This PR restructures how authentication policies are used in Krill. It
removes the use of Oso and its policy definition language and instead
switches to simple, straightforward mappings between permissions, roles,
and users.
The existing concept of roles is augmented to serve as the central
configuration option for limiting a user’s access to certain action and
resources. Roles are now user configurable via the new auth_roles
configuration directive. For each role, a set of permissions has to be
provided. Optionally, a list of resource handles (vulgo: CAs) can be given
in which case access is limited to these resources.
The authentication providers now assign one of these roles to each logged
in user.
The OpenID Connect provider now only determines claims for “id,” i.e., the
user name, and the “role.” Since we replaced the previous use of JMES
paths with custom functions with a more stringent model of matching and
substitution, the configuration had to change in a non-compatible way,
anyway, so we cleaned it up a bit and switched from a map to an array for
the claims.
For the config file provider, this was already possible by adding a “role”
attribute. This has now been changed into a “role” field of the user
details. In order to make upgrading seamless, the “role” attribute is
still accepted but a deprecation warning is logged. Since the auth_users
configuration is not used for the OpenID Connect provider any more, the
password_hash and salt fields of the user details are now mandatory.
Custom policies have been removed.
This is a breaking change.
This PR changes how the clients -- krillc, krillta, as well as the
integration tests -- work to better fit the derive model provided by clap.
This results in basically everything in the cli module and all the
integration tests being different now.
The PR slightly changes the options for both krillc and krillta. For krillc,
the --server, --token, --format, and --api options are now before the first
subcommand (since they affect all commands). For krillta, those options are
now after krillta proxy but before the next subcommand, while --format is
now after krillta signer.
This PR also removes client support and integration tests for RTA.
This is a breaking change.
* Add mapping to support that parent and child use different rc names.
* Export child (so that we can test importing it).
* Import child.
* Force parent refresh in resource check loop.
* allow users to just use this, rather than create/delete
* needed to deal with potentially existing history where Krill
instances <0.13.0 ended up with AspaDefinitions with an
empty providers list.
* Remove support for migrating pre-0.9.0 versions.
* Keep publisher files in one place only.
* Improve merging new publish elements into staged elements.
* Upgrade pre-0.12.0 RepositoryContent.
* Upgrade v0.12.x RepositoryContent
* Log errors in case of merge conflicts
* No session reset on 0.13 upgrade (#1028)
---------
Co-authored-by: ximon18 <3304436+ximon18@users.noreply.github.com>
* Use types which were ported into rpki-rs.
* Update dependency to rpki-rs 0.14.3-dev.
* IGNORE old_events test for now, see issue: #819
* Quick fix for compilation using --all-features. See issue #821
Co-authored-by: Ximon Eighteen <3304436+ximon18@users.noreply.github.com>
