Skip to main content

Direct Access

note
OpenFGA is an open source Fine-Grained Authorization solution based on Google's Zanzibar. We welcome community contribution to this project.

In this guide you will learn how to grant a user access to an object (such as a certain document) in OpenFGA.

When to use

Granting access with relationship tuple is a core part of OpenFGA. Without them, any checks will fail. You should use:

  • authorization model to represent what relations are possible between the users and objects in the system
  • relationship tuples to represent the facts about the relationships between users and objects in your system.

Before you start

In order to understand this guide correctly you must be familiar with some OpenFGA Concepts and know how to develop the things that we will list below.

Assume that you have the following authorization model.
You have a type called document that can have a viewer and/or an editor.

type document
relations
define viewer as self
define editor as self

In addition, you will need to know the following:

OpenFGA Concepts

  • A Type: a class of objects that have similar characteristics
  • A User: an entity in the system that can be related to an object
  • A Relation: is a string defined in the type definition of an authorization model that defines the possibility of a relationship between an object of the same type as the type definition and a user in the system
  • An Object: represents an entity in the system. Users' relationships to it can be define through relationship tuples and the authorization model
  • A Relationship Tuple: a grouping consisting of a user, a relation and an object stored in OpenFGA

Step By Step

For our applications to understand that user x has access to document y, we need to provide OpenFGA that information through relationship tuples. Each relationship tuple has three basic parameters, a user, a relation and an object.

01. Create A Relationship Tuple

Let us add a relationship tuple to indicate that bob who is an editor of document:meeting_notes.doc. This is represented by adding the following:

Initialize the SDK
// ApiTokenIssuer, ApiAudience, ClientId and ClientSecret are optional.
// import the SDK
const { OpenFgaApi } = require('@openfga/sdk');

// Initialize the SDK with no auth - see "How to setup SDK client" for more options
const fgaClient = new OpenFgaApi({
apiScheme: process.env.FGA_API_SCHEME, // Either "http" or "https", defaults to "https"
apiHost: process.env.FGA_API_HOST, // required, define without the scheme (e.g. api.openfga.example instead of https://api.openfga.example)
storeId: process.env.FGA_STORE_ID, // Either "http" or "https", defaults to "https"
});

await fgaClient.write({
writes: {
tuple_keys: [
{ user: 'bob', relation: 'editor', object: 'document:meeting_notes.doc'}
]
}
});

02. Check That The Relationship Exists

Once that relationship tuple is added to OpenFGA, we can check if the relationship is valid by asking the following: "is bob an editor of document:meeting_notes.doc?"

Initialize the SDK
// ApiTokenIssuer, ApiAudience, ClientId and ClientSecret are optional.
// import the SDK
const { OpenFgaApi } = require('@openfga/sdk');

// Initialize the SDK with no auth - see "How to setup SDK client" for more options
const fgaClient = new OpenFgaApi({
apiScheme: process.env.FGA_API_SCHEME, // Either "http" or "https", defaults to "https"
apiHost: process.env.FGA_API_HOST, // required, define without the scheme (e.g. api.openfga.example instead of https://api.openfga.example)
storeId: process.env.FGA_STORE_ID, // Either "http" or "https", defaults to "https"
});

// Run a check
const { allowed } = await fgaClient.check({
tuple_key: {
user: 'bob',
relation: 'editor',
object: 'document:meeting_notes.doc',
},});

// allowed = true

If we were to check the following: "is bob a viewer of document:meeting_notes.doc?" it would return false since that relationship tuple does not exist within OpenFGA yet.

Initialize the SDK
// ApiTokenIssuer, ApiAudience, ClientId and ClientSecret are optional.
// import the SDK
const { OpenFgaApi } = require('@openfga/sdk');

// Initialize the SDK with no auth - see "How to setup SDK client" for more options
const fgaClient = new OpenFgaApi({
apiScheme: process.env.FGA_API_SCHEME, // Either "http" or "https", defaults to "https"
apiHost: process.env.FGA_API_HOST, // required, define without the scheme (e.g. api.openfga.example instead of https://api.openfga.example)
storeId: process.env.FGA_STORE_ID, // Either "http" or "https", defaults to "https"
});

// Run a check
const { allowed } = await fgaClient.check({
tuple_key: {
user: 'bob',
relation: 'viewer',
object: 'document:meeting_notes.doc',
},});

// allowed = false
caution

Note: When creating relationship tuples for OpenFGA make sure to use unique ids for each object and user within your application domain. We're using first names and simple ids to just illustrate an easy-to-follow example.

OpenFGA Concepts

Learn about the OpenFGA Concepts.

Modeling: Getting Started

Learn about how to get started with modeling.

Configuration Language

Learn about OpenFGA Configuration Language.