From 904c9bdb22b4447fde9a4b012c9bdbf8db4cf4c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= Date: Tue, 4 Jun 2024 17:11:31 +0200 Subject: [PATCH 1/4] add some accessRestrictions docs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Fredrik Adelöw --- docs/auth/service-to-service-auth.md | 89 ++++++++++++++++++++++++++++ 1 file changed, 89 insertions(+) diff --git a/docs/auth/service-to-service-auth.md b/docs/auth/service-to-service-auth.md index 1d6de30ce6..b4d6bb5750 100644 --- a/docs/auth/service-to-service-auth.md +++ b/docs/auth/service-to-service-auth.md @@ -94,6 +94,9 @@ backend: options: token: ${CICD_TOKEN} subject: cicd-system-completion-events + # Restrictions are optional; see below + accessRestrictions: + - plugin: events - type: static options: token: ${ADMIN_CURL_TOKEN} @@ -260,3 +263,89 @@ header: ```yaml Authorization: Bearer eZv5o+fW3KnR3kVabMW4ZcDNLPl8nmMW ``` + +## Access Restrictions + +Each `externalAccess` entry may optionally have an `accessRestrictions` key, +which limits what that particular access method can do. Let's look at an +example: + +```yaml title="in e.g. app-config.production.yaml" +backend: + auth: + externalAccess: + - type: static + options: + token: ${CICD_TOKEN} + subject: cicd-system-completion-events + accessRestrictions: + - plugin: events +``` + +In this short example there's only one entry. It says that for anyone trying to +make access with the CICD token, they will be rejected if they try to contact +anything but the `events` backend plugin. You could add additional entries to +the array that allow targeting more plugins if that's what you want. + +:::note Note + +If no `accessRestrictions` are added, the access method has unlimited access to +all functionality of all plugins. It is recommended that you try to specify +access restrictions whenever possible, to reduce risk. + +::: + +Each entry has one or more of the following fields: + +- **`plugin`**: Required. A plugin ID as a string, for example `'catalog'`. Permits + access to make requests to this plugin. Can be further refined by setting + additional fields as per below. + + Example: + + ```yaml + accessRestrictions: + # access to any other plugin will be rejected + - plugin: my-plugin + ``` + +- **`permission`**: Optional. A collection (comma/space separated string or + string array) of permission names. If given, this method is limited to only + performing actions with these named permissions in the plugin with the ID + given above. + + Note that this only applies where permissions checks are enabled in the first + place. Endpoints that are not protected by the permissions system at all, are + not affected by this setting. + + Example: + + ```yaml + accessRestrictions: + - plugin: my-plugin + # any other permission check will be rejected + permission: my-plugin.add-item, my-plugin.remove-item + ``` + +- **`permissionAttribute`**: Optional. A key-value object of permission attributes + where each value is a collection (comma/space separated string or string + array) of allowed such values. If given, this method is limited to only + performing actions whose permissions have these attributes. + + Note that this only applies where permissions checks are + enabled in the first place. Endpoints that are not protected by + the permissions system at all, are not affected by this + setting. + + In practice, this is typically used to limit by the `action` attribute, for + `'create'`, `'read'`, `'update'`, or `'delete'` values. + + Example: + + ```yaml + accessRestrictions: + - plugin: my-plugin + permissionAttribute: + # updates and deletes will be rejected + action: create, read + ``` From f6d9a5f7281e2013c7f8afc3990951612c02d068 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= Date: Wed, 5 Jun 2024 13:37:22 +0200 Subject: [PATCH 2/4] Update docs/auth/service-to-service-auth.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Vincenzo Scamporlino Signed-off-by: Fredrik Adelöw --- docs/auth/service-to-service-auth.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/auth/service-to-service-auth.md b/docs/auth/service-to-service-auth.md index b4d6bb5750..f87ca8ed10 100644 --- a/docs/auth/service-to-service-auth.md +++ b/docs/auth/service-to-service-auth.md @@ -347,5 +347,7 @@ Each entry has one or more of the following fields: - plugin: my-plugin permissionAttribute: # updates and deletes will be rejected - action: create, read + action: + - create + - read ``` From df8063f7adc8d18b4667895995fd49c792e34ea7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= Date: Wed, 5 Jun 2024 13:37:28 +0200 Subject: [PATCH 3/4] Update docs/auth/service-to-service-auth.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Vincenzo Scamporlino Signed-off-by: Fredrik Adelöw --- docs/auth/service-to-service-auth.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/auth/service-to-service-auth.md b/docs/auth/service-to-service-auth.md index f87ca8ed10..f8b199a632 100644 --- a/docs/auth/service-to-service-auth.md +++ b/docs/auth/service-to-service-auth.md @@ -324,7 +324,9 @@ Each entry has one or more of the following fields: accessRestrictions: - plugin: my-plugin # any other permission check will be rejected - permission: my-plugin.add-item, my-plugin.remove-item + permission: + - my-plugin.add-item + - my-plugin.remove-item ``` - **`permissionAttribute`**: Optional. A key-value object of permission attributes From 15e23227e5e23e934e532070a448f5ab71e44ee7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= Date: Wed, 5 Jun 2024 13:40:57 +0200 Subject: [PATCH 4/4] mention shorthands MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Fredrik Adelöw --- docs/auth/service-to-service-auth.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/docs/auth/service-to-service-auth.md b/docs/auth/service-to-service-auth.md index f8b199a632..8c9130173c 100644 --- a/docs/auth/service-to-service-auth.md +++ b/docs/auth/service-to-service-auth.md @@ -323,10 +323,12 @@ Each entry has one or more of the following fields: ```yaml accessRestrictions: - plugin: my-plugin - # any other permission check will be rejected + # Any other permission check will be rejected. permission: - my-plugin.add-item - my-plugin.remove-item + # Also supports the shorthand form: + # permission: my-plugin.add-item, my-plugin.remove-item ``` - **`permissionAttribute`**: Optional. A key-value object of permission attributes @@ -348,8 +350,10 @@ Each entry has one or more of the following fields: accessRestrictions: - plugin: my-plugin permissionAttribute: - # updates and deletes will be rejected + # Updates and deletes will be rejected. action: - create - read + # Also supports the shorthand form: + # action: create, read ```