Skip to content

Commit ae931d0

Browse files
elizabethhealyelizabethhealy
authored
feat(authz): Remove org-admin role, move privileges to admin role (#1740)
### Proposed Changes * dont need a separate org-admin role, remove it from keycloak setup and casbin config ### Checklist - [ ] I have added or updated unit tests - [ ] I have added or updated integration tests (if appropriate) - [ ] I have added or updated documentation ### Testing Instructions
1 parent 88496cd commit ae931d0

File tree

9 files changed

+67
-206
lines changed

9 files changed

+67
-206
lines changed

‎docs/configuration.md‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -256,19 +256,10 @@ server:
256256
map:
257257
standard: opentdf-standard
258258
admin: opentdf-admin
259-
org-admin: opentdf-org-admin
260259
261260
## Custom policy (see examples https://github.com/casbin/casbin/tree/master/examples)
262261
csv: |
263-
p, role:org-admin, policy:attributes, *, *, allow
264-
p, role:org-admin, policy:subject-mappings, *, *, allow
265-
p, role:org-admin, policy:resource-mappings, *, *, allow
266-
p, role:org-admin, policy:kas-registry, *, *, allow
267-
p, role:org-admin, policy:unsafe, *, *, allow
268-
p, role:admin, policy:attributes, read, allow
269-
p, role:admin, policy:subject-mappings, read, allow
270-
p, role:admin, policy:resource-mappings, read, allow
271-
p, role:admin, policy:kas-registry, read, allow
262+
p, role:admin, *, *, allow
272263
p, role:standard, policy:attributes, read, allow
273264
p, role:standard, policy:subject-mappings, read, allow
274265
p, role:standard, policy:resource-mappings, read, allow

‎lib/fixtures/keycloak.go‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,6 @@ func SetupKeycloak(ctx context.Context, kcConnectParams KeycloakConnectParams) e
120120

121121
opentdfClientID := "opentdf"
122122
opentdfSdkClientID := "opentdf-sdk"
123-
opentdfOrgAdminRoleName := "opentdf-org-admin"
124123
opentdfAdminRoleName := "opentdf-admin"
125124
opentdfStandardRoleName := "opentdf-standard"
126125
testingOnlyRoleName := "opentdf-testing-role"
@@ -155,7 +154,7 @@ func SetupKeycloak(ctx context.Context, kcConnectParams KeycloakConnectParams) e
155154
}
156155

157156
// Create Roles
158-
roles := []string{opentdfOrgAdminRoleName, opentdfAdminRoleName, opentdfStandardRoleName, testingOnlyRoleName}
157+
roles := []string{opentdfAdminRoleName, opentdfStandardRoleName, testingOnlyRoleName}
159158
for _, role := range roles {
160159
_, err := client.CreateRealmRole(ctx, token.AccessToken, kcConnectParams.Realm, gocloak.Role{
161160
Name: gocloak.StringP(role),
@@ -173,8 +172,7 @@ func SetupKeycloak(ctx context.Context, kcConnectParams KeycloakConnectParams) e
173172
}
174173

175174
// Get the roles
176-
var opentdfOrgAdminRole *gocloak.Role
177-
// var opentdfAdminRole *gocloak.Role
175+
var opentdfAdminRole *gocloak.Role
178176
var opentdfStandardRole *gocloak.Role
179177
var testingOnlyRole *gocloak.Role
180178
realmRoles, err := client.GetRealmRoles(ctx, token.AccessToken, kcConnectParams.Realm, gocloak.GetRoleParams{
@@ -187,10 +185,8 @@ func SetupKeycloak(ctx context.Context, kcConnectParams KeycloakConnectParams) e
187185
slog.Info(fmt.Sprintf("✅ Roles found: %d", len(realmRoles))) // , slog.String("roles", fmt.Sprintf("%v", realmRoles))
188186
for _, role := range realmRoles {
189187
switch *role.Name {
190-
case opentdfOrgAdminRoleName:
191-
opentdfOrgAdminRole = role
192-
// case opentdfAdminRoleName:
193-
// opentdfAdminRole = role
188+
case opentdfAdminRoleName:
189+
opentdfAdminRole = role
194190
case opentdfStandardRoleName:
195191
opentdfStandardRole = role
196192
case testingOnlyRoleName:
@@ -207,7 +203,7 @@ func SetupKeycloak(ctx context.Context, kcConnectParams KeycloakConnectParams) e
207203
ClientAuthenticatorType: gocloak.StringP("client-secret"),
208204
Secret: gocloak.StringP("secret"),
209205
ProtocolMappers: &protocolMappers,
210-
}, []gocloak.Role{*opentdfOrgAdminRole}, nil)
206+
}, []gocloak.Role{*opentdfAdminRole}, nil)
211207
if err != nil {
212208
return err
213209
}

‎opentdf-dev.yaml‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -49,15 +49,10 @@ server:
4949
map:
5050
# standard: opentdf-standard
5151
# admin: opentdf-admin
52-
# org-admin: opentdf-org-admin
5352

5453
## Custom policy (see examples https://github.com/casbin/casbin/tree/master/examples)
5554
csv: #|
56-
# p, role:org-admin, policy:attributes, *, *, allow
57-
# p, role:org-admin, policy:subject-mappings, *, *, allow
58-
# p, role:org-admin, policy:resource-mappings, *, *, allow
59-
# p, role:org-admin, policy:kas-registry, *, *, allow
60-
# p, role:org-admin, policy:unsafe, *, *, allow
55+
# p, role:admin, *, *, allow
6156

6257
## Custom model (see https://casbin.org/docs/syntax-for-models/)
6358
model: #|

‎opentdf-example.yaml‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -40,15 +40,10 @@ server:
4040
map:
4141
# standard: opentdf-standard
4242
# admin: opentdf-admin
43-
# org-admin: opentdf-org-admin
4443

4544
## Custom policy (see examples https://github.com/casbin/casbin/tree/master/examples)
4645
csv: #|
47-
# p, role:org-admin, policy:attributes, *, *, allow
48-
# p, role:org-admin, policy:subject-mappings, *, *, allow
49-
# p, role:org-admin, policy:resource-mappings, *, *, allow
50-
# p, role:org-admin, policy:kas-registry, *, *, allow
51-
# p, role:org-admin, policy:unsafe, *, *, allow
46+
# p, role:admin, *, *, allow
5247
## Custom model (see https://casbin.org/docs/syntax-for-models/)
5348
model: #|
5449
# [request_definition]

‎opentdf-with-hsm.yaml‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -47,14 +47,9 @@ server:
4747
map:
4848
# standard: opentdf-standard
4949
# admin: opentdf-admin
50-
# org-admin: opentdf-org-admin
5150
## Custom policy (see examples https://github.com/casbin/casbin/tree/master/examples)
5251
csv: #|
53-
# p, role:org-admin, policy:attributes, *, *, allow
54-
# p, role:org-admin, policy:subject-mappings, *, *, allow
55-
# p, role:org-admin, policy:resource-mappings, *, *, allow
56-
# p, role:org-admin, policy:kas-registry, *, *, allow
57-
# p, role:org-admin, policy:unsafe, *, *, allow
52+
# p, role:admin, *, *, allow
5853
## Custom model (see https://casbin.org/docs/syntax-for-models/)
5954
model: #|
6055
# [request_definition]

‎service/cmd/keycloak_data.yaml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ realms:
1313
realm: opentdf
1414
enabled: true
1515
custom_realm_roles:
16-
- name: opentdf-org-admin
1716
- name: opentdf-admin
1817
- name: opentdf-standard
1918
custom_client_roles:
@@ -35,7 +34,7 @@ realms:
3534
protocolMappers:
3635
- *customAudMapper
3736
sa_realm_roles:
38-
- opentdf-org-admin
37+
- opentdf-admin
3938
- client:
4039
clientID: opentdf-sdk
4140
enabled: true
@@ -98,7 +97,7 @@ realms:
9897
groups:
9998
- mygroup
10099
realmRoles:
101-
- opentdf-org-admin
100+
- opentdf-admin
102101
clientRoles:
103102
realm-management:
104103
- view-clients

‎service/internal/auth/casbin.go‎

Lines changed: 10 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -24,14 +24,12 @@ var (
2424
var defaultRoleClaim = "realm_access.roles"
2525

2626
var defaultRoleMap = map[string]string{
27-
"standard": "opentdf-standard",
28-
"admin": "opentdf-admin",
29-
"org-admin": "opentdf-org-admin",
27+
"standard": "opentdf-standard",
28+
"admin": "opentdf-admin",
3029
}
3130

3231
var defaultPolicy = `
3332
## Roles (prefixed with role:)
34-
# org-admin - organization admin
3533
# admin - admin
3634
# standard - standard
3735
# unknown - unknown role or no role
@@ -46,70 +44,35 @@ var defaultPolicy = `
4644
# delete - delete the resource
4745
# unsafe - unsafe actions
4846
49-
# Role: Org-Admin
50-
## gRPC routes
51-
p, role:org-admin, policy.*, *, allow
52-
p, role:org-admin, kasregistry.*, *, allow
53-
p, role:org-admin, kas.AccessService/Rewrap, *, allow
54-
p, role:org-admin, authorization.*, *, allow
55-
## HTTP routes
56-
p, role:org-admin, /attributes*, *, allow
57-
p, role:org-admin, /namespaces*, *, allow
58-
p, role:org-admin, /subject-mappings*, *, allow
59-
p, role:org-admin, /resource-mappings*, *, allow
60-
p, role:org-admin, /key-access-servers*, *, allow
61-
p, role:org-admin, /kas/v2/rewrap, *, allow
62-
p, role:org-admin, /unsafe*, *, allow
63-
p, role:org-admin, /v1/entitlements, *, allow
64-
p, role:org-admin, /v1/authorization, *, allow
65-
p, role:org-admin, /v1/token/authorization, *, allow
6647
6748
# Role: Admin
68-
## gRPC routes
69-
p, role:admin, policy.*, read, allow
70-
p, role:admin, policy.*, write, allow
71-
p, role:admin, policy.*, delete, allow
72-
p, role:admin, kasregistry.*, *, allow
73-
p, role:admin, kas.AccessService/Rewrap, *, allow
74-
p, role:admin, authorization.*, *, allow
75-
## HTTP routes
76-
p, role:admin, /attributes*, *, allow
77-
p, role:admin, /namespaces*, *, allow
78-
p, role:admin, /subject-mappings*, *, allow
79-
p, role:admin, /resource-mappings*, *, allow
80-
p, role:admin, /key-access-servers*, *, allow
81-
p, role:admin, /kas/v2/rewrap, *, allow
82-
p, role:admin, /v1/entitlements, *, allow
83-
p, role:admin, /v1/authorization, *, allow
84-
p, role:admin, /v1/token/authorization, *, allow
85-
49+
## gRPC and HTTP routes
50+
p, role:admin, *, *, allow
8651
8752
## Role: Standard
8853
## gRPC routes
8954
p, role:standard, policy.*, read, allow
9055
p, role:standard, kasregistry.*, read, allow
91-
p, role:standard, kas.AccessService/Rewrap, *, allow
92-
p, role:standard, authorization.AuthorizationService/GetDecisions, read, allow
93-
p, role:standard, authorization.AuthorizationService/GetDecisionsByToken, read, allow
56+
p, role:standard, kas.AccessService/Rewrap, *, allow
57+
p, role:standard, authorization.AuthorizationService/GetDecisions, read, allow
58+
p, role:standard, authorization.AuthorizationService/GetDecisionsByToken, read, allow
59+
9460
## HTTP routes
9561
p, role:standard, /attributes*, read, allow
9662
p, role:standard, /namespaces*, read, allow
9763
p, role:standard, /subject-mappings*, read, allow
9864
p, role:standard, /resource-mappings*, read, allow
9965
p, role:standard, /key-access-servers*, read, allow
10066
p, role:standard, /kas/v2/rewrap, write, allow
101-
p, role:standard, /entityresolution/resolve, write, allow
102-
p, role:standard, /v1/authorization, write, allow
103-
p, role:standard, /v1/token/authorization, write, allow
67+
p, role:standard, /v1/authorization, write, allow
68+
p, role:standard, /v1/token/authorization, write, allow
10469
10570
# Public routes
10671
## gRPC routes
10772
## for ERS, right now we don't care about requester role, just that a valid jwt is provided when the OPA engine calls (enforced in the ERS itself, not casbin)
108-
p, role:unknown, entityresolution.EntityResolutionService.ResolveEntities, write, allow
10973
p, role:unknown, kas.AccessService/Rewrap, *, allow
11074
## HTTP routes
11175
## for ERS, right now we don't care about requester role, just that a valid jwt is provided when the OPA engine calls (enforced in the ERS itself, not casbin)
112-
p, role:unknown, /entityresolution/resolve, write, allow
11376
p, role:unknown, /kas/v2/rewrap, *, allow
11477
11578
`

0 commit comments

Comments
 (0)