Fine Grained News - February 2025

Welcome to the second Fine Grained News edition of 2025!

Just Shipped!

• We shipped 3 minor versions of OpenFGA which include:

  • Fixes for CVE-2025-25196 and CVE-2024-56323

  • Several performance improvements that are enabled with the enable-check-optimizations experimental flag.

  • Dynamic TLS certificate reloading for HTTP and gRPC servers. Thanks Rokibul Hasan for your contribution!

  • A name filter to ListStores. The name parameter instructs the API to only include results that match that name. Thanks Karl Persson for your contribution!

  • Optimized database dialect handling by setting it during initialization instead of per-call, fixing SQL syntax errors in MySQL. Thanks Siddhant Khare for your contribution!

  • Support for Go 1.24. We follow Go's version support policy and will only support the latest two major versions of Go. Now that Go 1.24 is out, we have dropped support for Go < 1.23.

• Two minor versions of the Java SDK, with support for server-side BatchCheck. Thanks Piotr Olaszewski for your contribution!

• A minor release of the Go SDK, with support for the StartTime parameter in the ReadChanges method and support for specifying contextual tuples and context parameters in assertions.

• A minor release of the FGA CLI, with support for the start-time parameter for the changes command and importing assertions during fga store import. Thanks Sujitha A V for your contribution!

Using OpenFGA for GenAI and Retrieval Augmented Generation (RAG)

We are seeing a lot of interest in using OpenFGA for RAG scenarios and we wanted to share a list of interesting articles and repositories that were published lately:

• RAG and Access Control: Where Do You Start?
• Building a Secure RAG with Python, LangChain, and OpenFGA
• GenAI, LangChain.js, and FGA
• Building a Permissions System For Your RAG Application
• mdb-openfga: OpenFGA + MongoDB

Learning OpenFGA

We've been busy creating blog posts and videos that help you adopt OpenFGA, check them out!

• OpenFGA: Modeling Guide
• OpenFGA: The Basics
• OpenFGA for Python Flask Applications
• How to Implement Relationship-Based Access Control (ReBAC) in a Ruby On Rails API?
• Securing data in your Next.js app with Okta and OpenFGA
• OpenFGA for an Express + Typescript Node.js API
• OpenFGA for Spring Boot Applications

OpenFGA to CNCF Incubation

The CNCF Technical Oversight Committee triaged OpenFGA's application to be accepted as an "Incubation" project, decided we had provided the appropriate information and references, and moved the project to the next step. We now need to wait for a TOC member to pick the project and do their due diligence.

Thanks to Canonical, Grafana, Docker, Read.AI, Agicap, Sourcegraph, Zuplo, and Stacklok for agreeing to be interviewed by the CNCF as reference adopters!

OpenFGA in London

OpenFGA will be present in two high-profile events in London:

• Sam Bellen will participate in the Gartner IAM EMEA event demoing OpenFGA interoperability with the AuthZen standard.

• Poovamraj Thanganadar Thiagarajan from Okta will be presenting at KubeCon Europe, together with Jo Guerreiro from Grafana Labs about From Chaos To Control: Migrating Access Control To OpenFGA in a Multi-Tenant World.

• Andres Aguiar from Okta was invited to present on the Maintainer's Summit at KubeCon Europe about our experiences collaborating with the CNCF TAG-Security team: A Project Maintainers Guide To TAG Security.

See You Next Month:

Fine Grained News is published every month. If you have any feedback, want to share your OpenFGA story, or have a noteworthy update, please let us know on any of our community channels or at [email protected].