This PR restructures how authentication policies are used in Krill. It
removes the use of Oso and its policy definition language and instead
switches to simple, straightforward mappings between permissions, roles,
and users.
The existing concept of roles is augmented to serve as the central
configuration option for limiting a user’s access to certain action and
resources. Roles are now user configurable via the new auth_roles
configuration directive. For each role, a set of permissions has to be
provided. Optionally, a list of resource handles (vulgo: CAs) can be given
in which case access is limited to these resources.
The authentication providers now assign one of these roles to each logged
in user.
The OpenID Connect provider now only determines claims for “id,” i.e., the
user name, and the “role.” Since we replaced the previous use of JMES
paths with custom functions with a more stringent model of matching and
substitution, the configuration had to change in a non-compatible way,
anyway, so we cleaned it up a bit and switched from a map to an array for
the claims.
For the config file provider, this was already possible by adding a “role”
attribute. This has now been changed into a “role” field of the user
details. In order to make upgrading seamless, the “role” attribute is
still accepted but a deprecation warning is logged. Since the auth_users
configuration is not used for the OpenID Connect provider any more, the
password_hash and salt fields of the user details are now mandatory.
Custom policies have been removed.
This is a breaking change.
This PR refactors how response for the HTTP metrics endpoint is being
assembled. It uses a very thin layer on top of the bare Prometheus
protocol instead of manually writing all the content.
Ideally, this doesn’t change any of the metrics. It does, however,
slightly change the formatting.
This PR renames the `timing_config` options in the Krill config to
`ta_config`. It was already required to have this name if the config
was used by the Krill TA signer. The `timing_config` name is allowed
as an alias in both cases now.
Fails regularly due to hitting GH API limits, the underlying GH Action hasn't been updated for 4 years, and the functionality is replaced by GH security vuln notifications anyway.
This PR changes how the clients -- krillc, krillta, as well as the
integration tests -- work to better fit the derive model provided by clap.
This results in basically everything in the cli module and all the
integration tests being different now.
The PR slightly changes the options for both krillc and krillta. For krillc,
the --server, --token, --format, and --api options are now before the first
subcommand (since they affect all commands). For krillta, those options are
now after krillta proxy but before the next subcommand, while --format is
now after krillta signer.
This PR also removes client support and integration tests for RTA.
This is a breaking change.
This PR adds an explicit lifetime to the Open ID connection, and if the
connection has existed for more than 60 seconds, it will initialise a new
connection in order to pick up possible configuration changes at the provider.
This PR upgrades the codebase to Rust edition 2021.
This mostly just means removing a number of use statements for TryFrom and
TryInto. There are no actual code changes.
This PR fixes all warnings from nightly Clippy as of today and enables a
Clippy run in the CI workflow for the stable channel with all features
enabled.
