Over the past few years, we have built Guardian step by step and reported on the concept and initial results in our blog posts from 2023 and 2024. Guardian is the component in Nubus that answers a central question: Is this person allowed to perform this action?
Today, we would like to share openly what we have learned in the meantime—and what consequences we are drawing from it.
Table of Contents
What we originally built—and why it was too much
The previous implementation was based on the Open Policy Agent and was developed entirely in-house: it included a custom management interface, rules written in the niche language Rego, and a database for storing them. For this reason, the UDM extension for role-based administration, available as a preview, was also implemented without integration with Guardian. During integration—particularly with the Univention Directory Manager—it became clear that the maintenance effort was disproportionately high and that the conceptual model did not fit well with a dynamically extensible system such as UDM.
Many of the problems were not simply implementation gaps but fundamental issues. To resolve them properly, we would have had to rebuild large parts of the system anyway.
A lean restart with Cerbos
Guardian, the authorization service for Nubus, now uses the open source project Cerbos as its policy decision backend, replacing the previous OPA-based implementation. Cerbos was selected specifically because it offers features well suited to the kind of authorization decisions Guardian needs to make. Univention will publish a dedicated blog post shortly explaining the reasoning behind this decision in more detail.
Alongside the new backend, the Guardian authorization service itself has changed how it is delivered: it is now shipped as a native UCS “component,” built as a Debian package that contains a Docker container, rather than as a Docker Compose–based App Center App. Setup and upgrades of Guardian follow the UCS component lifecycle as other Nubus services like OpenLDAP or Samba, although Cerbos runs in a Docker Container. This new approach reduces the complexity needed in the App Center Docker Compose handling and installations easier to automate in software deployment tools.
What this means for operators
Since Guardian has not yet been officially released as production-ready software, this change of direction comes at the right time: We are addressing conceptual debt before the component enters production use.
The previous management UI and its associated REST API will not be continued. Instead, we are creating a system from the outset that is fundamentally aligned with the actual requirements.
For everyone operating Nubus or UCS, Guardian will become easier to manage. Fewer components mean less effort when setting up, updating, and operating the environment. Changes to policies can be tracked and reverted using the same tools that are already used throughout the rest of the infrastructure.
Since Guardian has not previously been used in the standard components of Nubus or UCS, this change has no impact on existing installations or configurations—including the UDM preview of role-based administration.
What comes next
The new Cerbos-based Guardian component is taking concrete shape. Aspects such as extensible policies for customer-specific use cases and support for Nubus extensions such as UDM Extensions are still being worked on. These are solvable tasks—not open-ended questions.
An initial production-ready release for use with Univention software is coming soon. We will keep you informed here on the blog.
We welcome your feedback—whether in the comments or directly via our Help Forum.
