title: Implementation of RBAC with Postgres + Firestore
body: <p>I'm in the process of implementing an authentication + authorization system for my web application, and I'm struggling to decide how to implement the authorization part. This is what I've decided on, so far:</p>
  
  <ul>
  <li><strong>For the authentication process</strong> I'll be using Firebase. After some research it stood between Firebase and AWS Cognito, and Firebase seemed to be more mature. The solution is secure, saves me a lot of hassle, and there's no point reinventing the wheel.</li>
  <li><strong>For storing additional user data</strong> I'll use Firestore. It seems like this will make my life easier for performing user tasks, like updating personal information, and saving/retrieving user state in the onboarding process etc.</li>
  <li><strong>For the server side</strong> I'm using Kotlin + Postgres, mainly because I want to know these technologies better.</li>
  <li><strong>For the permission model</strong> I'll be using RBAC. This is mainly because it's flexible, and I've gotten some experience with it using AWS.</li>
  </ul>
  
  <p>Now, for the RBAC implementation my idea is to keep the roles, policies and user groups in the Postgres database, while keeping my users in the Firebase (+ Firestore).</p>
  
  <p>I'm really just looking for input on best practices, and if anyone has done something like this before.
  There seems to be a lot of articles covering the authentication process, but not so many covering good authorization system implementations.</p>
  
  <p>Any tips will be very much appreciated.</p>