249
00:12:51.185 --> 00:12:54.085
<00:12:51.185>so <00:12:51.418>to <00:12:51.651>perform <00:12:51.885>the, <00:12:52.118>the <00:12:52.351>request <00:12:52.584>instead

250
00:12:54.085 --> 00:12:56.365
<00:12:54.085>of <00:12:54.365>having <00:12:54.645>one <00:12:54.925>HTP, <00:12:55.205>uh, <00:12:55.485>service.

251
00:12:58.405 --> 00:13:00.905
<00:12:58.405>So <00:12:58.579>how <00:12:58.755>would <00:12:58.930>it <00:12:59.105>look <00:12:59.280>like <00:12:59.454>in <00:12:59.630>practice <00:12:59.805>here?

252
00:13:01.685 --> 00:13:04.545
<00:13:01.685>Uh, <00:13:01.859>we <00:13:02.035>have <00:13:02.209>one <00:13:02.385>authorization <00:13:02.560>policy <00:13:02.734>to <00:13:02.910>start <00:13:03.084>with

253
00:13:04.545 --> 00:13:09.025
<00:13:04.545>that's <00:13:04.745>loaded <00:13:04.944>to <00:13:05.145>the <00:13:05.344>opa, <00:13:05.545>uh, <00:13:05.745>right, <00:13:05.944>uh,

254
00:13:09.165 --> 00:13:13.585
<00:13:09.165>and <00:13:09.305>this <00:13:09.444>is <00:13:09.584>one <00:13:09.724>example <00:13:09.865>in <00:13:10.005>Rego, <00:13:10.145>uh, <00:13:10.285>which <00:13:10.425>just <00:13:10.564>states

255
00:13:13.655 --> 00:13:17.465
<00:13:13.655>that <00:13:13.782>the <00:13:13.909>user <00:13:14.036>is <00:13:14.164>allowed <00:13:14.291>to <00:13:14.418>pass <00:13:14.545>if <00:13:14.673>there <00:13:14.800>are <00:13:14.927>no <00:13:15.055>violations.

256
00:13:17.805 --> 00:13:21.425
<00:13:17.805>And <00:13:17.960>what <00:13:18.116>makes <00:13:18.271>a <00:13:18.427>violation <00:13:18.582>is <00:13:18.738>if <00:13:18.893>the <00:13:19.049>user's <00:13:19.204>trying

257
00:13:21.425 --> 00:13:25.745
<00:13:21.425>to <00:13:21.580>lease <00:13:21.736>the <00:13:21.891>salaries <00:13:22.047>and <00:13:22.202>is <00:13:22.358>not <00:13:22.513>one <00:13:22.669>admin <00:13:22.824>user.

258
00:13:26.165 --> 00:13:27.865
<00:13:26.165>So <00:13:26.444>it <00:13:26.724>would <00:13:27.005>trigger <00:13:27.285>one <00:13:27.564>violation,

259
00:13:27.885 --> 00:13:29.145
<00:13:27.885>and <00:13:28.111>the <00:13:28.338>law <00:13:28.565>would <00:13:28.792>be <00:13:29.019>false.

260
00:13:31.565 --> 00:13:34.265
<00:13:31.565>Uh, <00:13:31.705>and <00:13:31.845>okay, <00:13:31.985>on <00:13:32.125>the <00:13:32.265>other <00:13:32.405>side, <00:13:32.545>we <00:13:32.685>have <00:13:32.825>the <00:13:32.965>input.

261
00:13:34.325 --> 00:13:37.545
<00:13:34.325>So <00:13:34.480>for <00:13:34.636>a <00:13:34.791>given <00:13:34.947>user, <00:13:35.102>we <00:13:35.258>pass <00:13:35.413>if <00:13:35.569>that <00:13:35.725>user,

262
00:13:37.805 --> 00:13:40.025
<00:13:37.805>and <00:13:38.005>if <00:13:38.204>it's <00:13:38.405>one <00:13:38.604>admin <00:13:38.805>or <00:13:39.005>not <00:13:39.204>here,

263
00:13:40.205 --> 00:13:41.985
<00:13:40.205>and <00:13:40.671>the <00:13:41.138>requested <00:13:41.605>operation.

264
00:13:42.165 --> 00:13:45.145
<00:13:42.165>So <00:13:42.398>this <00:13:42.631>input, <00:13:42.865>uh, <00:13:43.098>that <00:13:43.331>goes, <00:13:43.564>uh,

265
00:13:45.215 --> 00:13:47.105
<00:13:45.215>with <00:13:45.448>a <00:13:45.681>special <00:13:45.915>URL <00:13:46.148>you <00:13:46.381>can <00:13:46.615>see,

266
00:13:47.245 --> 00:13:50.425
<00:13:47.245>so <00:13:47.420>my <00:13:47.595>app <00:13:47.770>salary <00:13:47.945>are <00:13:48.120>defined, <00:13:48.295>the <00:13:48.470>package, <00:13:48.645>name

267
00:13:50.425 --> 00:13:52.985
<00:13:50.425>of <00:13:50.625>the <00:13:50.824>policy, <00:13:51.025>and <00:13:51.224>we'll <00:13:51.425>try <00:13:51.625>to <00:13:51.824>query

268
00:13:53.125 --> 00:13:54.865
<00:13:53.125>for <00:13:53.475>the <00:13:53.825>result <00:13:54.175>of <00:13:54.525>halal.

269
00:13:55.805 --> 00:13:59.745
<00:13:55.805>And <00:13:55.979>when <00:13:56.155>it <00:13:56.329>happens, <00:13:56.505>you <00:13:56.680>receive <00:13:56.854>the, <00:13:57.030>this <00:13:57.204>result.

270
00:13:59.805 --> 00:14:04.505
<00:13:59.805>So <00:13:59.932>as, <00:14:00.059>uh, <00:14:00.186>John <00:14:00.314>is <00:14:00.441>one <00:14:00.568>admin, <00:14:00.695>it <00:14:00.823>would <00:14:00.950>trigger <00:14:01.077>no <00:14:01.204>violation.

271
00:14:04.615 --> 00:14:07.225
<00:14:04.615>Therefore, <00:14:04.895>uh, <00:14:05.175>that <00:14:05.455>would <00:14:05.735>be <00:14:06.015>true.

272
00:14:09.165 --> 00:14:12.465
<00:14:09.165>So, <00:14:09.365>uh, <00:14:09.564>some <00:14:09.765>of <00:14:09.964>the <00:14:10.165>benefits <00:14:10.365>here, <00:14:10.564>uh,

273
00:14:12.725 --> 00:14:16.585
<00:14:12.725>we <00:14:12.958>decoupled <00:14:13.191>policy <00:14:13.425>definition, <00:14:13.658>policy <00:14:13.891>enforcement, <00:14:14.125>uh,

274
00:14:16.765 --> 00:14:20.705
<00:14:16.765>we <00:14:16.905>have <00:14:17.045>all, <00:14:17.185>all <00:14:17.324>the <00:14:17.465>authorization <00:14:17.605>logic <00:14:17.745>in, <00:14:17.885>in, <00:14:18.025>in <00:14:18.165>opa.

275
00:14:20.725 --> 00:14:23.425
<00:14:20.725>So <00:14:20.880>in <00:14:21.036>a, <00:14:21.191>in <00:14:21.347>a <00:14:21.502>standard <00:14:21.658>way, <00:14:21.813>we'll <00:14:21.969>see <00:14:22.125>also

276
00:14:23.425 --> 00:14:25.225
<00:14:23.425>that <00:14:23.704>we <00:14:23.984>can <00:14:24.265>test <00:14:24.545>those <00:14:24.824>policies.

277
00:14:25.725 --> 00:14:27.625
<00:14:25.725>And <00:14:25.958>there <00:14:26.191>are <00:14:26.425>even <00:14:26.658>some, <00:14:26.891>uh, <00:14:27.125>benefits

278
00:14:27.625 --> 00:14:29.705
<00:14:27.625>that <00:14:27.825>we're <00:14:28.025>not <00:14:28.225>covering <00:14:28.425>here <00:14:28.625>in <00:14:28.825>this <00:14:29.025>demo,

279
00:14:29.955 --> 00:14:31.945
<00:14:29.955>which <00:14:30.188>is <00:14:30.421>you <00:14:30.655>can <00:14:30.888>sign <00:14:31.121>the <00:14:31.355>policies

280
00:14:31.945 --> 00:14:34.425
<00:14:31.945>and <00:14:32.145>verify <00:14:32.345>for <00:14:32.545>certain <00:14:32.745>public <00:14:32.945>key <00:14:33.145>to <00:14:33.345>burn

281
00:14:34.455 --> 00:14:37.545
<00:14:34.455>that <00:14:34.655>you're <00:14:34.855>only <00:14:35.055>apply <00:14:35.255>authorization <00:14:35.455>logic <00:14:35.655>that <00:14:35.855>comes

282
00:14:38.415 --> 00:14:39.505
<00:14:38.415>from <00:14:38.905>trusted <00:14:39.396>source,

283
00:14:40.455 --> 00:14:42.985
<00:14:40.455>becomes <00:14:40.688>then <00:14:40.921>a <00:14:41.155>common <00:14:41.388>standard <00:14:41.621>of <00:14:41.855>authorization.

284
00:14:43.165 --> 00:14:46.385
<00:14:43.165>And <00:14:43.292>also <00:14:43.419>perform, <00:14:43.546>uh, <00:14:43.674>allows <00:14:43.801>you <00:14:43.928>to <00:14:44.055>have <00:14:44.183>a <00:14:44.310>how <00:14:44.437>to <00:14:44.564>reload

285
00:14:46.385 --> 00:14:48.665
<00:14:46.385>because <00:14:46.665>there <00:14:46.944>are <00:14:47.225>some <00:14:47.505>management <00:14:47.785>APIs

286
00:14:48.995 --> 00:14:52.845
<00:14:48.995>where <00:14:49.150>you <00:14:49.306>can <00:14:49.461>force <00:14:49.617>the <00:14:49.772>reload <00:14:49.928>of, <00:14:50.083>uh, <00:14:50.239>the <00:14:50.395>policies.

287
00:14:53.905 --> 00:14:56.805
<00:14:53.905>So, <00:14:54.105>uh, <00:14:54.305>we, <00:14:54.505>we'll <00:14:54.704>do <00:14:54.905>two <00:14:55.105>demos <00:14:55.305>here.

288
00:14:57.185 --> 00:15:01.325
<00:14:57.185>One, <00:14:57.385>uh, <00:14:57.584>very <00:14:57.785>short <00:14:57.984>that <00:14:58.185>we, <00:14:58.385>uh, <00:14:58.584>just,

289
00:15:02.065 --> 00:15:05.365
<00:15:02.065>uh, <00:15:02.220>put <00:15:02.376>in <00:15:02.531>practice <00:15:02.687>what <00:15:02.842>you've <00:15:02.998>seen <00:15:03.153>on <00:15:03.309>these <00:15:03.465>slides,

290
00:15:05.945 --> 00:15:08.885
<00:15:05.945>and <00:15:06.145>then <00:15:06.345>we'll <00:15:06.545>compliment <00:15:06.745>with <00:15:06.945>one <00:15:07.145>additional <00:15:07.345>demo,

291
00:15:09.065 --> 00:15:10.365
<00:15:09.065>uh, <00:15:09.455>covering <00:15:09.845>more <00:15:10.235>topics.

292
00:15:12.185 --> 00:15:17.165
<00:15:12.185>So, <00:15:12.418>uh, <00:15:12.651>here <00:15:12.885>we <00:15:13.118>have <00:15:13.351>my, <00:15:13.584>uh,

293
00:15:17.825 --> 00:15:22.805
<00:15:17.825>id, <00:15:17.980>uh, <00:15:18.136>all <00:15:18.291>the, <00:15:18.447>the, <00:15:18.602>the <00:15:18.758>input <00:15:18.913>as <00:15:19.069>you <00:15:19.225>saw.

294
00:15:22.825 --> 00:15:25.005
<00:15:22.825>So <00:15:23.025>we <00:15:23.225>have <00:15:23.425>here, <00:15:23.625>John, <00:15:23.825>this <00:15:24.025>one <00:15:24.225>admin,

295
00:15:27.155 --> 00:15:29.895
<00:15:27.155>and, <00:15:27.388>uh, <00:15:27.621>we <00:15:27.855>have <00:15:28.088>here <00:15:28.321>the <00:15:28.555>policy

296
00:15:31.695 --> 00:15:34.785
<00:15:31.695>that <00:15:31.811>is <00:15:31.928>trying <00:15:32.045>to <00:15:32.161>the, <00:15:32.278>the <00:15:32.395>same <00:15:32.511>as <00:15:32.628>you <00:15:32.745>saw <00:15:32.861>in <00:15:32.978>these <00:15:33.095>slides.

297
00:15:35.925 --> 00:15:37.225
<00:15:35.925>The, <00:15:36.314>the <00:15:36.705>interesting <00:15:37.095>part,

298
00:15:37.285 --> 00:15:39.545
<00:15:37.285>we <00:15:37.518>also <00:15:37.751>have <00:15:37.985>tests <00:15:38.218>for <00:15:38.451>this <00:15:38.685>policy.

299
00:15:40.565 --> 00:15:44.345
<00:15:40.565>So <00:15:40.740>for, <00:15:40.915>to <00:15:41.090>create <00:15:41.265>operation, <00:15:41.440>both <00:15:41.615>admin <00:15:41.790>is <00:15:41.965>allowed

300
00:15:44.345 --> 00:15:46.025
<00:15:44.345>and <00:15:44.625>no <00:15:44.905>admin <00:15:45.185>are, <00:15:45.465>are <00:15:45.745>allowed,

301
00:15:46.605 --> 00:15:48.625
<00:15:46.605>but <00:15:46.780>if <00:15:46.955>you <00:15:47.130>want <00:15:47.305>to <00:15:47.480>list <00:15:47.655>all <00:15:47.830>the <00:15:48.005>salaries,

302
00:15:49.015 --> 00:15:51.265
<00:15:49.015>then <00:15:49.295>only <00:15:49.574>admin <00:15:49.855>is <00:15:50.135>allowed <00:15:50.415>and,

303
00:15:51.325 --> 00:15:54.025
<00:15:51.325>and <00:15:51.605>no <00:15:51.885>admin <00:15:52.165>are <00:15:52.445>not <00:15:52.725>allowed.

304
00:15:55.165 --> 00:16:00.105
<00:15:55.165>So <00:15:55.281>to <00:15:55.398>make <00:15:55.515>sure <00:15:55.631>we <00:15:55.748>can, <00:15:55.865>uh, <00:15:55.981>see <00:15:56.098>if <00:15:56.214>the <00:15:56.331>tests <00:15:56.448>are <00:15:56.564>passing,

305
00:16:01.835 --> 00:16:03.055
<00:16:01.835>we <00:16:02.109>can <00:16:02.384>run <00:16:02.658>the <00:16:02.933>tests.

306
00:16:05.465 --> 00:16:08.845
<00:16:05.465>And <00:16:05.620>very <00:16:05.776>quickly <00:16:05.931>you'll <00:16:06.087>see <00:16:06.242>that <00:16:06.398>those <00:16:06.553>tests <00:16:06.709>are <00:16:06.865>passing.

307
00:16:10.145 --> 00:16:14.005
<00:16:10.145>Now, <00:16:10.300>uh, <00:16:10.456>I'm <00:16:10.611>going <00:16:10.767>to <00:16:10.922>start <00:16:11.078>the, <00:16:11.233>the <00:16:11.389>web <00:16:11.545>server

308
00:16:16.605 --> 00:16:17.655
<00:16:16.605>loading <00:16:17.077>the <00:16:17.550>policy.

309
00:16:17.915 --> 00:16:19.175
<00:16:17.915>So <00:16:18.482>web <00:16:19.049>salaries,

310
00:16:22.235 --> 00:16:23.895
<00:16:22.235>so <00:16:22.515>it's <00:16:22.795>now <00:16:23.075>running <00:16:23.355>on <00:16:23.635>port

311
00:16:23.985 --> 00:16:28.175
<00:16:23.985>8, <00:16:24.265>1 <00:16:24.545>8 <00:16:24.825>1, <00:16:25.105>uh, <00:16:25.385>okay.

312
00:16:32.565 --> 00:16:35.865
<00:16:32.565>And <00:16:32.740>I <00:16:32.915>can <00:16:33.090>then <00:16:33.265>do <00:16:33.440>a <00:16:33.615>request <00:16:33.790>to <00:16:33.965>it,

313
00:16:36.775 --> 00:16:40.145
<00:16:36.775>sending <00:16:36.949>a <00:16:37.125>certain <00:16:37.300>input <00:16:37.475>to <00:16:37.650>the <00:16:37.824>allow <00:16:38.000>address <00:16:38.175>here.

314
00:16:41.835 --> 00:16:46.095
<00:16:41.835>So <00:16:41.975>this <00:16:42.115>input <00:16:42.255>is, <00:16:42.395>uh, <00:16:42.535>is, <00:16:42.675>uh, <00:16:42.815>exactly <00:16:42.955>this <00:16:43.095>one <00:16:43.235>here,

315
00:16:46.955 --> 00:16:48.375
<00:16:46.955>and <00:16:47.210>we <00:16:47.466>see <00:16:47.721>what <00:16:47.977>we <00:16:48.233>get.

316
00:16:50.395 --> 00:16:54.455
<00:16:50.395>So <00:16:50.535>when <00:16:50.675>the <00:16:50.814>user <00:16:50.954>is <00:16:51.095>one <00:16:51.235>admin, <00:16:51.375>he's <00:16:51.515>allowed <00:16:51.655>to <00:16:51.795>to,

317
00:16:55.195 --> 00:16:56.415
<00:16:55.195>to <00:16:55.744>that <00:16:56.293>operation.

318
00:16:58.155 --> 00:17:00.215
<00:16:58.155>But <00:16:58.329>let's <00:16:58.505>see <00:16:58.680>if <00:16:58.855>we <00:16:59.030>set <00:16:59.204>it's <00:16:59.380>too <00:16:59.555>false

319
00:17:03.015 --> 00:17:06.675
<00:17:03.015>and <00:17:03.189>try <00:17:03.365>again, <00:17:03.540>the <00:17:03.715>user <00:17:03.890>is <00:17:04.065>not <00:17:04.240>allowed <00:17:04.415>anymore.

320
00:17:07.975 --> 00:17:11.715
<00:17:07.974>Uh, <00:17:08.149>so <00:17:08.324>that's <00:17:08.500>the <00:17:08.675>main <00:17:08.849>concept, <00:17:09.024>uh, <00:17:09.199>of <00:17:09.375>opa.

321
00:17:12.015 --> 00:17:16.515
<00:17:12.015>And <00:17:12.142>now <00:17:12.269>we <00:17:12.396>will <00:17:12.524>hand <00:17:12.651>over <00:17:12.778>to <00:17:12.905>Dennis <00:17:13.033>so <00:17:13.160>he <00:17:13.287>can, <00:17:13.415>uh,

322
00:17:16.745 --> 00:17:18.115
<00:17:16.744>tell <00:17:16.991>you <00:17:17.238>even <00:17:17.484>more <00:17:17.731>about <00:17:17.978>that.

323
00:17:21.135 --> 00:17:23.525
<00:17:21.135>Thank <00:17:21.290>you, <00:17:21.446>Anderson. <00:17:21.601>I <00:17:21.757>will <00:17:21.912>try <00:17:22.068>to <00:17:22.223>share <00:17:22.379>my <00:17:22.535>screen.

324
00:17:24.425 --> 00:17:25.645
<00:17:24.425>Uh, <00:17:24.973>let's <00:17:25.522>see.

325
00:17:28.845 --> 00:17:30.935
<00:17:28.845>Okay, <00:17:29.078>hopefully <00:17:29.311>you <00:17:29.545>should <00:17:29.778>see <00:17:30.011>my <00:17:30.245>screen.

326
00:17:31.915 --> 00:17:33.575
<00:17:31.915>And <00:17:32.148>let's <00:17:32.381>switch <00:17:32.615>back <00:17:32.848>to <00:17:33.081>a <00:17:33.315>terminal.

327
00:17:34.755 --> 00:17:39.175
<00:17:34.755>So, <00:17:34.882>um, <00:17:35.009>I <00:17:35.136>would <00:17:35.264>compliment <00:17:35.391>this <00:17:35.518>demo <00:17:35.645>with, <00:17:35.773>uh, <00:17:35.900>with <00:17:36.027>a <00:17:36.155>small,

328
00:17:39.475 --> 00:17:41.175
<00:17:39.475>uh, <00:17:39.824>API <00:17:40.175>that <00:17:40.524>I <00:17:40.875>developed.

329
00:17:41.245 --> 00:17:43.415
<00:17:41.245>It's <00:17:41.594>super <00:17:41.945>simple. <00:17:42.294>So, <00:17:42.645>uh,

330
00:17:45.035 --> 00:17:46.655
<00:17:45.035>um, <00:17:45.385>we'll <00:17:45.735>start <00:17:46.085>with <00:17:46.435>this.

331
00:17:46.675 --> 00:17:48.575
<00:17:46.675>So, <00:17:46.850>uh, <00:17:47.024>let <00:17:47.200>me <00:17:47.375>describe <00:17:47.550>real <00:17:47.725>quick <00:17:47.899>the <00:17:48.075>code.

332
00:17:48.575 --> 00:17:50.845
<00:17:48.575>It's <00:17:48.808>Golan, <00:17:49.041>uh, <00:17:49.275>I <00:17:49.508>hope <00:17:49.741>it's <00:17:49.975>understandable.

333
00:17:51.165 --> 00:17:53.125
<00:17:51.165>I <00:17:51.340>also <00:17:51.514>added <00:17:51.690>some <00:17:51.865>comments <00:17:52.040>to <00:17:52.215>help <00:17:52.389>you <00:17:52.565>read

334
00:17:53.125 --> 00:17:55.485
<00:17:53.125>through <00:17:53.325>the <00:17:53.525>think, <00:17:53.725>just <00:17:53.925>ignore <00:17:54.125>the <00:17:54.325>part <00:17:54.525>here,

335
00:17:55.495 --> 00:17:58.285
<00:17:55.495>which <00:17:55.774>is <00:17:56.054>basically <00:17:56.334>the <00:17:56.614>initialization <00:17:56.895>and,

336
00:17:58.745 --> 00:18:01.805
<00:17:58.745>and <00:17:58.945>getting <00:17:59.145>the <00:17:59.344>OPA <00:17:59.544>address <00:17:59.745>variable <00:17:59.945>environment <00:18:00.145>variable.

337
00:18:02.055 --> 00:18:04.805
<00:18:02.055>Let's <00:18:02.210>focus <00:18:02.366>on <00:18:02.521>the <00:18:02.677>slash <00:18:02.832>API <00:18:02.988>slash <00:18:03.143>V <00:18:03.299>one <00:18:03.455>rock.

338
00:18:05.065 --> 00:18:08.245
<00:18:05.065>So <00:18:05.220>I'm <00:18:05.376>creating <00:18:05.531>this <00:18:05.687>slash <00:18:05.842>API <00:18:05.998>slash <00:18:06.153>V <00:18:06.309>one <00:18:06.465>route,

339
00:18:08.905 --> 00:18:10.805
<00:18:08.905>and <00:18:09.185>I'm <00:18:09.465>also <00:18:09.745>creating <00:18:10.024>a <00:18:10.305>middleware.

340
00:18:10.985 --> 00:18:14.405
<00:18:10.985>So, <00:18:11.140>uh, <00:18:11.296>for <00:18:11.451>this <00:18:11.607>API <00:18:11.762>group, <00:18:11.918>I'm <00:18:12.073>using <00:18:12.229>a <00:18:12.385>middleware

341
00:18:14.405 --> 00:18:19.045
<00:18:14.405>that <00:18:14.580>will <00:18:14.754>simply <00:18:14.930>evaluate <00:18:15.105>some <00:18:15.280>policies, <00:18:15.455>um, <00:18:15.629>and <00:18:15.805>return.

342
00:18:19.425 --> 00:18:22.765
<00:18:19.425>And <00:18:19.565>based <00:18:19.705>on, <00:18:19.845>on <00:18:19.985>the <00:18:20.125>result <00:18:20.264>of <00:18:20.405>devaluation, <00:18:20.544>we <00:18:20.685>the <00:18:20.825>return,

343
00:18:23.305 --> 00:18:27.285
<00:18:23.305>uh, <00:18:23.460>when, <00:18:23.616>when <00:18:23.771>it's <00:18:23.927>true, <00:18:24.082>it'll <00:18:24.238>proceed <00:18:24.393>with <00:18:24.549>the <00:18:24.705>request.

344
00:18:27.285 --> 00:18:30.045
<00:18:27.285>Otherwise, <00:18:27.460>it'll <00:18:27.635>return <00:18:27.810>a <00:18:27.985>4 <00:18:28.160>0 <00:18:28.335>3 <00:18:28.510>status <00:18:28.685>forbidden

345
00:18:30.505 --> 00:18:33.405
<00:18:30.505>and <00:18:30.632>will <00:18:30.759>say, <00:18:30.886>uh, <00:18:31.014>you <00:18:31.141>do <00:18:31.268>not <00:18:31.395>have <00:18:31.523>access <00:18:31.650>to <00:18:31.777>this <00:18:31.905>resource.

346
00:18:34.265 --> 00:18:37.685
<00:18:34.265>Uh, <00:18:34.465>just <00:18:34.665>as, <00:18:34.865>as <00:18:35.065>a <00:18:35.265>quick, <00:18:35.465>uh, <00:18:35.665>point

347
00:18:37.745 --> 00:18:39.045
<00:18:37.745>or <00:18:38.037>a <00:18:38.330>quick <00:18:38.622>note, <00:18:38.915>uh,

348
00:18:39.185 --> 00:18:40.885
<00:18:39.185>I'm <00:18:39.465>getting <00:18:39.745>the <00:18:40.024>other <00:18:40.304>authorization <00:18:40.585>error.

349
00:18:41.225 --> 00:18:43.405
<00:18:41.225>Uh, <00:18:41.458>this <00:18:41.691>contained <00:18:41.925>the <00:18:42.158>basic, <00:18:42.391>uh, <00:18:42.625>out.

350
00:18:43.625 --> 00:18:46.605
<00:18:43.625>So, <00:18:43.858>uh, <00:18:44.091>HT <00:18:44.325>is <00:18:44.558>account <00:18:44.791>and <00:18:45.025>basic.

351
00:18:46.865 --> 00:18:50.005
<00:18:46.865>Um, <00:18:47.040>the <00:18:47.215>HTP <00:18:47.390>basic <00:18:47.565>out <00:18:47.740>is, <00:18:47.915>uh, <00:18:48.090>usually <00:18:48.265>encoded

352
00:18:50.005 --> 00:18:51.205
<00:18:50.005>with, <00:18:50.365>uh, <00:18:50.725>basic <00:18:51.085>64.

353
00:18:51.705 --> 00:18:56.205
<00:18:51.705>So <00:18:51.832>I'm <00:18:51.959>getting <00:18:52.086>the <00:18:52.214>other, <00:18:52.341>uh, <00:18:52.468>I'm <00:18:52.595>performing <00:18:52.723>a <00:18:52.850>Rex <00:18:52.977>just <00:18:53.105>to,

354
00:18:56.345 --> 00:18:58.045
<00:18:56.345>to, <00:18:56.625>to <00:18:56.905>take <00:18:57.185>the <00:18:57.465>second <00:18:57.745>part.

355
00:18:58.065 --> 00:19:00.965
<00:18:58.065>So <00:18:58.240>it's <00:18:58.415>basic. <00:18:58.590>And <00:18:58.765>then <00:18:58.940>the, <00:18:59.115>uh, <00:18:59.290>encoded <00:18:59.465>string.

356
00:19:01.505 --> 00:19:02.525
<00:19:01.505>I'm <00:19:01.811>decoding <00:19:02.117>the <00:19:02.423>string,

357
00:19:03.345 --> 00:19:07.405
<00:19:03.345>and <00:19:03.545>I'm <00:19:03.745>simply <00:19:03.945>simply, <00:19:04.145>uh, <00:19:04.345>dividing <00:19:04.545>the, <00:19:04.745>uh,

358
00:19:07.685 --> 00:19:09.085
<00:19:07.685>username <00:19:07.937>part <00:19:08.189>from <00:19:08.441>the <00:19:08.693>password <00:19:08.945>part.

359
00:19:09.295 --> 00:19:11.765
<00:19:09.295>We'll <00:19:09.470>see <00:19:09.645>afterwards <00:19:09.820>that, <00:19:09.995>uh, <00:19:10.170>this <00:19:10.345>will <00:19:10.520>allow <00:19:10.695>me

360
00:19:11.905 --> 00:19:13.965
<00:19:11.905>to <00:19:12.105>easily <00:19:12.305>switch <00:19:12.504>between <00:19:12.705>the <00:19:12.905>users <00:19:13.105>without <00:19:13.305>having

361
00:19:13.965 --> 00:19:16.485
<00:19:13.965>to <00:19:14.165>implement <00:19:14.365>the <00:19:14.564>proper <00:19:14.764>authentication <00:19:14.965>layer <00:19:15.165>that, <00:19:15.365>uh,

362
00:19:16.485 --> 00:19:17.685
<00:19:16.485>it's <00:19:16.844>out <00:19:17.205>scope <00:19:17.565>here.

363
00:19:18.515 --> 00:19:21.925
<00:19:18.515>Then <00:19:18.655>I'll <00:19:18.795>simply <00:19:18.935>call <00:19:19.075>this <00:19:19.215>ML <00:19:19.355>policy <00:19:19.495>function <00:19:19.635>that <00:19:19.775>I <00:19:19.915>created

364
00:19:22.025 --> 00:19:23.605
<00:19:22.025>by <00:19:22.375>passing <00:19:22.725>the <00:19:23.075>opa <00:19:23.425>URL

365
00:19:24.705 --> 00:19:28.125
<00:19:24.705>and <00:19:24.860>this, <00:19:25.016>uh, <00:19:25.171>this <00:19:25.327>fancy <00:19:25.482>type <00:19:25.638>that <00:19:25.793>I <00:19:25.949>created, <00:19:26.105>which,

366
00:19:28.125 --> 00:19:29.485
<00:19:28.125>which <00:19:28.431>are <00:19:28.736>called <00:19:29.043>input <00:19:29.349>requests.

367
00:19:29.485 --> 00:19:31.125
<00:19:29.485>You <00:19:29.685>can <00:19:29.885>pass <00:19:30.084>whatever <00:19:30.284>you <00:19:30.485>want <00:19:30.685>in <00:19:30.885>here.

368
00:19:31.585 --> 00:19:34.965
<00:19:31.585>Uh, <00:19:31.740>and, <00:19:31.896>and <00:19:32.051>this <00:19:32.207>will <00:19:32.362>actually <00:19:32.518>be <00:19:32.673>reflected <00:19:32.829>in, <00:19:32.985>in,

369
00:19:35.065 --> 00:19:38.165
<00:19:35.065>in <00:19:35.240>the <00:19:35.415>opa, <00:19:35.590>uh, <00:19:35.765>in <00:19:35.940>the <00:19:36.115>OPA <00:19:36.290>regular <00:19:36.465>group.

370
00:19:38.265 --> 00:19:40.685
<00:19:38.265>So, <00:19:38.498>uh, <00:19:38.731>in <00:19:38.965>here <00:19:39.198>I'm <00:19:39.431>passing <00:19:39.665>method.

371
00:19:41.105 --> 00:19:43.965
<00:19:41.105>So <00:19:41.280>the <00:19:41.455>request <00:19:41.630>method <00:19:41.805>that <00:19:41.980>be <00:19:42.155>get <00:19:42.330>post <00:19:42.505>put

372
00:19:44.145 --> 00:19:45.485
<00:19:44.145>or <00:19:44.547>delete <00:19:44.948>or <00:19:45.351>whatever.

373
00:19:46.265 --> 00:19:50.885
<00:19:46.265>I'm <00:19:46.372>passing <00:19:46.480>the <00:19:46.588>path <00:19:46.695>as <00:19:46.803>a, <00:19:46.911>as <00:19:47.018>a, <00:19:47.126>as <00:19:47.234>an <00:19:47.341>array <00:19:47.449>of, <00:19:47.557>of, <00:19:47.665>uh,

374
00:19:51.075 --> 00:19:55.625
<00:19:51.075>strings <00:19:51.215>where, <00:19:51.355>uh, <00:19:51.495>it <00:19:51.635>has <00:19:51.775>been <00:19:51.915>divided <00:19:52.055>by, <00:19:52.195>uh, <00:19:52.335>the <00:19:52.475>lashes.

375
00:19:56.085 --> 00:19:58.905
<00:19:56.085>And <00:19:56.225>I'm <00:19:56.365>also <00:19:56.505>passing <00:19:56.645>the <00:19:56.785>user. <00:19:56.925>So <00:19:57.065>I'm <00:19:57.205>getting <00:19:57.345>the <00:19:57.485>user.

376
00:19:59.325 --> 00:20:02.065
<00:19:59.325>Uh, <00:19:59.500>if <00:19:59.675>the <00:19:59.850>authorization <00:20:00.025>error <00:20:00.200>does <00:20:00.375>not <00:20:00.550>exist, <00:20:00.725>uh,

377
00:20:02.065 --> 00:20:06.225
<00:20:02.065>then <00:20:02.205>the <00:20:02.345>user, <00:20:02.485>uh, <00:20:02.625>is <00:20:02.765>set <00:20:02.905>to, <00:20:03.045>to <00:20:03.185>nothing, <00:20:03.325>basically <00:20:03.465>the,

378
00:20:06.405 --> 00:20:08.985
<00:20:06.405>to <00:20:06.605>strength, <00:20:06.805>otherwise, <00:20:07.004>it <00:20:07.205>is <00:20:07.405>set <00:20:07.605>to, <00:20:07.805>uh,

379
00:20:09.405 --> 00:20:12.825
<00:20:09.405>to <00:20:09.560>basically <00:20:09.716>the <00:20:09.871>username <00:20:10.027>that <00:20:10.182>to <00:20:10.338>specify <00:20:10.493>during <00:20:10.649>the, <00:20:10.805>uh,

380
00:20:12.905 --> 00:20:14.185
<00:20:12.905>HTP <00:20:13.481>basic <00:20:14.057>authentication.

381
00:20:15.085 --> 00:20:19.525
<00:20:15.085>And <00:20:15.285>this <00:20:15.485>is <00:20:15.685>my, <00:20:15.885>um, <00:20:16.085>mar <00:20:16.285>rego <00:20:16.485>policy.

382
00:20:19.985 --> 00:20:24.485
<00:20:19.985>So <00:20:20.125>basically, <00:20:20.264>this <00:20:20.405>is <00:20:20.544>a <00:20:20.685>simple, <00:20:20.824>uh, <00:20:20.965>example <00:20:21.104>where <00:20:21.245>we, <00:20:21.385>uh,

383
00:20:25.255 --> 00:20:29.525
<00:20:25.255>where <00:20:25.410>we <00:20:25.566>do <00:20:25.721>define <00:20:25.877>who <00:20:26.032>can <00:20:26.188>access, <00:20:26.343>uh, <00:20:26.499>which <00:20:26.655>employees.

384
00:20:29.825 --> 00:20:31.285
<00:20:29.825>So, <00:20:30.153>uh, <00:20:30.482>in <00:20:30.810>this <00:20:31.139>case,

385
00:20:31.795 --> 00:20:34.765
<00:20:31.795>only <00:20:32.028>the <00:20:32.261>managers <00:20:32.495>can <00:20:32.728>access <00:20:32.961>other <00:20:33.195>employees

386
00:20:34.765 --> 00:20:38.165
<00:20:34.765>that <00:20:34.965>they <00:20:35.165>manage, <00:20:35.365>otherwise, <00:20:35.565>only <00:20:35.765>the <00:20:35.965>users <00:20:36.165>themselves,

387
00:20:38.165 --> 00:20:39.765
<00:20:38.165>only <00:20:38.445>the <00:20:38.725>employees <00:20:39.004>themselves <00:20:39.284>can <00:20:39.565>access,

388
00:20:40.025 --> 00:20:41.045
<00:20:40.025>uh, <00:20:40.331>their <00:20:40.637>own <00:20:40.943>profile.

389
00:20:41.625 --> 00:20:45.365
<00:20:41.625>So <00:20:41.765>in <00:20:41.905>this <00:20:42.045>case, <00:20:42.185>uh, <00:20:42.325>first, <00:20:42.465>uh, <00:20:42.605>we <00:20:42.745>allow <00:20:42.885>the <00:20:43.025>users

390
00:20:45.465 --> 00:20:46.685
<00:20:45.465>to <00:20:45.739>get <00:20:46.014>their <00:20:46.288>own <00:20:46.562>profiles.

391
00:20:47.065 --> 00:20:50.565
<00:20:47.065>So <00:20:47.265>we <00:20:47.465>define <00:20:47.665>username <00:20:47.865>as <00:20:48.065>a <00:20:48.265>unknown <00:20:48.465>variable,

392
00:20:50.985 --> 00:20:54.005
<00:20:50.985>and <00:20:51.112>we <00:20:51.239>use <00:20:51.366>it <00:20:51.494>to <00:20:51.621>match <00:20:51.748>it <00:20:51.875>with <00:20:52.003>the <00:20:52.130>input <00:20:52.257>user <00:20:52.385>input.

393
00:20:54.005 --> 00:20:55.405
<00:20:54.005>User <00:20:54.215>is <00:20:54.425>the <00:20:54.635>one <00:20:54.845>that <00:20:55.055>comes <00:20:55.264>from,

394
00:20:55.595 --> 00:20:56.805
<00:20:55.595>from <00:20:55.958>the <00:20:56.321>basic <00:20:56.684>authentication.

395
00:20:57.065 --> 00:21:00.645
<00:20:57.065>We <00:20:57.220>match <00:20:57.376>it <00:20:57.531>truly <00:20:57.687>with <00:20:57.842>the <00:20:57.998>username <00:20:58.153>variable <00:20:58.309>that <00:20:58.465>needs

396
00:21:00.645 --> 00:21:01.685
<00:21:00.645>to <00:21:00.879>be <00:21:01.113>in <00:21:01.347>the <00:21:01.581>path,

397
00:21:01.785 --> 00:21:05.805
<00:21:01.785>so <00:21:01.940>slash <00:21:02.096>api <00:21:02.251>slash <00:21:02.407>the <00:21:02.562>one <00:21:02.718>slash <00:21:02.873>employees <00:21:03.029>slash <00:21:03.185>username.

398
00:21:06.505 --> 00:21:10.365
<00:21:06.505>And <00:21:06.660>therefore, <00:21:06.816>this <00:21:06.971>basically <00:21:07.127>says <00:21:07.282>that, <00:21:07.438>uh, <00:21:07.593>the <00:21:07.749>users, <00:21:07.905>uh,

399
00:21:10.585 --> 00:21:11.885
<00:21:10.585>can <00:21:10.877>see <00:21:11.170>their <00:21:11.462>own <00:21:11.755>profile,

400
00:21:11.905 --> 00:21:15.965
<00:21:11.905>and <00:21:12.045>only <00:21:12.185>that, <00:21:12.325>then <00:21:12.465>we <00:21:12.605>can <00:21:12.745>also <00:21:12.885>match <00:21:13.024>it <00:21:13.165>against, <00:21:13.305>um,

401
00:21:16.465 --> 00:21:17.605
<00:21:16.465>the <00:21:16.978>manager <00:21:17.491>thing.

402
00:21:17.945 --> 00:21:21.525
<00:21:17.945>So <00:21:18.120>basically, <00:21:18.294>we <00:21:18.470>allow <00:21:18.645>managers <00:21:18.820>to <00:21:18.995>get <00:21:19.169>their <00:21:19.345>profiles,

403
00:21:22.025 --> 00:21:26.565
<00:21:22.025>and <00:21:22.180>basically <00:21:22.336>we <00:21:22.491>say <00:21:22.647>that, <00:21:22.802>uh, <00:21:22.958>this, <00:21:23.113>this, <00:21:23.269>this, <00:21:23.425>uh,

404
00:21:26.565 --> 00:21:28.165
<00:21:26.565>underscore <00:21:27.031>sign <00:21:27.498>says <00:21:27.965>Annie.

405
00:21:28.545 --> 00:21:33.005
<00:21:28.545>So, <00:21:28.745>uh, <00:21:28.945>if <00:21:29.145>the <00:21:29.345>user, <00:21:29.545>um, <00:21:29.745>is <00:21:29.945>managing

406
00:21:33.585 --> 00:21:37.205
<00:21:33.585>one <00:21:33.740>of <00:21:33.896>those, <00:21:34.051>uh, <00:21:34.207>one <00:21:34.362>of <00:21:34.518>those, <00:21:34.673>uh, <00:21:34.829>members, <00:21:34.985>then,

407
00:21:37.505 --> 00:21:39.605
<00:21:37.505>or <00:21:37.705>employees, <00:21:37.905>then <00:21:38.105>they <00:21:38.305>can <00:21:38.505>access <00:21:38.705>the <00:21:38.905>resource.

408
00:21:40.105 --> 00:21:42.325
<00:21:40.105>And <00:21:40.305>we <00:21:40.505>also <00:21:40.705>have <00:21:40.905>a <00:21:41.105>default, <00:21:41.305>uh, <00:21:41.505>rule.

409
00:21:42.505 --> 00:21:45.725
<00:21:42.505>Uh, <00:21:42.632>it <00:21:42.759>also <00:21:42.886>is <00:21:43.014>always <00:21:43.141>nice <00:21:43.268>to <00:21:43.395>have <00:21:43.523>to <00:21:43.650>a <00:21:43.777>default <00:21:43.905>rule

410
00:21:45.995 --> 00:21:49.165
<00:21:45.995>that <00:21:46.169>will <00:21:46.344>always <00:21:46.520>fall <00:21:46.695>back <00:21:46.870>to <00:21:47.044>force, <00:21:47.219>uh, <00:21:47.395>so

411
00:21:49.165 --> 00:21:51.005
<00:21:49.165>that <00:21:49.398>you <00:21:49.631>do <00:21:49.865>not <00:21:50.098>get, <00:21:50.331>uh, <00:21:50.565>uh,

412
00:21:51.405 --> 00:21:54.125
<00:21:51.405>a <00:21:51.545>problem <00:21:51.685>when <00:21:51.825>you <00:21:51.965>brought <00:21:52.105>a <00:21:52.245>policy <00:21:52.385>in <00:21:52.524>the <00:21:52.665>wrong <00:21:52.805>way.

413
00:21:54.125 --> 00:21:57.885
<00:21:54.125>You <00:21:54.280>do <00:21:54.436>not <00:21:54.591>get, <00:21:54.747>uh, <00:21:54.902>like <00:21:55.058>in <00:21:55.213>this <00:21:55.369>sideways <00:21:55.525>possibilities

414
00:21:57.905 --> 00:22:00.605
<00:21:57.905>to <00:21:58.105>get, <00:21:58.305>uh, <00:21:58.504>through <00:21:58.705>the <00:21:58.905>certification <00:21:59.105>me, <00:21:59.305>uh,

415
00:22:00.605 --> 00:22:01.845
<00:22:00.605>authorization <00:22:01.721>mechanism.

416
00:22:03.345 --> 00:22:06.445
<00:22:03.345>And <00:22:03.520>this <00:22:03.695>simple <00:22:03.870>going <00:22:04.045>application <00:22:04.220>will <00:22:04.395>listen <00:22:04.570>on, <00:22:04.745>on,

417
00:22:07.675 --> 00:22:08.725
<00:22:07.675>it's <00:22:07.911>basically <00:22:08.147>a <00:22:08.383>web <00:22:08.620>server.

418
00:22:08.785 --> 00:22:12.525
<00:22:08.785>So <00:22:08.960>we'll <00:22:09.135>switch <00:22:09.310>to <00:22:09.485>the <00:22:09.660>auto <00:22:09.835>window <00:22:10.010>real <00:22:10.185>quick.

419
00:22:13.745 --> 00:22:18.395
<00:22:13.745>And <00:22:13.945>I'm <00:22:14.145>in <00:22:14.344>this <00:22:14.544>window, <00:22:14.745>I'm <00:22:14.945>running, <00:22:15.145>okay,

420
00:22:18.775 --> 00:22:21.755
<00:22:18.775>in <00:22:18.930>this <00:22:19.086>window, <00:22:19.241>I'm <00:22:19.397>running <00:22:19.552>OPA <00:22:19.708>as <00:22:19.863>a <00:22:20.019>docker <00:22:20.175>container.

421
00:22:22.975 --> 00:22:26.795
<00:22:22.975>Uh, <00:22:23.115>so, <00:22:23.254>uh, <00:22:23.395>this, <00:22:23.534>this <00:22:23.675>code <00:22:23.814>is <00:22:23.955>on, <00:22:24.094>on <00:22:24.235>GitHub, <00:22:24.375>uh,

422
00:22:26.815 --> 00:22:30.595
<00:22:26.815>github.com/swisscom/opa <00:22:28.215>demo.

423
00:22:31.095 --> 00:22:32.115
<00:22:31.095>Uh, <00:22:31.278>you <00:22:31.462>can <00:22:31.645>look <00:22:31.829>it <00:22:32.013>up.

424
00:22:32.455 --> 00:22:35.635
<00:22:32.455>Uh, <00:22:32.595>basically <00:22:32.735>I'm <00:22:32.875>in <00:22:33.014>the <00:22:33.155>demo <00:22:33.294>folder <00:22:33.435>and <00:22:33.574>I'm <00:22:33.715>running <00:22:33.855>opa.

425
00:22:35.815 --> 00:22:39.355
<00:22:35.815>So <00:22:35.931>first <00:22:36.048>thing <00:22:36.165>that <00:22:36.281>you <00:22:36.398>need <00:22:36.515>to <00:22:36.631>do <00:22:36.748>when <00:22:36.865>you <00:22:36.981>run <00:22:37.098>OPA <00:22:37.215>is

426
00:22:39.435 --> 00:22:40.475
<00:22:39.435>to <00:22:39.746>load <00:22:40.059>the <00:22:40.370>policies.

427
00:22:40.695 --> 00:22:43.755
<00:22:40.695>Uh, <00:22:40.895>by <00:22:41.095>default, <00:22:41.294>those <00:22:41.495>policies <00:22:41.695>are <00:22:41.895>not <00:22:42.095>loaded.

428
00:22:44.335 --> 00:22:47.395
<00:22:44.335>Uh, <00:22:44.615>you <00:22:44.895>need <00:22:45.175>to, <00:22:45.455>uh, <00:22:45.735>put,

429
00:22:48.815 --> 00:22:51.995
<00:22:48.815>so <00:22:48.942>we <00:22:49.069>have <00:22:49.196>the <00:22:49.324>example <00:22:49.451>dot <00:22:49.578>rego <00:22:49.705>file <00:22:49.833>here <00:22:49.960>that <00:22:50.087>we've <00:22:50.215>seen

430
00:22:51.995 --> 00:22:52.995
<00:22:51.995>before <00:22:52.294>in <00:22:52.594>the <00:22:52.895>IDE,

431
00:22:53.415 --> 00:22:57.915
<00:22:53.415>and <00:22:53.570>we're <00:22:53.726>going <00:22:53.881>to <00:22:54.037>upload <00:22:54.192>it <00:22:54.348>to, <00:22:54.503>uh, <00:22:54.659>to <00:22:54.815>OPA

432
00:22:58.335 --> 00:22:59.955
<00:22:58.335>by <00:22:58.615>simply <00:22:58.895>doing <00:22:59.175>a <00:22:59.455>put <00:22:59.735>request.

433
00:23:00.455 --> 00:23:03.315
<00:23:00.455>Uh, <00:23:00.629>this <00:23:00.804>is <00:23:00.980>the <00:23:01.155>most <00:23:01.330>insecure <00:23:01.504>configuration <00:23:01.679>right <00:23:01.855>now,

434
00:23:03.315 --> 00:23:04.915
<00:23:03.315>but <00:23:03.595>it's <00:23:03.875>very <00:23:04.155>useful <00:23:04.435>for <00:23:04.715>development.

435
00:23:05.335 --> 00:23:08.595
<00:23:05.335>So, <00:23:05.535>uh, <00:23:05.735>if <00:23:05.935>you <00:23:06.135>wanted <00:23:06.335>to <00:23:06.535>implement <00:23:06.735>opa,

436
00:23:08.825 --> 00:23:11.635
<00:23:08.825>just <00:23:09.000>simply <00:23:09.175>look <00:23:09.350>at <00:23:09.525>the <00:23:09.700>documentation, <00:23:09.875>how <00:23:10.050>to <00:23:10.225>security,

437
00:23:11.635 --> 00:23:14.515
<00:23:11.635>because <00:23:11.835>by <00:23:12.035>default, <00:23:12.235>uh, <00:23:12.435>it <00:23:12.635>is <00:23:12.835>pretty <00:23:13.035>open.

438
00:23:14.695 --> 00:23:17.995
<00:23:14.695>So <00:23:14.850>it's <00:23:15.006>better <00:23:15.161>to, <00:23:15.317>to <00:23:15.472>keep <00:23:15.628>it, <00:23:15.783>uh, <00:23:15.939>more <00:23:16.095>secure.

439
00:23:18.255 --> 00:23:19.475
<00:23:18.255>So <00:23:18.529>I'm <00:23:18.804>uploading <00:23:19.078>a <00:23:19.352>policy,

440
00:23:19.855 --> 00:23:21.155
<00:23:19.855>and <00:23:20.022>on <00:23:20.189>the <00:23:20.356>left <00:23:20.523>side, <00:23:20.690>you <00:23:20.857>can <00:23:21.025>see

441
00:23:21.155 --> 00:23:22.555
<00:23:21.155>that <00:23:21.407>the <00:23:21.659>policy <00:23:21.911>has <00:23:22.163>been <00:23:22.415>put.

442
00:23:22.655 --> 00:23:27.435
<00:23:22.655>And <00:23:22.795>when <00:23:22.935>the <00:23:23.075>policy <00:23:23.215>is <00:23:23.355>put, <00:23:23.495>then, <00:23:23.635>uh, <00:23:23.774>a <00:23:23.915>a <00:23:24.055>200,

443
00:23:28.015 --> 00:23:30.475
<00:23:28.015>um, <00:23:28.248>status <00:23:28.481>cost <00:23:28.715>would <00:23:28.948>be <00:23:29.181>returned, <00:23:29.415>and,

444
00:23:30.735 --> 00:23:33.115
<00:23:30.735>and <00:23:30.968>this <00:23:31.201>empty, <00:23:31.435>uh, <00:23:31.668>object <00:23:31.901>would <00:23:32.135>be,

445
00:23:33.365 --> 00:23:35.795
<00:23:33.365>would <00:23:33.565>be <00:23:33.765>put <00:23:33.965>in <00:23:34.165>the, <00:23:34.365>in <00:23:34.565>the <00:23:34.765>response.

446
00:23:36.215 --> 00:23:38.515
<00:23:36.215>Now <00:23:36.342>the <00:23:36.469>policy <00:23:36.596>has <00:23:36.724>been <00:23:36.851>loaded <00:23:36.978>and <00:23:37.105>we <00:23:37.233>can <00:23:37.360>try <00:23:37.487>it <00:23:37.615>out.

447
00:23:38.975 --> 00:23:42.595
<00:23:38.975>So <00:23:39.149>I'm <00:23:39.324>logging <00:23:39.500>in <00:23:39.675>as <00:23:39.850>Alice <00:23:40.024>column <00:23:40.199>password, <00:23:40.375>uh,

448
00:23:42.955 --> 00:23:46.565
<00:23:42.955>password <00:23:43.110>is <00:23:43.266>password, <00:23:43.421>and <00:23:43.577>I'm <00:23:43.732>trying <00:23:43.888>to <00:23:44.043>get <00:23:44.199>Bob's, <00:23:44.355>uh,

449
00:23:47.315 --> 00:23:49.685
<00:23:47.315>profile, <00:23:47.548>and <00:23:47.781>hopefully <00:23:48.015>if <00:23:48.248>the <00:23:48.481>Democrats <00:23:48.715>are

450
00:23:49.685 --> 00:23:51.365
<00:23:49.685>with <00:23:50.034>me, <00:23:50.385>this <00:23:50.735>should <00:23:51.085>work.

451
00:23:51.705 --> 00:23:53.365
<00:23:51.705>You <00:23:51.905>do <00:23:52.105>not <00:23:52.304>have <00:23:52.504>access <00:23:52.705>to <00:23:52.905>this <00:23:53.105>resource.

452
00:23:53.505 --> 00:23:56.565
<00:23:53.505>On <00:23:53.632>the <00:23:53.759>bottom <00:23:53.886>side, <00:23:54.014>you <00:23:54.141>can <00:23:54.268>see <00:23:54.395>that, <00:23:54.523>uh, <00:23:54.650>the <00:23:54.777>policy <00:23:54.905>request

453
00:23:56.755 --> 00:23:58.445
<00:23:56.755>that <00:23:56.988>was <00:23:57.221>made, <00:23:57.455>what <00:23:57.688>is <00:23:57.921>the <00:23:58.155>following?

454
00:23:58.505 --> 00:24:00.685
<00:23:58.505>So, <00:23:58.738>uh, <00:23:58.971>basically <00:23:59.205>the <00:23:59.438>matter <00:23:59.671>is <00:23:59.905>gad.

455
00:24:01.065 --> 00:24:03.925
<00:24:01.065>The <00:24:01.265>path <00:24:01.465>is <00:24:01.665>a <00:24:01.865>PIV <00:24:02.065>one <00:24:02.265>employees, <00:24:02.465>Bob,

456
00:24:04.425 --> 00:24:06.485
<00:24:04.425>and <00:24:04.625>the <00:24:04.825>user <00:24:05.024>that <00:24:05.225>is <00:24:05.425>making <00:24:05.625>request <00:24:05.825>service.

457
00:24:06.905 --> 00:24:10.475
<00:24:06.905>So <00:24:07.045>if <00:24:07.185>we <00:24:07.325>switch <00:24:07.465>back <00:24:07.605>to <00:24:07.745>Bob, <00:24:07.885>as <00:24:08.024>we <00:24:08.165>said, <00:24:08.305>uh,

458
00:24:10.565 --> 00:24:12.995
<00:24:10.565>users <00:24:10.845>can <00:24:11.125>access <00:24:11.405>their <00:24:11.685>own <00:24:11.965>profiles.

459
00:24:13.055 --> 00:24:15.755
<00:24:13.055>So <00:24:13.230>Bob <00:24:13.405>is <00:24:13.580>able <00:24:13.755>to <00:24:13.930>get <00:24:14.105>his <00:24:14.280>own <00:24:14.455>profile.

460
00:24:16.055 --> 00:24:19.275
<00:24:16.055>Now <00:24:16.195>it's <00:24:16.335>just <00:24:16.475>a <00:24:16.615>dummy, <00:24:16.755>uh, <00:24:16.895>a <00:24:17.035>PR <00:24:17.175>that <00:24:17.315>is <00:24:17.455>returning.

461
00:24:19.735 --> 00:24:24.035
<00:24:19.735>What's <00:24:19.862>your <00:24:19.989>passing? <00:24:20.116>But, <00:24:20.244>uh, <00:24:20.371>you <00:24:20.498>get <00:24:20.625>the <00:24:20.753>sense <00:24:20.880>of, <00:24:21.007>of, <00:24:21.135>uh,

462
00:24:24.215 --> 00:24:25.795
<00:24:24.215>of <00:24:24.564>the <00:24:24.915>error <00:24:25.264>is <00:24:25.615>just

463
00:24:25.795 --> 00:24:27.995
<00:24:25.795>to <00:24:25.950>see <00:24:26.106>whether <00:24:26.261>the <00:24:26.417>request <00:24:26.572>is <00:24:26.728>going <00:24:26.883>true <00:24:27.039>or <00:24:27.195>not.

464
00:24:29.215 --> 00:24:32.755
<00:24:29.215>Now, <00:24:29.342>we <00:24:29.469>said <00:24:29.596>that <00:24:29.724>Bob <00:24:29.851>is <00:24:29.978>a <00:24:30.105>manager <00:24:30.233>of <00:24:30.360>Alice, <00:24:30.487>so, <00:24:30.615>uh,

465
00:24:32.855 --> 00:24:34.995
<00:24:32.855>Bob <00:24:33.055>should <00:24:33.255>be <00:24:33.455>able <00:24:33.655>with <00:24:33.855>his <00:24:34.055>own <00:24:34.255>credentials

466
00:24:35.015 --> 00:24:39.155
<00:24:35.015>to <00:24:35.248>access <00:24:35.481>Alice's <00:24:35.715>profile, <00:24:35.948>and <00:24:36.181>he <00:24:36.415>does.

467
00:24:40.255 --> 00:24:42.395
<00:24:40.255>Now, <00:24:40.488>let's <00:24:40.721>say <00:24:40.955>that <00:24:41.188>your <00:24:41.421>business, <00:24:41.655>uh,

468
00:24:42.435 --> 00:24:43.715
<00:24:42.435>requirements <00:24:43.011>are <00:24:43.587>changed,

469
00:24:44.095 --> 00:24:47.655
<00:24:44.095>and <00:24:44.445>now <00:24:44.795>managers <00:24:45.145>cannot <00:24:45.495>access,

470
00:24:48.395 --> 00:24:49.895
<00:24:48.395>cannot <00:24:49.070>access <00:24:49.745>anymore.

471
00:24:50.435 --> 00:24:55.025
<00:24:50.435>Um, <00:24:50.901>their <00:24:51.368>oops, <00:24:51.835>uh,

472
00:24:55.025 --> 00:24:58.305
<00:24:55.025>cannot <00:24:55.305>access <00:24:55.585>anymore <00:24:55.865>their <00:24:56.145>subordinate <00:24:56.425>profiles.

473
00:24:58.765 --> 00:25:03.745
<00:24:58.765>So <00:24:58.965>we <00:24:59.165>can <00:24:59.365>just <00:24:59.565>comment <00:24:59.765>this <00:24:59.965>out. <00:25:00.165>Oops.

474
00:25:06.235 --> 00:25:10.305
<00:25:06.235>We <00:25:06.375>need <00:25:06.514>to <00:25:06.655>repu <00:25:06.794>the <00:25:06.935>policy <00:25:07.074>again, <00:25:07.215>and <00:25:07.354>not <00:25:07.495>on <00:25:07.635>that.

475
00:25:10.325 --> 00:25:13.145
<00:25:10.325>On <00:25:10.480>the <00:25:10.636>bottom <00:25:10.791>that <00:25:10.947>we <00:25:11.102>have <00:25:11.258>our, <00:25:11.413>uh, <00:25:11.569>our <00:25:11.725>binary

476
00:25:13.205 --> 00:25:14.385
<00:25:13.205>or <00:25:13.470>goal <00:25:13.735>line <00:25:14.001>application <00:25:14.267>running,

477
00:25:14.925 --> 00:25:16.625
<00:25:14.925>we <00:25:15.158>are <00:25:15.391>not <00:25:15.625>changing <00:25:15.858>anything <00:25:16.091>at <00:25:16.325>all.

478
00:25:16.845 --> 00:25:21.065
<00:25:16.845>So <00:25:16.972>if <00:25:17.099>we <00:25:17.226>redo <00:25:17.354>the <00:25:17.481>request <00:25:17.608>as <00:25:17.735>Bob <00:25:17.863>to <00:25:17.990>get <00:25:18.117>Alice's <00:25:18.245>profile,

479
00:25:21.645 --> 00:25:23.945
<00:25:21.645>we <00:25:21.785>should <00:25:21.925>get, <00:25:22.065>you <00:25:22.205>do <00:25:22.345>not <00:25:22.485>have <00:25:22.625>access <00:25:22.764>to <00:25:22.905>this <00:25:23.045>resource,

480
00:25:24.525 --> 00:25:27.425
<00:25:24.525>and <00:25:24.700>this <00:25:24.875>can <00:25:25.050>be <00:25:25.225>extended <00:25:25.400>to <00:25:25.575>have <00:25:25.750>multiple <00:25:25.925>policies.

481
00:25:27.765 --> 00:25:30.465
<00:25:27.765>You <00:25:27.998>can <00:25:28.231>return, <00:25:28.465>um, <00:25:28.698>multiple <00:25:28.931>things, <00:25:29.165>uh,

482
00:25:30.525 --> 00:25:33.625
<00:25:30.525>not <00:25:30.680>only <00:25:30.836>in <00:25:30.991>this <00:25:31.147>case, <00:25:31.302>allow <00:25:31.458>or, <00:25:31.613>or <00:25:31.769>not <00:25:31.925>allow.

483
00:25:34.125 --> 00:25:38.425
<00:25:34.125>And <00:25:34.252>you <00:25:34.379>can <00:25:34.506>extend <00:25:34.634>this <00:25:34.761>to <00:25:34.888>have <00:25:35.015>within <00:25:35.143>your <00:25:35.270>company <00:25:35.397>as <00:25:35.525>many,

484
00:25:38.725 --> 00:25:42.145
<00:25:38.725>uh, <00:25:38.925>as <00:25:39.125>many <00:25:39.324>authorization <00:25:39.524>layers <00:25:39.725>as <00:25:39.925>you <00:25:40.125>want.

485
00:25:42.685 --> 00:25:46.225
<00:25:42.685>Uh, <00:25:42.825>in <00:25:42.965>this <00:25:43.105>example, <00:25:43.245>I <00:25:43.385>am <00:25:43.524>posting <00:25:43.665>the <00:25:43.804>exact <00:25:43.945>same <00:25:44.085>thing

486
00:25:46.285 --> 00:25:48.745
<00:25:46.285>as <00:25:46.485>Jsm <00:25:46.685>to <00:25:46.885>see <00:25:47.085>what <00:25:47.285>is <00:25:47.485>being <00:25:47.685>returned.

487
00:25:49.125 --> 00:25:50.745
<00:25:49.125>So <00:25:49.475>basically <00:25:49.825>when <00:25:50.175>you <00:25:50.525>connect,

488
00:25:51.025 --> 00:25:53.345
<00:25:51.025>rego <00:25:51.200>is <00:25:51.375>the <00:25:51.550>API <00:25:51.725>slash <00:25:51.900>V <00:25:52.075>one <00:25:52.250>slash <00:25:52.425>data,

489
00:25:53.575 --> 00:25:55.825
<00:25:53.575>then <00:25:53.808>you <00:25:54.041>have <00:25:54.275>the <00:25:54.508>package <00:25:54.741>name, <00:25:54.975>uh,

490
00:25:56.285 --> 00:25:59.145
<00:25:56.285>and <00:25:56.518>then <00:25:56.751>you <00:25:56.985>can <00:25:57.218>restrict <00:25:57.451>the <00:25:57.685>result

491
00:25:59.405 --> 00:26:01.705
<00:25:59.405>to <00:25:59.685>only <00:25:59.965>show <00:26:00.245>the <00:26:00.524>allow <00:26:00.805>variable.

492
00:26:01.885 --> 00:26:05.505
<00:26:01.885>So <00:26:02.025>this <00:26:02.165>will <00:26:02.305>basically <00:26:02.445>say, <00:26:02.585>uh, <00:26:02.725>return <00:26:02.865>the <00:26:03.004>exact <00:26:03.145>same <00:26:03.285>thing

493
00:26:05.535 --> 00:26:09.065
<00:26:05.535>with <00:26:05.690>the <00:26:05.846>decision <00:26:06.001>id, <00:26:06.157>decision <00:26:06.312>id, <00:26:06.468>uh, <00:26:06.623>is <00:26:06.779>actually <00:26:06.935>logged.

494
00:26:09.245 --> 00:26:11.665
<00:26:09.245>So <00:26:09.419>you <00:26:09.594>have <00:26:09.770>this <00:26:09.945>kind <00:26:10.120>of, <00:26:10.294>uh, <00:26:10.469>auditing <00:26:10.645>logs

495
00:26:11.665 --> 00:26:14.745
<00:26:11.665>as <00:26:11.945>well <00:26:12.225>in <00:26:12.504>and <00:26:12.784>the <00:26:13.065>result.

496
00:26:15.205 --> 00:26:17.745
<00:26:15.205>But <00:26:15.360>if <00:26:15.516>we <00:26:15.671>do <00:26:15.827>not <00:26:15.982>want <00:26:16.138>to <00:26:16.293>just <00:26:16.449>limit, <00:26:16.605>oops,

497
00:26:18.255 --> 00:26:20.425
<00:26:18.255>just <00:26:18.605>limit <00:26:18.955>ourselves <00:26:19.305>to, <00:26:19.655>uh,

498
00:26:22.575 --> 00:26:26.035
<00:26:22.575>to <00:26:22.715>the <00:26:22.855>allow <00:26:22.995>variable, <00:26:23.135>we <00:26:23.275>can <00:26:23.415>see <00:26:23.555>everything <00:26:23.695>that <00:26:23.835>is <00:26:23.975>being

499
00:26:26.875 --> 00:26:29.835
<00:26:26.875>actually, <00:26:27.155>oops, <00:26:27.435>that <00:26:27.715>is <00:26:27.995>being <00:26:28.275>evaluated.

500
00:26:30.015 --> 00:26:32.475
<00:26:30.015>So <00:26:30.190>we <00:26:30.365>have <00:26:30.540>the <00:26:30.715>decision <00:26:30.890>ideas <00:26:31.065>before <00:26:31.240>we <00:26:31.415>result.

501
00:26:32.475 --> 00:26:34.555
<00:26:32.475>We <00:26:32.754>contain, <00:26:33.034>allow, <00:26:33.314>as <00:26:33.594>I <00:26:33.875>said,

502
00:26:35.135 --> 00:26:37.635
<00:26:35.135>and <00:26:35.290>we <00:26:35.446>also <00:26:35.601>return <00:26:35.757>this <00:26:35.912>variable <00:26:36.068>that <00:26:36.223>we <00:26:36.379>defined <00:26:36.535>before.

503
00:26:37.775 --> 00:26:41.195
<00:26:37.775>So, <00:26:38.008>uh, <00:26:38.241>one <00:26:38.475>can <00:26:38.708>also, <00:26:38.941>uh, <00:26:39.175>decide

504
00:26:42.255 --> 00:26:44.655
<00:26:42.255>to <00:26:42.605>return <00:26:42.955>something <00:26:43.305>like, <00:26:43.655>uh,

505
00:26:46.035 --> 00:26:50.735
<00:26:46.035>is <00:26:46.268>accessing <00:26:46.501>on, <00:26:46.735>uh, <00:26:46.968>is <00:26:47.201>accessing <00:26:47.435>profile

506
00:26:52.865 --> 00:26:54.795
<00:26:52.865>just <00:26:53.215>as <00:26:53.565>a <00:26:53.915>dummy <00:26:54.265>example,

507
00:26:55.745 --> 00:27:00.155
<00:26:55.745>or <00:26:56.024>actually, <00:26:56.304>uh, <00:26:56.584>it <00:26:56.864>should <00:26:57.145>work.

508
00:27:01.435 --> 00:27:06.115
<00:27:01.435>I <00:27:02.135>It <00:27:02.835>should

509
00:27:06.115 --> 00:27:07.955
<00:27:06.115>return <00:27:06.465>that <00:27:06.815>variable <00:27:07.165>as <00:27:07.515>well.

510
00:27:08.255 --> 00:27:10.595
<00:27:08.255>Uh, <00:27:08.721>lemme <00:27:09.188>upload <00:27:09.655>it.

511
00:27:16.195 --> 00:27:19.375
<00:27:16.195>My <00:27:16.370>bad. <00:27:16.544>It <00:27:16.720>should <00:27:16.895>return, <00:27:17.070>you <00:27:17.245>can <00:27:17.419>return, <00:27:17.595>uh,

512
00:27:19.635 --> 00:27:20.975
<00:27:19.635>as <00:27:19.876>much <00:27:20.117>as <00:27:20.358>you <00:27:20.599>want, <00:27:20.841>basically.

513
00:27:21.235 --> 00:27:24.935
<00:27:21.235>Uh, <00:27:21.362>you're <00:27:21.489>not <00:27:21.616>limited <00:27:21.744>to <00:27:21.871>simply <00:27:21.998>the <00:27:22.125>allow, <00:27:22.253>uh, <00:27:22.380>to, <00:27:22.507>or <00:27:22.635>four.

514
00:27:24.955 --> 00:27:28.175
<00:27:24.955>So <00:27:25.071>you <00:27:25.188>can, <00:27:25.304>you <00:27:25.421>can <00:27:25.538>extend <00:27:25.655>this, <00:27:25.771>uh, <00:27:25.888>as <00:27:26.004>much <00:27:26.121>as <00:27:26.238>you <00:27:26.355>want.

515
00:27:29.955 --> 00:27:34.175
<00:27:29.955>And <00:27:30.110>if <00:27:30.266>you <00:27:30.421>fancy, <00:27:30.577>uh, <00:27:30.732>let's <00:27:30.888>try <00:27:31.043>to <00:27:31.199>switch <00:27:31.355>to

516
00:27:36.675 --> 00:27:40.055
<00:27:36.675>in, <00:27:37.024>in, <00:27:37.375>in, <00:27:37.725>in <00:27:38.075>chromium.

517
00:27:40.105 --> 00:27:44.375
<00:27:40.105>Let's <00:27:40.338>see. <00:27:40.571>Sorry, <00:27:40.805>I <00:27:41.038>didn't <00:27:41.271>prepare <00:27:41.505>myself

518
00:27:44.375 --> 00:27:46.695
<00:27:44.375>for <00:27:44.725>sharing <00:27:45.075>the <00:27:45.425>chrome <00:27:45.775>window.

519
00:27:46.945 --> 00:27:47.535
<00:27:46.945>Let's <00:27:47.476>try.

520
00:27:51.935 --> 00:27:56.375
<00:27:51.935>Okay. <00:27:52.635>No, <00:27:53.335>Okay.

521
00:27:56.375 --> 00:27:58.695
<00:27:56.375>Regular <00:27:56.841>playground. <00:27:57.308>So, <00:27:57.775>uh,

522
00:27:58.835 --> 00:28:01.655
<00:27:58.835>you <00:27:58.990>can <00:27:59.146>have <00:27:59.301>also <00:27:59.457>these <00:27:59.612>regular <00:27:59.768>playground <00:27:59.923>as <00:28:00.079>well, <00:28:00.235>uh,

523
00:28:01.655 --> 00:28:05.135
<00:28:01.655>where <00:28:01.782>you <00:28:01.909>can <00:28:02.036>see, <00:28:02.164>uh, <00:28:02.291>the <00:28:02.418>exact <00:28:02.545>same <00:28:02.673>thing <00:28:02.800>you <00:28:02.927>can <00:28:03.055>play

524
00:28:05.135 --> 00:28:07.055
<00:28:05.135>around <00:28:05.415>with, <00:28:05.695>uh, <00:28:05.975>with <00:28:06.254>the <00:28:06.535>policies.

525
00:28:07.235 --> 00:28:09.615
<00:28:07.235>In <00:28:07.390>this <00:28:07.546>case, <00:28:07.701>I <00:28:07.857>just <00:28:08.012>pasted <00:28:08.168>the <00:28:08.323>exact <00:28:08.479>same <00:28:08.635>policy.

526
00:28:09.995 --> 00:28:11.495
<00:28:09.995>You <00:28:10.219>can <00:28:10.445>play <00:28:10.669>around <00:28:10.895>with <00:28:11.120>the <00:28:11.344>policies

527
00:28:11.835 --> 00:28:15.055
<00:28:11.835>and <00:28:11.990>see <00:28:12.146>the <00:28:12.301>results <00:28:12.457>without <00:28:12.612>having <00:28:12.768>actually <00:28:12.923>to <00:28:13.079>download <00:28:13.235>the,

528
00:28:15.115 --> 00:28:19.415
<00:28:15.115>uh, <00:28:15.270>the <00:28:15.426>OPA <00:28:15.581>binary <00:28:15.737>or, <00:28:15.892>or <00:28:16.048>the <00:28:16.203>opa, <00:28:16.359>uh, <00:28:16.515>container.

529
00:28:19.995 --> 00:28:21.295
<00:28:19.995>So <00:28:20.189>you <00:28:20.385>can <00:28:20.580>tweak <00:28:20.775>around <00:28:20.970>and, <00:28:21.165>and,

530
00:28:21.475 --> 00:28:23.575
<00:28:21.475>and <00:28:21.649>play <00:28:21.824>around <00:28:22.000>with <00:28:22.175>the, <00:28:22.350>with <00:28:22.524>the <00:28:22.699>policies <00:28:22.875>here,

531
00:28:24.315 --> 00:28:28.455
<00:28:24.315>and <00:28:24.455>do <00:28:24.595>exactly <00:28:24.735>the <00:28:24.875>same <00:28:25.015>thing <00:28:25.155>as <00:28:25.295>we <00:28:25.435>did <00:28:25.575>before <00:28:25.715>evaluating.

532
00:28:30.495 --> 00:28:34.195
<00:28:30.495>Okay, <00:28:30.844>this <00:28:31.195>is <00:28:31.544>strange, <00:28:31.895>uh,

533
00:28:34.205 --> 00:28:35.595
<00:28:34.205>evaluating <00:28:34.517>the <00:28:34.830>things <00:28:35.143>as <00:28:35.456>well.

534
00:28:39.645 --> 00:28:43.625
<00:28:39.645>All <00:28:39.785>right, <00:28:39.925>so <00:28:40.065>just <00:28:40.205>to <00:28:40.345>go <00:28:40.485>back <00:28:40.625>to <00:28:40.764>sharing <00:28:40.905>my <00:28:41.045>screen,

535
00:28:47.115 --> 00:28:50.035
<00:28:47.115>Uh, <00:28:47.315>yeah, <00:28:47.515>Are <00:28:47.715>you <00:28:47.915>able <00:28:48.115>to <00:28:48.315>share <00:28:48.515>because,

536
00:28:50.695 --> 00:28:51.695
Yes.

537
00:28:54.135 --> 00:28:56.035
<00:28:54.135>So, <00:28:55.535>okay.

538
00:28:56.535 --> 00:28:59.155
<00:28:56.535>Now <00:28:56.675>I <00:28:56.815>believe <00:28:56.955>that <00:28:57.095>people <00:28:57.235>should <00:28:57.375>be <00:28:57.515>seeing <00:28:57.655>my <00:28:57.795>screen <00:28:57.935>now.

539
00:29:01.685 --> 00:29:04.595
<00:29:01.685>Uh, <00:29:01.885>we <00:29:02.085>can <00:29:02.284>see <00:29:02.485>your <00:29:02.685>screen <00:29:02.885>now. <00:29:03.085>Okay.

540
00:29:05.895 --> 00:29:09.275
<00:29:05.895>So, <00:29:06.070>uh, <00:29:06.245>OPA <00:29:06.420>is <00:29:06.595>not <00:29:06.770>only <00:29:06.945>for <00:29:07.120>web <00:29:07.295>apps.

541
00:29:09.855 --> 00:29:14.755
<00:29:09.855>Uh, <00:29:10.010>we <00:29:10.166>have, <00:29:10.321>uh, <00:29:10.477>there <00:29:10.632>are, <00:29:10.788>it's <00:29:10.943>available, <00:29:11.099>uh, <00:29:11.255>adapters

542
00:29:14.755 --> 00:29:17.995
<00:29:14.755>for <00:29:14.930>other <00:29:15.105>technologies <00:29:15.280>as <00:29:15.455>well, <00:29:15.630>such <00:29:15.805>as <00:29:15.980>Kubernetes, <00:29:16.155>symbol

543
00:29:18.925 --> 00:29:20.595
<00:29:18.925>Kafka, <00:29:19.205>uh, <00:29:19.485>and, <00:29:19.764>and <00:29:20.044>many <00:29:20.325>more.

544
00:29:20.875 --> 00:29:22.995
<00:29:20.875>Actually, <00:29:21.030>they <00:29:21.186>don't <00:29:21.341>fit <00:29:21.497>in <00:29:21.652>this <00:29:21.808>line, <00:29:21.963>so <00:29:22.119>I <00:29:22.275>have

545
00:29:23.015 --> 00:29:25.115
<00:29:23.015>to <00:29:23.295>just <00:29:23.575>pick <00:29:23.855>the <00:29:24.135>top <00:29:24.415>ones.

546
00:29:26.855 --> 00:29:30.955
<00:29:26.855>Uh, <00:29:27.010>we <00:29:27.166>have <00:29:27.321>one, <00:29:27.477>uh, <00:29:27.632>quick <00:29:27.788>example <00:29:27.943>here, <00:29:28.099>uh, <00:29:28.255>on

547
00:29:30.975 --> 00:29:33.675
<00:29:30.975>how <00:29:31.149>it <00:29:31.324>could, <00:29:31.500>uh, <00:29:31.675>work, <00:29:31.850>for <00:29:32.024>example, <00:29:32.199>for <00:29:32.375>Linux,

548
00:29:33.695 --> 00:29:35.435
<00:29:33.695>uh, <00:29:34.395>uh, <00:29:35.095>module.

549
00:29:36.255 --> 00:29:39.315
<00:29:36.255>So <00:29:36.455>yeah, <00:29:36.655>can <00:29:36.855>talk <00:29:37.055>a <00:29:37.255>bit <00:29:37.455>more. <00:29:37.655>Yeah,

550
00:29:39.315 --> 00:29:41.085
<00:29:39.315>Basically, <00:29:39.595>I'm <00:29:39.875>not, <00:29:40.155>I'm <00:29:40.435>sorry, <00:29:40.715>sorry,

551
00:29:41.085 --> 00:29:42.245
<00:29:41.085>but <00:29:41.433>I'm <00:29:41.781>still <00:29:42.129>seeing

552
00:29:42.245 --> 00:29:44.005
<00:29:42.245>that <00:29:42.445>I'm <00:29:42.645>sharing <00:29:42.844>my <00:29:43.044>screen <00:29:43.245>for <00:29:43.445>some <00:29:43.645>reason.

553
00:29:44.115 --> 00:29:47.365
<00:29:44.115>Okay. <00:29:44.395>Uh, <00:29:44.675>maybe <00:29:44.955>it's <00:29:45.235>a <00:29:45.515>pin

554
00:29:47.385 --> 00:29:51.445
<00:29:47.385>or <00:29:47.585>maybe <00:29:47.785>I'm <00:29:47.985>not <00:29:48.185>sure <00:29:48.385>it, <00:29:48.585>it's <00:29:48.785>okay.

555
00:29:51.625 --> 00:29:52.625
<00:29:51.625>In, <00:29:52.075>in, <00:29:52.525>uh,

556
00:29:54.195 --> 00:29:56.365
<00:29:54.195>Yeah, <00:29:54.395>basically <00:29:54.595>in <00:29:54.794>a <00:29:54.995>nutshell, <00:29:55.195>you <00:29:55.395>can <00:29:55.595>extend

557
00:29:56.505 --> 00:29:59.925
<00:29:56.505>or, <00:29:56.645>um, <00:29:56.785>you <00:29:56.925>use <00:29:57.065>open <00:29:57.205>not <00:29:57.345>only <00:29:57.485>for, <00:29:57.625>uh, <00:29:57.765>the <00:29:57.905>example

558
00:30:00.105 --> 00:30:03.005
<00:30:00.105>as <00:30:00.305>we've <00:30:00.505>seen, <00:30:00.705>uh, <00:30:00.905>of <00:30:01.105>the <00:30:01.305>API <00:30:01.505>indications

559
00:30:03.465 --> 00:30:07.005
<00:30:03.465>or, <00:30:03.620>um, <00:30:03.776>uh, <00:30:03.931>for <00:30:04.087>example, <00:30:04.242>you <00:30:04.398>can <00:30:04.553>use <00:30:04.709>it <00:30:04.865>for,

560
00:30:07.185 --> 00:30:08.365
<00:30:07.185>for <00:30:07.716>Kubernetes <00:30:08.247>Englishes.

561
00:30:08.425 --> 00:30:12.445
<00:30:08.425>But <00:30:08.565>in <00:30:08.705>this <00:30:08.845>example, <00:30:08.985>we're <00:30:09.125>using <00:30:09.264>it <00:30:09.405>for, <00:30:09.544>um, <00:30:09.685>for <00:30:09.825>accessing,

562
00:30:12.905 --> 00:30:17.005
<00:30:12.905>uh, <00:30:13.080>where <00:30:13.254>defining <00:30:13.430>whether <00:30:13.605>a <00:30:13.780>certain <00:30:13.955>user <00:30:14.129>can, <00:30:14.305>uh,

563
00:30:17.065 --> 00:30:18.805
<00:30:17.065>run <00:30:17.345>a <00:30:17.625>certain <00:30:17.905>command <00:30:18.185>as <00:30:18.465>pseudo.

564
00:30:19.225 --> 00:30:22.445
<00:30:19.225>Uh, <00:30:19.380>so <00:30:19.536>we're <00:30:19.691>just <00:30:19.847>checking <00:30:20.002>the <00:30:20.158>roles, <00:30:20.313>uh, <00:30:20.469>rolling <00:30:20.625>here,

565
00:30:22.505 --> 00:30:25.845
<00:30:22.505>but <00:30:22.660>you <00:30:22.816>can <00:30:22.971>extend <00:30:23.127>it <00:30:23.282>to, <00:30:23.438>uh, <00:30:23.593>have, <00:30:23.749>for <00:30:23.905>example,

566
00:30:25.965 --> 00:30:28.365
<00:30:25.965>a <00:30:26.105>check <00:30:26.245>on <00:30:26.385>the <00:30:26.524>time <00:30:26.665>of <00:30:26.804>the <00:30:26.945>day, <00:30:27.084>just <00:30:27.225>have <00:30:27.365>access

567
00:30:28.365 --> 00:30:31.085
<00:30:28.365>to <00:30:28.565>the <00:30:28.765>productive <00:30:28.965>system <00:30:29.165>on <00:30:29.365>days <00:30:29.565>like, <00:30:29.765>uh,

568
00:30:31.795 --> 00:30:33.205
<00:30:31.795>like <00:30:32.112>Thursday <00:30:32.429>or <00:30:32.746>similar <00:30:33.063>things.

569
00:30:33.625 --> 00:30:38.285
<00:30:33.625>So <00:30:33.752>you <00:30:33.879>can, <00:30:34.006>you <00:30:34.134>can <00:30:34.261>create <00:30:34.388>your <00:30:34.515>own <00:30:34.643>rules, <00:30:34.770>uh, <00:30:34.897>with <00:30:35.025>rego

570
00:30:38.305 --> 00:30:41.925
<00:30:38.305>as <00:30:38.445>well <00:30:38.585>as, <00:30:38.725>as, <00:30:38.865>as <00:30:39.005>by <00:30:39.145>using <00:30:39.285>the, <00:30:39.425>the <00:30:39.565>Pam, <00:30:39.705>um,

571
00:30:43.115 --> 00:30:45.415
<00:30:43.115>pam, <00:30:43.581>uh, <00:30:44.048>modules. <00:30:44.515>Yeah.

572
00:30:45.415 --> 00:30:48.535
<00:30:45.415>Yeah. <00:30:45.570>So <00:30:45.726>pretty <00:30:45.881>much <00:30:46.037>anything <00:30:46.192>you <00:30:46.348>put <00:30:46.503>on <00:30:46.659>the <00:30:46.815>input,

573
00:30:48.755 --> 00:30:50.295
<00:30:48.755>you <00:30:48.953>can <00:30:49.151>work <00:30:49.349>on <00:30:49.547>it, <00:30:49.745>on <00:30:49.943>the <00:30:50.141>policy.

574
00:30:51.715 --> 00:30:55.775
<00:30:51.715>So <00:30:51.842>some <00:30:51.969>case, <00:30:52.096>uh, <00:30:52.224>we <00:30:52.351>are <00:30:52.478>interested <00:30:52.605>in, <00:30:52.733>for <00:30:52.860>example, <00:30:52.987>uh, <00:30:53.115>to,

575
00:30:56.555 --> 00:30:59.695
<00:30:56.555>uh, <00:30:56.710>when, <00:30:56.866>when <00:30:57.021>you <00:30:57.177>integrate <00:30:57.332>on <00:30:57.488>Kubernetes, <00:30:57.643>you <00:30:57.799>can, <00:30:57.955>uh,

576
00:31:00.205 --> 00:31:03.575
<00:31:00.205>deny <00:31:00.360>some <00:31:00.516>images <00:31:00.671>that <00:31:00.827>do <00:31:00.982>not <00:31:01.138>come <00:31:01.293>from <00:31:01.449>trusted <00:31:01.605>sources.

577
00:31:04.755 --> 00:31:08.935
<00:31:04.755>Uh, <00:31:04.955>and <00:31:05.155>another <00:31:05.355>huge <00:31:05.555>benefits, <00:31:05.755>the <00:31:05.955>security <00:31:06.155>visibility

578
00:31:09.075 --> 00:31:11.215
<00:31:09.075>for <00:31:09.275>authorization <00:31:09.475>checks <00:31:09.675>when <00:31:09.875>we <00:31:10.075>have <00:31:10.275>a <00:31:10.475>standard.

579
00:31:12.075 --> 00:31:15.175
<00:31:12.075>And, <00:31:12.250>uh, <00:31:12.425>another <00:31:12.600>one <00:31:12.775>is <00:31:12.950>to <00:31:13.125>have <00:31:13.300>it, <00:31:13.475>uh,

580
00:31:15.365 --> 00:31:19.055
<00:31:15.365>tightly <00:31:15.540>controlled <00:31:15.715>on <00:31:15.890>who <00:31:16.065>can <00:31:16.240>change <00:31:16.415>the <00:31:16.590>authorization <00:31:16.765>logic

581
00:31:19.725 --> 00:31:22.415
<00:31:19.725>instead <00:31:19.958>of, <00:31:20.191>uh, <00:31:20.425>yeah, <00:31:20.658>only <00:31:20.891>the <00:31:21.125>developers.

582
00:31:22.435 --> 00:31:24.335
<00:31:22.435>And <00:31:22.610>you, <00:31:22.784>you <00:31:22.960>kind <00:31:23.135>of <00:31:23.310>lose <00:31:23.485>track <00:31:23.659>on <00:31:23.835>it

583
00:31:24.555 --> 00:31:27.855
<00:31:24.555>unless <00:31:24.695>you <00:31:24.835>know <00:31:24.975>the <00:31:25.115>specific <00:31:25.255>files <00:31:25.395>on <00:31:25.535>gates <00:31:25.675>to <00:31:25.815>watch <00:31:25.955>for.

584
00:31:29.565 --> 00:31:32.585
<00:31:29.565>So, <00:31:29.765>uh, <00:31:29.965>there <00:31:30.165>are <00:31:30.365>some <00:31:30.565>links, <00:31:30.765>uh, <00:31:30.965>that,

585
00:31:32.965 --> 00:31:35.625
<00:31:32.965>uh, <00:31:33.431>we <00:31:33.898>have <00:31:34.365>here.

586
00:31:35.925 --> 00:31:37.825
<00:31:35.925>So <00:31:36.205>do <00:31:36.485>you <00:31:36.764>want <00:31:37.044>to <00:31:37.325>comment?

587
00:31:38.405 --> 00:31:40.185
<00:31:38.405>I'm <00:31:38.605>still, <00:31:38.805>I'm, <00:31:39.004>I'm <00:31:39.205>so <00:31:39.405>sorry. <00:31:39.605>Maybe <00:31:39.805>I

588
00:31:40.185 --> 00:31:41.185
<00:31:40.185>Should. <00:31:40.485>No, <00:31:40.784>so <00:31:41.085>basically

589
00:31:41.185 --> 00:31:43.345
<00:31:41.185>the, <00:31:41.385>the, <00:31:41.585>the, <00:31:41.784>the <00:31:41.985>gi <00:31:42.185>the, <00:31:42.385>the <00:31:42.585>links

590
00:31:43.345 --> 00:31:45.945
<00:31:43.345>that <00:31:43.520>Dennis <00:31:43.695>mentioned, <00:31:43.870>such <00:31:44.045>as <00:31:44.220>the <00:31:44.395>open <00:31:44.570>policy, <00:31:44.745>the,

591
00:31:45.945 --> 00:31:50.625
<00:31:45.945>the <00:31:46.120>playground <00:31:46.294>and <00:31:46.470>our <00:31:46.645>GitHub, <00:31:46.820>they <00:31:46.995>are <00:31:47.169>available <00:31:47.345>here.

592
00:31:50.725 --> 00:31:54.785
<00:31:50.725>So <00:31:50.865>just <00:31:51.004>to <00:31:51.145>have <00:31:51.284>it <00:31:51.425>in <00:31:51.564>writing. <00:31:51.705>That's <00:31:51.844>pretty <00:31:51.985>much <00:31:52.125>it.

593
00:31:54.965 --> 00:31:57.705
<00:31:54.965>Uh, <00:31:55.165>we <00:31:55.365>thank <00:31:55.564>you <00:31:55.764>for <00:31:55.965>taking <00:31:56.165>your <00:31:56.365>time

594
00:31:57.885 --> 00:32:00.025
<00:31:57.885>and <00:31:58.085>having <00:31:58.285>the <00:31:58.485>patience <00:31:58.685>to <00:31:58.885>go <00:31:59.085>through <00:31:59.285>it.

595
00:32:01.525 --> 00:32:05.185
<00:32:01.525>Uh, <00:32:01.758>and <00:32:01.991>yeah, <00:32:02.225>uh, <00:32:02.458>think <00:32:02.691>that's <00:32:02.925>it.

596
00:32:05.725 --> 00:32:10.225
<00:32:05.725>If <00:32:05.852>you <00:32:05.979>have <00:32:06.106>any <00:32:06.234>other <00:32:06.361>remarks. <00:32:06.488>Yeah, <00:32:06.615>so <00:32:06.743>I <00:32:06.870>think <00:32:06.997>that's <00:32:07.125>it.