Skip to main content

Libra

The authorization proxy for NGSI-LD context brokers.

Authenticates every request, narrows it to what your policy allows, and filters every response on the way back. No context data stored.

The caller sendsto Libra
GET /ngsi-ld/v1/entities?type=Vehicle,Building HTTP/1.1
Authorization: Bearer libra_9f3e…
NGSILD-Tenant: fleet
Librachanges
- Building
- Authorization
+ X-Auth-Subject
+ X-Auth-Groups
The broker receivesfrom Libra
GET /ngsi-ld/v1/entities?type=Vehicle HTTP/1.1
X-Auth-Subject: ingest
X-Auth-Groups: fleet
NGSILD-Tenant: fleet
The policylibra.toml
[[policy]]
id = "fleet-read"
description = "The fleet group may read vehicles"
priority = 100

[policy.condition]
groups = ["fleet"]
operations = ["read"]

[policy.access]
effect = "allow"

[policy.access.entity-type]
allowed = ["Vehicle"]

The grant covers Vehicle, so the selection that leaves Libra names only Vehicle. The token stops at Libra; the broker is told who asked through X-Auth-* headers instead.

Get startedRead the docs

Open beta, not independently audited. Read the known limitations before putting Libra in front of production data.

Sovereignty

The access rules decide who gets your data, so they belong to you.

An EU open standard

Libra speaks ETSI NGSI-LD rather than a vendor-specific API, so it fronts the context broker you choose instead of locking you into one.

Your policies, your repository

Policies are plain TOML files you keep and version yourself. The broker stays exactly as it is, and the caller credential stops at Libra.

Your machines

The FOSS edition runs under the EUPL-1.2 with no account, no licence key, and no telemetry.

SenLab's full position on ownership, export, and reversibility is at velacontext.com/sovereignty.

Editions

Libra is open core. The FOSS edition is complete on its own: it authenticates, decides, and enforces without a licence key, account, or call-home check, and everything released in it stays in it. Pro adds operational capabilities around the same proxy: policy and key management over HTTP with hot reload, several replicas on a shared key store, resilience against a failing broker, rate limiting per principal and tenant, an NGSI-LD response cache, request deduplication, identity provider integration, and federation. What each edition holds.

Community

Libra is not accepting external source-code contributions yet. Bug reports, feature requests, and documentation feedback are welcome.

General contact: info@senlab.io. Never report a security vulnerability through a public issue — follow the security policy instead.