Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: properly set casbin authz policy #1776

Merged
merged 6 commits into from
Nov 26, 2024

Conversation

strantalis
Copy link
Member

@strantalis strantalis commented Nov 20, 2024

Proposed Changes

When calling the SetPolicy function it was overwrittng what ever was defined within the yaml configuration. This pr addresses this by changing the current functionality to overwrite the default policy while still allowing the policy in configuration to take precedence.

The pull request also introduces two new fields UsernameClaim and GroupsClaim aligning more with openid based claim names and not keycloak realm roles. The authz policy will pull the username and list of groups and run them through the casbin enforce function now. A user can now scope a policy to a username.

p, strantalis, policy.attributes.*, read, allow

Checklist

  • I have added or updated unit tests
  • I have added or updated integration tests (if appropriate)
  • I have added or updated documentation

Testing Instructions

@strantalis strantalis marked this pull request as ready for review November 22, 2024 21:18
@strantalis strantalis requested a review from a team as a code owner November 22, 2024 21:18
@strantalis strantalis added this pull request to the merge queue Nov 26, 2024
@strantalis strantalis removed this pull request from the merge queue due to a manual request Nov 26, 2024
@jrschumacher
Copy link
Member

There is some deprecation here that has been removed, but since it was for internal purposes there is no concern about consumers being impacted. We are leaving deprecated yaml config such as roleMap since it could impact consumers.

@jrschumacher jrschumacher added this pull request to the merge queue Nov 26, 2024
Merged via the queue into opentdf:main with commit d4b501c Nov 26, 2024
21 checks passed
github-merge-queue bot pushed a commit that referenced this pull request Nov 27, 2024
🤖 I have created a release *beep* *boop*
---


##
[0.4.30](service/v0.4.29...service/v0.4.30)
(2024-11-27)


### Features

* **core:** Introduce ERS mode, ability to connect to remote ERS
([#1735](#1735))
([a118316](a118316))
* **policy:** limit/offset throughout LIST service RPCs/db
([#1669](#1669))
([ec46a3a](ec46a3a)),
closes [#55](#55)


### Bug Fixes

* **core:** Autobump service
([#1789](#1789))
([ff7c6f3](ff7c6f3))
* **core:** Set token endpoint manually if client creds provided in
server sdk_config
([#1780](#1780))
([07a1dbd](07a1dbd))
* properly set casbin authz policy
([#1776](#1776))
([d4b501c](d4b501c))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants