mirror of
https://github.com/NLnetLabs/krill.git
synced 2026-09-23 18:04:54 +02:00
Ximon EighteenandGitHub
f3e8023be5
- Various changes to support a grey policy in between black and white approach of permitting or denying access to CAs entirely, whereby a user can have a different role in one CA than in another. - Introduces the NoResourceType for requests not relating to a specific "resource", e.g. CA, such as LOGIN. NoResourceType maps to `nil` in Oso policy language. - Add support for Permission constants in Polar files. Build the Permission enum using a macro. - Added CA_ADMIN (for bulk operations) and CA_DELETE permissions. - Support loading more than one custom auth policy file. - Checks were missing on some API calls if the user had the necessary permission *on the relevant resources*. - Rename the team policy as a demo to indicate that it is educational only. - Split a role-per-ca demo out of the team policy demo. - Extend the with_ta Cypress test to cover the role-per-ca ca demo policy (as it creates the needed data). - Don't misrepresent an external policy file in log statements as being internal. - Better comments describing what the tests are doing. - Remove unused role parameter in team access demo policy. - Add disallow() in Oso policies as a way to define deny rules.
18 lines
1.2 KiB
Plaintext
18 lines
1.2 KiB
Plaintext
# This test demonstrates both a team based custom authorization policy and
|
|
# using attribute hiding and excess attributes as one way of controlling what is
|
|
# shown in the UI for a user.
|
|
|
|
service_uri = "https://localhost:3000/"
|
|
log_level = "info"
|
|
log_type = "stderr"
|
|
|
|
auth_type = "config-file"
|
|
auth_token = "secret"
|
|
auth_policies = ["doc/policies/team-based-access-demo.polar"]
|
|
auth_private_attributes = ["team", "teamrole"]
|
|
|
|
[auth_users]
|
|
"team1ro@krill" = { attributes={ team="t1", "Team"="Red Team", teamrole="readonly", "Team Role"="Read Only" }, password_hash="403169d6cf93e2cc895844eef132a1c45953b8c6db2854a8a7a122dc505f997c" } # team1ro
|
|
"team1rw@krill" = { attributes={ team="t1", "Team"="Red Team", teamrole="readwrite", "Team Role"="Read Write" }, password_hash="f26cd2a78c38840866155e05f8e447c30c7469862fe11ae75cd2e17a73fc6f71" } # team1rw
|
|
"team2ro@krill" = { attributes={ team="t2", "Team"="Blue Team", teamrole="readonly", "Team Role"="Read Only" }, password_hash="c9166dd49708380c18846cf56b81c8f066d1107b9cd95d4b22657090c0b9b145" } # team2ro
|
|
"team2rw@krill" = { attributes={ team="t2", "Team"="Blue Team", teamrole="readwrite", "Team Role"="Read Write" }, password_hash="82d17e3a693214aebaa009b8f79a36de18f7a3301c446faa79f147d26f389ed0" } # team2rw |