Open Source Oso Alternatives
A curated collection of the 2 best open source alternatives to Oso.
The best open source alternative to Oso is Permify. If that doesn't suit you, we've compiled a ranked list of other open source Oso alternatives to help you find a suitable replacement. Other interesting open source alternative to Oso is Cerbos.
Oso alternatives are mainly Identity & Access Management (IAM) but may also be Application Security. Browse these if you want a narrower list of alternatives or looking for a specific functionality of Oso.
A fine-grained authorization service modeled on Google Zanzibar, for teams that want permission logic out of application code.
Permify moves access control out of your codebase into a service of its own. Rather than permission checks scattered through application logic, one system answers questions such as whether user X can view document Y, or which posts the members of team Y may edit, and answers them in tens of milliseconds.
The design follows Google Zanzibar, the consistent global authorization system behind Google's own products. Permissions are written in a domain specific language compatible with RBAC, ReBAC and ABAC, and a hosted playground lets you build the logic and test it against sample data before wiring anything in.
A handful of properties define what the service gives you.
- Centralized logic: reason about, test and debug authorization as a single entity.
- Granular permissions: express resource-specific, hierarchical and context aware rules.
- Multi-tenancy: give each vendor or organization isolated logic, managed from one place.
- Two interfaces: a REST API on port 3476 and a gRPC service on port 3478.
- Load tested: a run at 1000 virtual users returned no failed requests, with median latency around 15 milliseconds.
One Docker command starts the server with authorization data held in memory, and a health check endpoint confirms it is up. The self-hosted Community Edition is published four times a year and leaves observability dashboards and data synchronization to the paid cloud. Readers should also know that Permify has been acquired by FusionAuth.
Stateless authorization service that evaluates access rules written as YAML policies, keeping permission logic out of your application code.
Authorization logic tends to spread through an application until nobody can say who is allowed to do what. Cerbos pulls that logic out into YAML policies, authored and deployed through the Git-ops infrastructure you already run, and answers access questions over an API instead.
The model is small enough to hold in your head. A principal, usually a user but equally a service, a bot or another application, attempts an action on a resource, and the policy written for that resource decides the outcome.
The stateless service evaluating those policies is the Policy Decision Point, and it exposes two primary APIs.
- CheckResources: can this principal carry out these actions on this resource.
- PlanResources: which resources of a given kind can this principal access.
- Derived roles: RBAC roles extended dynamically with conditions evaluated against contextual data at runtime.
- Principal policies: per-user overrides for the cases where a resource policy is too broad a brush.
- Query plan adapters: turn a PlanResources response into a query instance for your data layer.
The decision point deploys as a Kubernetes service or sidecar, a systemd service or an AWS Lambda function, reading policies from disk, cloud object stores, Git repositories or supported databases and watching them for changes. SDKs cover the usual languages. Cerbos Hub, a hosted control plane, adds shared authoring playgrounds, fleet-wide policy distribution and embedded bundles for browser and edge deployments.
