mirror of
https://github.com/NLnetLabs/krill.git
synced 2026-09-21 17:07:44 +02:00
Ximon EighteenandGitHub
f3e8023be5
- Various changes to support a grey policy in between black and white approach of permitting or denying access to CAs entirely, whereby a user can have a different role in one CA than in another. - Introduces the NoResourceType for requests not relating to a specific "resource", e.g. CA, such as LOGIN. NoResourceType maps to `nil` in Oso policy language. - Add support for Permission constants in Polar files. Build the Permission enum using a macro. - Added CA_ADMIN (for bulk operations) and CA_DELETE permissions. - Support loading more than one custom auth policy file. - Checks were missing on some API calls if the user had the necessary permission *on the relevant resources*. - Rename the team policy as a demo to indicate that it is educational only. - Split a role-per-ca demo out of the team policy demo. - Extend the with_ta Cypress test to cover the role-per-ca ca demo policy (as it creates the needed data). - Don't misrepresent an external policy file in log statements as being internal. - Better comments describing what the tests are doing. - Remove unused role parameter in team access demo policy. - Add disallow() in Oso policies as a way to define deny rules.
14 lines
551 B
Plaintext
14 lines
551 B
Plaintext
################################################################################
|
|
### Role aliases
|
|
################################################################################
|
|
|
|
# Role names can be aliased so that they can be referred to, e.g. in actor
|
|
# attributes, via other names. For example the following aliases the "readonly"
|
|
# role to the name "Read Only" and does a quick sanity check to show that it
|
|
# works.
|
|
#
|
|
# role_allow("Read Only", action: Permission) if
|
|
# role_allow("readonly", action);
|
|
#
|
|
# ?= role_allow("Read Only", CA_LIST);
|