Can OPA be used a replacement for ForgeRock/OpenAMs web policy agent?

[rjwesten]

Hi,

Just curious if OPA could be an alternative for ForgeRocks Web Policy agent?

[srenatus]

Hello! 👋

This is quite hard to answer if you don't happen to know both projects well.

Can you please roughly outline your use case and your requirements? It'll be easier to say if OPA can be used for X if you know OPA than trying to figure out if it can be used instead of Y.

[rjwesten]

Can OPA be used to protect web urls based on group membership in AzureAD.
ie.
https://somedomain.com/admin
Only if you're in the admin group

https://somedomain.com/view
as long as you're view or edit or admin group

https://somedomain.com/edit
Only if in the edit group

[srenatus]

API authorization is a common use case. See https://www.openpolicyagent.org/docs/latest/http-api-authorization/ for examples.

[srenatus]

... But you would need another service acting as an authorizing proxy, OPA doesn't do that on its own.