[CASE STUDY]
Why high availability is key for
access management
[CASE STUDY]
All types of businesses use access management systems for security and peace of mind. But if the technology that powers these systems isn’t available, it can become a real hassle for end-users. SALTO is a leader in cloud-based access management technology as a top keys-as-a-service provider. The company, founded more than two decades ago, manufactures advanced and reliable wireless electronic locking and smart access management solutions (and a smoother, more comfortable, and secure daily life for the people using them).
Today SALTO’s products are available in over 40 countries and they have over 40M daily active users accessing over 5M equipped devices. They aim to lead the movement to replace mechanical keys with digital keys. To help them achieve this goal, they are building with CockroachDB.
"We became early adopters of CockroachDB at SALTO because we had a feeling it would be a big player in the future. We started with an expectation and a hope of what the product would become, and we were not disappointed!"
How SALTO built a cloud-based access management system on CockroachDB.
Manufacturing
Build a cloud-based platform that could collect data from devices in real-time and guarantee that customers could still unlock doors even if there was any sort of outage.
CockroachDB serves as the persistent datastore backing SALTO’s user access management system which serves customers across the world.
Challenges & Requirements
The company started in 2001 providing electronic lock hardware that was installed on-prem. While the physical products are still a large part of their business, they needed to develop a cloud-based platform that could collect data from these devices in real-time — and they needed to guarantee that customers could still unlock doors even if there was any sort of outage.
The team at SALTO knew that a “lift-and-shift” migration to the cloud was not going to be the best approach for their legacy application built on SQL Server. Here’s some of the challenges they faced:
They decided to build a new product from scratch in order to deliver a better, faster experience for their customers. Building a greenfield project with no dependencies on prior work made sense. However, it was also important for their developer team to be able to get up and running quickly with an easy-to-use solution.
After years of operating a legacy system, the team at SALTO had some requirements for their new database: active-active experience, easy to operate, easy to upgrade/make changes.
They considered PostgreSQL since it's a powerful relational database, but it also involves a lot of manual work. They wanted to “extract the developer from the infrastructure” meaning that they didn’t want them doing any database management and focus on solving the business problem at hand. With their previous infrastructure, their developers didn’t think that making small changes meant taking down the system; it seemed irrelevant to them. But it was actually having a big impact on the business.
Gorka Lerchundi, the Engineering Manager & Tech Lead at SALTO, suggested that they evaluate CockroachDB. He is a self-proclaimed “database freak” who follows the industry on Twitter and heard that the ex-Googlers who created GIMP built a database called CockroachDB.
We wanted to decouple the developer from the infrastructure team. We didn’t want to make the developer responsible for knowing that there’s a difference between primary, failover, or read replicas. We just wanted them to use the database; that's all.
– Gorka Lerchundi, Engineering Manager & Tech Lead
Solution & Deployment
After running an evaluation in 2018, SALTO became early adopters of CockroachDB. They purchased an enterprise license and were impressed with how CockroachDB, in Gorka’s words, “just worked.”
WIthin the SALTO dev environment there were two important things they needed to have out-of-the-box: 24/7 availability and the ability to simplify their database architecture by reducing operations. Gorka reported that they were able to achieve these things pretty quickly and get started building their new application on CockroachDB. When it came to developing their schema, they wanted to keep it as simple as possible. They also wanted to leverage CockroachDB’s ability to scale their application across multiple regions, and its change data capture (CDC) functionality.
CockroachDB’s CDC feature allows for synchronized and highly efficient movement of data downstream to other APIs or processing engines. Here’s how it works: A user makes a permissions request via an API that hits the database it's closest to and follows the outbox pattern. Permissions are pushed out via CDC and stored/replicated via the CDC link.
It’s important to note that CockroachDB allows you to set your own survivability goals up front. If SALTO wanted to run in a single region (Frankfurt for example), they would be able to lose a node or AZ in that region and survive with no problem at all since they follow the recommended 3 nodes and 3 AZ single-region configuration.
However, given the critical need for constant uptime, the SALTO team needed their app to survive not just node or AZ failures, but the loss of an entire region. Thus they created a multi-region setup to ensure availability. Currently SALTO is running in three regions; that way, if the entire Frankfurt GCP region goes down, they will survive because they have concurrent copies of the data in the other two regions. And, more importantly, their customers will never even notice.
If we zoom in further, you can see that there’s one API in different regions and they use Google’s load balancer to automatically hit the database region that’s closest to the user. (According to Gorka, this is for the infrastructure people to know, not for the developers to care about.)
Running a distributed system across multiple regions can be very complex. You have to determine what regions to operate in and set up networking, nodes, load balancers for each region. CockroachDB’s managed solution greatly simplifies the complexities of running a distributed system which is why SALTO switched to CockroachDB Dedicated in 2020 shortly after it became available.
Using a managed service greatly simplified our experience. We aren’t DBAs and we don’t want to be. With CockroachDB Dedicated, the infrastructure is managed by the experts that built the database. Our developers are more productive and we are actually saving time and resources.
– Gorka Lerchundi, Engineering Manager & Tech Lead
Applications
SALTO uses CockroachDB as the persistent datastore backing their user access management system to serve customers across the world. We know how this works under the covers, but what does it look like from the end-user perspective?
When you purchase a SALTO product, you get the physical locks, wallreader, keycard, key fob, wristband, etc., plus the software that supports all these devices. Once you install the physical device, you then designate the users that should have access. To open a SALTO lock, for example, the user communicates directly with the device through a card swipe, PIN code, etc. Before the door unlocks, SALTO’s platform verifies the user's access rights and returns the signal to unlock (or not, as the case may be). All of this happens in real time, and the metadata generated from every user interaction is stored within the database. So there’s an accessible log of data such as who accessed the room, what room they accessed, what time they accessed, and much more.
Since SALTO was very happy with CockroachDB’s performance for their IAM solution, they decided to use it for a new product that would have an integration with Apple. Apple has requirements for partners around performance, feature sets, survivability. When Apple releases a hardware refresh, an iOS update, or a new device, they see massive spikes in traffic. So not only was it important that SALTO could prove the reliability and performance of their product, but they had to ensure that it would scale for spiky workloads.
Since CockroachDB is built to scale automatically and horizontally, SALTO reports that it “behaved very well and was a really important component of this new product.” They could easily add more capacity whenever needed, so there was no impact to performance. And, once again, their developers didn’t need to worry about building scalability into the application layer to handle traffic spikes, because the database simply took care of it instead.
Best Practices
Gorka’s first piece of advice for anyone interested in CockroachDB, “Try it, it just works.” However, as early adopters, CockroachDB did not have as many features as it does today. SALTO has been a great design partner for some really powerful capabilities of CockroachDB on the performance side, and on the data governance/compliance side.
For example, determining your survival goals used to be relatively complicated to set up. This was a priority for SALTO so they worked with the Cockroach Labs team to help simplify the experience. The result? An abstraction layer that makes it easy to dictate your survival goals with just a few SQL commands.
The SALTO team also helped develop advanced features around CDC support, TTL support and geo-partitioning. SALTO had requirements around placing information/data in certain geographies to help with various compliance regulations like GDPR. To minimize latency, they also didn’t want their users fetching data from a node that lived across the world – it should be the one closest to them. Geo-partitioning allows you to pin data to a location at the table or even row level, which helps SALTO meet these requirements.
Another piece of advice from Gorka is that moving to a distributed database does not have to be difficult, especially if you are already familiar with standard SQL. With CockroachDB, using an ORM with a PostgreSQL driver will likely work. And even though it's not 100% wire compatible with PostgreSQL (yet), this shouldn’t be a blocker for the vast majority of applications.
Applications
For SALTO, CockroachDB’s technology solves a lot of their problems and pairs well with their own steady growth. Gorka says that their partnership with Cockroach Labs has been very valuable since it's nice to work with “pleasant, forward-thinking, open-minded people that see value in your partnership”.
In the near future, SALTO plans to move some of their workloads to CockroachDB Serverless which is a fully-managed service with great benefits (automated scale! No ops!). Gorka thinks this serverless offering will be a hit with developers and make their lives even easier.
Finally, if you are interested in IAM and working at a leading access management company, SALTO is always hiring. Plus you get to work with CockroachDB. Check out their job listings here.
Ready to get started?
Go hands-on with 100% free CockroachDB Serverless. Spin up your first cluster in just a few clicks.
Get started Compare products