A relationship store is a shared repository for relationships such as ownership, membership, and delegation. ReBAC-enabled services query it instead of relying on upstream authorization claims or duplicating relationship logic locally. section 17.2.2 section 17.3
A central store helps distributed services by:
- Combining relationship data contributed by different services into one relationship graph. section 17.3
- Answering whether a user has a valid relationship with a requested resource. section 17.2.2
- Reducing inconsistent authorization caused by services interpreting roles or attributes differently. section 17.2.2
Checking invoice ownership
When the payments service must verify whether Joe owns particular invoices, it queries the relationship store. The store evaluates the relationship graph and returns the authorization result rather than having the payments service compute the relationship locally. section 17.2.2
Figure 17.6 Using a central relationship store for ReBAC in a microservices architecture. Each service syncs its relationship data (such as ownerships, memberships, and associations) to a central relationship store. When a service needs to authorize a request, it queries the store to evaluate whether a valid relationship exists between the user and the resource in question.
Use the architecture figure to trace how services synchronize ownerships, memberships, and associations, then query the central store during authorization. section 17.2.2
