How to build an enterprise app without an expensive IAM using Daml [2021]
Nothing is loaded from YouTube until you press play, and then without tracking cookies.
About this video
📚Check out Daml Learning Center: bit.ly/LearnDaml 📖Join our forum and get started: bit.ly/tryDaml
Daml is a development framework for creating systems of record that securely connect across business processes and data boundaries while retaining privacy, guaranteeing data integrity, and enforcing strict authorization. Allowing such systems to cross boundaries — legal, regulatory, organizational, or other — enables them to form seamless economic networks.
Radically simpler #IAM (Identity management system) and #RBAC (Role-based access control) using #DAML
POC of a DAML model for the scenario of an employee making a proposal to a company on the behalf of their employer, with the employees of the other company accepting or rejecting the proposal. It is designed to be an example of how DAML can separate the company party from the employee parties who can act on behalf of it, without having to rely on an external IAM/RBAC.
Included in this repo is a DAML model as well as a DAML Trigger that is run as each company party.
Each company has a public and a private contract. A company can have any number of employees who are completely private to other companies. Employees are given access from the company to perform various actions on, or on behalf of the company. After bootstrapping, the company party does not need to be used to perform any action.
The proposal workflow:
An employee of a Company A can make a proposal to Company B Employees of Company B can then accept or reject the proposal When the proposal is accepted or rejected, a notification is sent to the employees of Company A.
The model:
The model separates the public space where information about the companies live, and the private space, where internal company information lives. The company’s private space is then split between the company and the employees, who can be authorized or delegated to perform different actions based on who the employee is. For example, the trigger currently del
Transcript
625 wordsCaptions as YouTube publishes them, usually machine-generated, so names such as Daml and Canton can be misheard.
- 0:00
this is an example of how you can use daml to have a company delegate actions to their employees to act on behalf of the company but allow these actions to be taken by an employee operating under their own party as opposed to by a single company party that employees have to share access to so in this scenario we want employees of company a to be able to make a proposal to company b and for the employees of company b to be able to accept this proposal but
- 0:25
the trick here is we want for the employees of company a to have no direct knowledge of the employees within company b and vice versa so in many cases we can delegate with choices that can be exercised by the employee on the company's contract but in this scenario due to the privacy concerns we use some automation triggers written in demo that act on behalf of the company parties so right now we're looking at the project dabble console
- 0:50
that is running our model and the automation triggers for this scenario when we click on one of the parties here we can see what contracts they would be able to see if they were logged in this is the public party which all other parties have access to you can see these public company contracts which have some public information such as the name of the company and it could have any other information you
- 1:13
want to share with everybody about your company however employees of the different companies have access to this internal company contract which has more private information such as the employees of the company who's in management and anything you'd want to keep private to the outside world but be shared amongst your employees within the company so let's say employee a1 wants to make a proposal to company b on behalf of company a they would go to this internal company contract they would make a proposal
- 1:46
say i am employee a1 i'd like to make proposal to company b who i do have knowledge of because it's in that public record and i do is make a trade submit that now if you go to company b's party company b can see the actual proposal contract which is fine but the employees can't see that because if they were observers on this proposal then they'd be able to see all the other observers on the proposal which would mean that other employees at the other company would be able to see their party id
- 2:26
and have access to that so what company b does is through this automated trigger without anyone having to log into employee b's party create these delegated proposals which the employees of company b can see their own and then exercise the choice that they want to accept or reject it we'll have employee b1 accept it now the automation trigger for company b will go and resolve that original proposal
- 2:57
which in this case just sends a notification to the employees of company a so a1 now sees this notification that says the proposal make a traders accepted and they can dismiss that notification so the model here is set up to delegate this proposal acceptance to all the employees of the company but the logic could easily change to only delegate to certain employees of different groups
- 3:23
such as management or different teams that would all be defined in demo and then could be onboarded by an employee of the company so you can see here that it is very achievable and relatively simple to securely and privately handle this sort of role-based access and action delegation directly in demo