Skip to content

Add FAQ entry on authentication-layer revocation #583

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ivanauth wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add FAQ entry on authentication-layer revocation #583

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 20 additions & 1 deletion app/spicedb/getting-started/faq/page.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
title: "Frequently-asked Questions"
description: "Answers to common SpiceDB questions on open-source licensing, IT infrastructure, policy engines, filtering resources by access, and getting involved."
description: "Answers to common SpiceDB questions on open-source licensing, IT infrastructure, policy engines, credential revocation, filtering resources by access, and getting involved."
---

# Frequently-asked Questions
Expand Down Expand Up @@ -51,6 +51,25 @@ For these scenarios, SpiceDB supports [Caveats] as a light-weight form of policy
[Reverse Indices]: ../concepts/zanzibar/#reverse-indices
[caveats]: ../concepts/caveats

## Does SpiceDB revoke permissions when an OAuth token or session is revoked?

No.
SpiceDB is an authorization system, not an authentication system.
A permission check is computed from the schema and relationships stored in SpiceDB, together with any caveat context stored on those relationships or supplied with the request; relationships with expiration also depend on the datastore's clock.
SpiceDB does not consult any external credential state.

SpiceDB is commonly deployed behind a separate authentication layer, such as an OAuth 2.0 provider, that verifies who the caller is before the application asks SpiceDB what the caller may do.
Revoking a credential at that layer affects only that layer, and how quickly it takes effect depends on the credential: a revoked opaque token or session stops working at the next introspection, while a self-contained JWT is typically accepted until it expires.
Either way, revocation does not remove any relationships, so SpiceDB permission checks for that subject continue to succeed for as long as the granting relationships exist.
The same applies to `LookupResources` and `LookupSubjects`, which resolve from the same stored state.

To remove a subject's access in SpiceDB, delete the relationships that grant it, or model time-bound access with [expiring relationships] or [Caveats].
Note that a check using the default `minimize_latency` [consistency] mode can be served from a cached snapshot, so it may not observe a relationship deletion immediately; see [read-after-write] for that window and how to close it.

[expiring relationships]: ../concepts/expiring-relationships
[consistency]: ../concepts/consistency
[read-after-write]: ../concepts/read-after-write

## How do I filter resources based on access decisions in SpiceDB?

There are three approaches for filtering resources based on whether users have access to them:
Expand Down
Loading