Open Policy Agent (OPA) for Policy Authorization

1st Jan 2025

Introduction

In the world of microservices and cloud-native applications, managing authorization policies can quickly become complex. Open Policy Agent (OPA) is a general-purpose policy engine that provides a unified way to define and enforce fine-grained policies across your entire stack. This blog will walk you through using OPA for policy-based authorization, integrating it with your backend, and defining policies using the Rego language.

OPA decouples policy decision-making from application logic, enabling flexibility and centralization of policy enforcement. Let’s dive into how OPA can be used for role-based access control (RBAC) in a microservice architecture.

What is OPA?

OPA is an open-source, declarative policy engine that allows you to define policies in a high-level, declarative language called Rego. These policies are evaluated against incoming requests, and based on the outcome, OPA will return an "allow" or "deny" decision. This decouples the policy logic from the application, making your codebase cleaner and more manageable.

OPA is well-suited for enforcing policies in different layers of your system, including API authorization, Kubernetes admission control, and more.

Setting Up OPA for Policy Authorization

For this tutorial, we’ll build a basic OPA policy service that integrates with a backend application. OPA will determine whether a user is authorized to access certain resources based on roles stored in a database.

Step 1: Install OPA

To get started, you can install OPA using Docker, which is the easiest method. Run the following command:

    docker run -p 8181:8181 openpolicyagent/opa run --server
 

This command starts OPA on port 8181 in server mode, allowing us to interact with it using HTTP.

Step 2: Define an Example Policy

We’ll define a simple RBAC policy where only users with the role of admin or user can access certain resources. Policies are written in Rego and saved as .regofiles.

Here’s a basic Rego policy that checks the user’s role:

        package authz

default allow = false

allow {
    input.user.role == "admin"
}

allow {
    input.user.role == "user"
}


      

This policy checks the input.user.role field to see if it matches admin or user. If so, the allow rule evaluates to true, and OPA will return an "allow" decision.

Step 3: Test the Policy

You can test the policy using a curl command. Save the Rego policy as authz.rego and run the following command to load and evaluate it:

        curl -X POST http://localhost:8181/v1/data/authz/allow -d '{
    "input": {
        "user": {
            "role": "admin"
        }
    }
}'

      

OPA will respond with a true or false decision based on the role provided in the input.

Response

        {
            "result": true
        }
      

OPA returns true because the user role is admin, which is allowed according to the policy.

Comparison with other policy authorization frameworks

Here’s a comparison table that evaluates Open Policy Agent (OPA) against other popular policy authorization frameworks like AWS IAM, Google Cloud IAM, Kubernetes RBAC, and Spring Security.

Conclusion

OPA makes policy-based authorization easy to implement and scale in modern microservices architectures. By separating the policy logic from application code, you gain flexibility and maintainability. Whether you're enforcing RBAC, ABAC (Attribute-Based Access Control), or custom policies, OPA provides a powerful and flexible solution.

With OPA integrated into your stack, you can manage policies in one place, scale them easily, and keep your application logic simple and clean.