Steve Coffman StevenACoffman

Zanzibar ReBAC Versus Cerbos PBAC

Choosing between a Zanzibar-based ReBAC (Relationship-Based Access Control) system and a Cerbos PBAC (Policy-Based Access Control) architecture means weighing centralized relationship state and consistency against the agility of local policy logic. Judge the choice on four criteria: data graph complexity, latency requirements, operational overhead, and how often compliance rules change.

Architectural Core Differences

| Dimension | Google Zanzibar-based ReBAC (for example, SpiceDB, Ory Keto, OpenFGA) | Cerbos PBAC | | ----------------

This is the command pattern in Go, for CLIs

Get the content of the QR for Okta Verify app setup. It looks like this: oktaverify://email@domain.com/?t=XXXXX&f=YYYYY&s=https://DOMAIN.okta.com&issuer=DOMAIN.okta.com&isIdxEnabled=true
Replace XXXXX, YYYYY and DOMAIN to your values in curl below:

curl --request POST \
  --url https://DOMAIN.okta.com/idp/authenticators \
  --header 'Accept: application/json; charset=UTF-8' \
  --header 'Accept-Encoding: gzip, deflate' \
  --header 'Authorization: OTDT XXXXX' \
  --header 'Content-Type: application/json; charset=UTF-8' \

### Procedure:

Step 1: Go to https://console.cloud.google.com/alloydb/clusters?referrer=search&project=khan-academy Select Cluster, and Edit Read Pool
Step 2: Under Network Security, Select Require SSL (and optionally Enforce mTLS via AlloyDB connectors)
Step 3: Under Connectivity, Select Enable Public IP
Step 4: Unhide Advanced Configuration vieo, then Under Flags, click "Add database flag" and ensure at least these minimum flags are set to these values (other flags also may be set) | flag | value | |---|---|

https://github.com/brunoga/deep

Go struct Mapping options

Library	⭐	Technique
go-viper/mapstructure	8k	Technique
jinzhu/copier	6.1k	Reflection
thoas/go-funk	4.9k	Technique
darccio/mergo	3.1k	Technique

How to Push to Someone Else's Pull Request

Let's say contributor has submitted a pull request to your (author) project (repo). They have made changes on their branch feature and have proposed to merge this into origin/master, where

origin -> https://github.com/author/repo.git

Now say you would like to make commits to their PR and push those changes. First, add their fork as a remote called

Simple DIY STS server Google Cloud Application Default Credential

or...how to use ADC and run your own STS token broker

An STS server will exchange one token for another. This protocol is used by GCP Workload Federation.

THis example runs your own STS server with GCP where the STS server accepts a source token, validates it and the returns a gcp access_token

For more information about STS servers, see

From https://www.reddit.com/r/golang/comments/1kwklgf/comment/mui4zkq/

Without a tool like buf, it's a lot of work for the consumers.

Let's say you leave the project layout exactly as in your question:

my-library/
└─ directory1/shared.proto

so downstream code can keep writing

	package main

	import (
	"google.golang.org/protobuf/proto"
	"google.golang.org/protobuf/reflect/protodesc"
	"google.golang.org/protobuf/reflect/protoreflect"
	"google.golang.org/protobuf/types/descriptorpb"
	"google.golang.org/protobuf/types/dynamicpb"
	)