title: How to implement ACL on an ElasticSearch-based system?
body: <p>I have a system (RESTful) using NodeJS and Elasticsearch which implements RBAC authorization policy. The RBAC authorization works with an authorization server in front of other APIs testing each request against the routes authorized to user's roles (using bearer token to authenticate the user).</p>
  
  <p>I like this design because other API's doesn't need to know about the authorization/authentication service. And it's very, very, very fast, because it uses an in-memory cache policy instead making request to Elasticsearch every time that receives a new request to test the auth.</p>
  
  <p>But now I need to implement ACL to provide more granular control of authorization. From REST point of view the policy will be applied at resources level. Example: "POST:/user/123" is authorized only to A user.</p>
  
  <p>I've done a survey with the clients and 85% will only use <strong>allow</strong> policy of ACL's, by default the ACL control will deny everything. So ok, now I have all information to develop this control. But I don't see the best way to implement this.</p>
  
  <p>My first thought was:</p>
  
  <ol>
  <li><p>The most important quality of system is to be scalable;</p></li>
  <li><p>Okay, it's impossible to do in memory cache, I've done some simulations with 100k users and 1 million of resources (which can be a real scenario) and the amount of memory is HUGE, this feature will have a high cost if cached;</p></li>
  <li><p>In this case the authentication service can't handle ACL because it can't filter searchs. The auth service doesn't intercept results, only validate headers and routes against roles;</p></li>
  <li><p>So, with all this points, what if in each document at Elasticsearch I had a new field named "acl_allow_method_user" which is an array of method + user's ID's authorized to use this resource? Will end up with something like this:</p></li>
  </ol>
  
  <p><code>"acl_allow_method_user":["POST:123434"]</code></p>
  
  <p>I'll also have to create a common package to be used by all API's to validate this policy on each interaction with Elasticsearch, but I don't see any problem with this.</p>
  
  <ol>
  <li><p>Anyone with experience on ACL, is this a good design?</p></li>
  <li><p>Elasticsearch have limit to size of array fields?</p></li>
  <li><p>What about performance? Will have impact with this approach?</p></li>
  </ol>