Success story
Utility Warehouse synchronizes authorization across 4,500 services
An FTSE 250 Index company replaces a cumbersome in-house authorization system with decoupled, centralized authorization management, gaining enhanced reliability and transparency.
Months of developer time reclaimed from boring maintenance
Enhanced reliability and transparency for access control
Eliminated technical debt from authorization
āCerbos has a grammar in their YAMLs that we can trust. What we had before was the wild west. It was thousands of lines of code.ā
Rob Crowe, Principal Engineer, Utility Warehouse
Summary
Utility Warehouse (or UW) is the only genuine multiservice provider in the UK. It offers the cheapest variable energy tariff in the UK and is a constituent of the FTSE 250 Index. It currently handles over 814,000 customer accounts with the help of over 45,000 independent distributors. They have a team of over 200 software engineers and their software runs over internal 4,500 services.
Cerbos is an authorization management solution that makes fine-grained access control easy to implement and maintain by decoupling authorization from application silos.
When Utility Warehouse used Cerbos to rebuild their internal authorization system, they reclaimed valuable time that would have been spent on maintenance, achieved an enhanced level of reliability and transparency in their access controls, and eliminated a source of technical debt.
Fine grained, contextual, continuous authorization for enterprise software and AI
Introduction
An in-house authorization system due for an overhaul
When you are an FTSE 250 company with a team of 200+ engineers running over 4,500 services, the idea of re-building your in-house authorization system can be highly daunting. For Rob Crowe, the Principal Engineer at Utility Warehouse, it was clear that such a re-build was due. Utility Warehouseās internal authorization logic was ālong in the toothā. Rob knew that there would be trouble down the road if his team didnāt upgrade the system.Ā Ā
āWeād built an internal authorization software but we hadnāt looked after it. It kind of worked but it was basic and a bit cumbersome,ā he explained. Utility Warehouse had YAML files in a GitHub repository that defined their role-based access control (RBAC) policies. But with 4,500 internal services, managing changes was getting hairy.Ā
āThe JWTs were too big to fit in browsers and cookies, so we had to hack around it,ā Rob recounts, āWe realized that our 200+ engineers were doing their own thing, we didnāt have a standard way of doing authorization, and we had no way of testing our pull requests. If we thought it looked right, we merged it and waited to see if it worked.ā
As a result of code bloat, lack of standardization, and insufficient visibility, UW was dealing with version control issues as well. They had many versions and implementations of authorization logic. The policy evaluation logic was scattered across Utility Warehouseās code base.
āWe realized that our 200+ engineers were doing their own thing, we didnāt have a standard way of doing authorization.ā
Rob Crowe, Principal Engineer, Utility Warehouse
Business Needs
Security, compliance, and consistency
Taking stock of Utility Warehouseās authorization challenges, alongside the requirements of the business, Rob knew that they needed a centralized, secure, and SOC/ISO-compliant way of managing access control.Ā
As an FTSE 250 company in a regulated market, they need to be able to track who accesses their systems and why. So creating a system that was auditable, with automatic logs that are easy to read, would be a great advantage. Centralizing their access control policies in one place would make it easier to enforce security standards. And it would simplify their access logs for easier auditing.Ā
Evaluating solutions
A familiar language and hassle-free implementation
Instead of re-building authorization in-house, Rob chose to look for an external tool. 'We could have used our existing tools, but it would've required a lot of investment in something that wasnāt our core business,' he says.Ā
Also in the interest of time, Rob looked for a solution that would fit easily into UWās existing framework. 'Cerbos is similar to our internal system, with a ton of extra features. Itās open source and written in YAML, which weāre familiar with. It fits with how we think about RBAC and ABAC,' says Rob.Ā
Rob and his team started by implementing a self-hosted, open-source Cerbos Policy Decision Point (PDP). They started small, using Cerbos to authorize just a few of their internal services.
Since they didn't need to learn new policy languages or learn new access control concepts, Rob and his team were able to move quickly. They improved their previous authorization, adding additional logic and rules. And they eliminated their previous version control issues and complicated roll-out processes.Ā
'Cerbos has a grammar in their YAMLs that we can trust. Whereas the one we had before was the wild west. It was thousands of lines of code,' Rob says. Using Cerbos, Rob and his teamĀ keep their code clean and simple. And they manage policies through the configuration rather than editing code.Ā
Rob was also pleased to find that Cerbos came with built-in testing and auditing capabilities. 'One of our favorite features is the audit logs because it allows us to understand what is happening in the black box,' he says, 'And weāve never been able to write tests and validate that changes are taking place. Cerbos allows us to do that.'
āOne of our favorite features is the audit logs because it allows us to understand what is happening in the black box. We didnāt know we needed that.ā
Rob Crowe, Principal Engineer, Utility Warehouse
Results
A more transparent and reliable authorization system requiring minimal upkeep
UWās access control system was in bad shape, but after implementing Cerbos, Rob feels they successfully averted a crisis. āIf we had kept our old system for more than 6 months or a year, we would have been in trouble. Cerbos came along with a product that let us bootstrap and move quickly,ā he says.Ā
Rob and his team donāt wrangle scattered authorization logic across 4,500 services anymore. Everything is managed and deployed through one decoupled Policy Decision Point. It takes a few minutes to make changes rather than days rooting out disparate pieces of code.Ā
Rob and his team also have total visibility into why a user is granted or denied access or permission. They have comprehensive audit trails that enable Rob to follow the evolution of access policies through time. Ā
āWe have a proper tool to depend on and I trust Cerbosā workflows. If the green tick says that it is built, then we know it should work.ā
Rob Crowe, Principal Engineer, Utility Warehouse
As a result, Rob is more confident than ever before that Utility Warehouseās authorization logic is accurate and secure. They donāt worry about errors when they apply permissions. Instead, they use the quality control capability within Cerbos to test policies before deployment.Ā
āWe have a proper tool to depend on and I trust Cerbosā workflows. If the green tick says that it is built, then we know it should work,ā he says.Ā
Eliminating the massive task of detangling permissions logic, Rob and his team have more time to focus on building UWās software. āCerbos allows our team to focus on getting rid of technical debt and other business use cases instead of wondering how to write a policy evaluation language,ā he explains.
Throughout the process of evaluating and implementing Cerbos, Rob also appreciated the expertise, honesty, and willingness to take feedback demonstrated by the Cerbos team. āThe Cerbos team is smart, humble, transparent, and nice. Our relationship feels like a partnership, and everything they've built has answered a need for us,ā he says, āIt's weird to say an outside company has our back, but Cerbos does. It's the people. It's their open-source code: it's high quality, you can read it, it does what it says on the tin.ā
Related links
- Full interview Rob Crowe
- Human Managed creates a future-proof ABAC engine with Cerbos
- NTWRK makes a complex access control system easy to manage with Cerbos