Skip to main content

Modeling User Groups

note
Auth0 Fine Grained Authorization (FGA) is the early-stage product we are building at Auth0 to solve fine-grained authorization at scale. Sign up for the Developer Community Preview to try it out, and join our Discord community if you are interested in learning more about our plans.

Please note that at this point in time, it is not considered production-ready and does not come with any SLAs; availability and uptime are not guaranteed. Limitations of Auth0 FGA during the Developer Community Preview can be found here.

In this guide you will learn how to add users to groups and grant groups access to an object using Auth0 FGA.

When to use

Adding a relationship tuple specifying that a group has a relation to an object is helpful in cases where you want to encompass a set of users with the same relation to an object. For example:

  • Grant a group of engineers viewer access to roadmap.doc
  • Create a block_list of members who can't access a document
  • Sharing a document with a team
  • Granting viewer access to a photo to followers only
  • Making a file viewable for all users within an organization
  • Restricting access from or to users in a certain locale

Before you start

In order to understand this guide correctly you must be familiar with some Auth0 FGA Concepts and know how to develop the things that we will list below.

Assume that you have the following authorization model.
You have an object called document that users can be related to as an editor.

type document
relations
define editor as self

In addition, you will need to know the following:

Modeling Basics

You need to know how to create an authorization model and create a relationship tuple to grant a user access to an object. Learn more →

Auth0 FGA Concepts

  • A Type: a class of objects that have similar characteristics
  • A User: an entity in the system that can be related to an object
  • A Relation: is a string defined in the type definition of an authorization model that defines the possibility of a relationship between objects of this type and other users in the system
  • An Object: represents an entity in the system. Users' relationships to it can be define through relationship tuples and the authorization model
  • A Relationship Tuple: a grouping consisting of a user, a relation and an object stored in Auth0 FGA

The Playground

Try this guide out on the Auth0 FGA Playground

Step by Step

As we develop our application, we might encounter use cases where a group of users have a certain role or permission on an object. For example, members of a certain team might have an editor relation to a certain document.

In order to represent this in Auth0 FGA, we need:

  1. Introduce the concept of a team to the authorization model
  2. Add users as members to the team
  3. Assign the team members a relation to an object
  4. Checking an individual member's access to the object

01. Introduce the concept of a team to the authorization model

We need to define the object team in our authorization model. In our use case, a team can have members, so we make the following changes to our authorization model:

type document
relations
define editor as self
type team
relations
define member as self

02. Add users as members to the team

We can now assign users as members of teams. Let's create a new relationship tuple that states alice is a member of team:writers.

Initialize the SDK
// FGA_ENVIRONMENT can be "us" (default if not set) for Developer Community Preview or "playground" for the Playground API
// import the SDK
const { Auth0FgaApi } = require('@auth0/fga');

// Initialize the SDK
const fgaClient = new Auth0FgaApi({
environment: process.env.FGA_ENVIRONMENT,
storeId: process.env.FGA_STORE_ID,
clientId: process.env.FGA_CLIENT_ID,
clientSecret: process.env.FGA_CLIENT_SECRET,
});

await fgaClient.write({
writes: {
tuple_keys: [
{ user: 'alice', relation: 'member', object: 'team:writers'}
]
}
});

03. Assign the team members a relation to an object

To represent groups we use the type:object_id#relation format, which represents the set of users related to the type:object_id as a certain relation. For example, team:writers#members is used to represent the set of users related to the team:writers object as members.

In order to assign members of a team a relation to a document, we can create the following relationship tuple that states that members of team:writers are editors of document:meeting_notes.doc.

Initialize the SDK
// FGA_ENVIRONMENT can be "us" (default if not set) for Developer Community Preview or "playground" for the Playground API
// import the SDK
const { Auth0FgaApi } = require('@auth0/fga');

// Initialize the SDK
const fgaClient = new Auth0FgaApi({
environment: process.env.FGA_ENVIRONMENT,
storeId: process.env.FGA_STORE_ID,
clientId: process.env.FGA_CLIENT_ID,
clientSecret: process.env.FGA_CLIENT_SECRET,
});

await fgaClient.write({
writes: {
tuple_keys: [
// Set of users related to 'team:writers' as 'member'
{ user: 'team:writers#member', relation: 'editor', object: 'document:meeting_notes.doc'}
]
}
});

04. Checking an individual member's access to an object

Now that we have:

  • a relationship tuple indicating that alice is an member of team:writers
  • a relationship tuple indicating that members of team:writers are editors of document:meeting_notes.doc

This means that if we *check*is alice an editor of document:meeting_notes.doc? We would get the following:

Initialize the SDK
// FGA_ENVIRONMENT can be "us" (default if not set) for Developer Community Preview or "playground" for the Playground API
// import the SDK
const { Auth0FgaApi } = require('@auth0/fga');

// Initialize the SDK
const fgaClient = new Auth0FgaApi({
environment: process.env.FGA_ENVIRONMENT,
storeId: process.env.FGA_STORE_ID,
clientId: process.env.FGA_CLIENT_ID,
clientSecret: process.env.FGA_CLIENT_SECRET,
});

// Run a check
const { allowed } = await fgaClient.check({
tuple_key: {
user: 'alice',
relation: 'editor',
object: 'document:meeting_notes.doc',
},});

// allowed = true

The chain of resolution becomes:

  • alice is member of team:writers
  • members of team:writers are editors of document:meeting_notes
  • therefore, alice is editor of document:meeting_notes
caution

Note: When creating relationship tuples for Auth0 FGA make sure to use unique ids for each object and user within your application domain. We're using first names and simple ids to just illustrate an easy-to-follow example.

Managing Group Membership

Learn how to add and remove users from groups

Modeling Google Drive

See how User Groups can be used to share documents within a domain in the Google Drive use-case.

Modeling GitHub

Granting teams permissions to a repo in the GitHub use-case.

Have Feedback?

Join us on the Discord community if you have any questions or suggestions.