Skip to content

feat(sdk): don't require client_id in the auth token #544

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
mkleene merged 6 commits into from
Apr 12, 2024
Merged

feat(sdk): don't require client_id in the auth token #544

mkleene merged 6 commits into from
Apr 12, 2024

Conversation

@mkleene
Copy link
Contributor

@mkleene mkleene commented Apr 8, 2024

This isn't a claim that is in any spec, except for token exchange drafts

Instead we should allow the roles specified in the token to dictate access to resources.

mkleene added 3 commits April 8, 2024 14:13
@mkleene
feat(sdk): don't require client id as a parameter
3564328 
This isn't a claim that is in any spec, except for token
exchange drafts

Instead we should allow the roles specified in the token
to dictate access to resources.
@mkleene
remove this in the yaml examples
bccc64d
@mkleene
Merge branch 'main' into dont-require-client-id
a022d09
@mkleene mkleene marked this pull request as ready for review April 8, 2024 21:39
@mkleene mkleene requested a review from a team as a code owner April 8, 2024 21:39
@mkleene mkleene changed the title feat(sdk): don't require client id as a parameter feat(sdk): don't require client_id in the auth token Apr 8, 2024
@mkleene mkleene requested a review from a team as a code owner April 12, 2024 18:11
@mkleene mkleene added this pull request to the merge queue Apr 12, 2024
@jrschumacher
Copy link
Member

jrschumacher commented Apr 12, 2024

Given that roles and groups are optional (at least with Keycloak they must be mapped) it would seem that we should utilize jq to allow the platform admin to validate any aspect of the claim. If they want to check for a client_id, role, group, etc then they could.

I assume we can add this kind of enhancement latter. Should we create an issue?

Merged via the queue into main with commit a1e70f9 Apr 12, 2024
@mkleene mkleene deleted the dont-require-client-id branch April 12, 2024 18:33
@strantalis
Copy link
Member

strantalis commented Apr 12, 2024

Given that roles and groups are optional (at least with Keycloak they must be mapped) it would seem that we should utilize jq to allow the platform admin to validate any aspect of the claim. If they want to check for a client_id, role, group, etc then they could.

I assume we can add this kind of enhancement latter. Should we create an issue?

I think we can add something to validate custom claims at a later time once someone maybe brings us a valid use case.

@opentdf-automation opentdf-automation bot mentioned this pull request Apr 18, 2024
Merged
github-merge-queue bot pushed a commit that referenced this pull request Apr 23, 2024
@opentdf-automation
chore(main): release service 0.1.0 (#614)
934e8f0 
🤖 I have created a release *beep* *boop*
---


##
[0.1.0](service-v0.1.0...service/v0.1.0)
(2024-04-22)


### ⚠ BREAKING CHANGES

* Singular platform/service
([#511](#511))

### Features

* ability to add public routes that bypass authn middleware
([#601](#601))
([7c65308](7c65308))
* ability to set config key or config file from root cmd
([#502](#502))
([56a0131](56a0131))
* allow --insecure in provision keycloak cmd
([#629](#629))
([a672325](a672325))
* **kas:** support HSM and standard crypto
([#497](#497))
([f0cbe03](f0cbe03))
* **opa:** Adding jq OPA builtin for selection
([#527](#527))
([d4ab17a](d4ab17a))
* **policy:** add `created_at` and `updated_at` timestamps to metadata
([#538](#538))
([e812563](e812563))
* **policy:** update fixtures, proto comments, and proto field names to
reflect use of jq selector syntax within Conditions of Subject Sets
([#523](#523))
([16f40f7](16f40f7))
* **sdk:** don't require `client_id` in the auth token
([#544](#544))
([a1e70f9](a1e70f9))
* **sdk:** normalize token exchange
([#546](#546))
([9059dff](9059dff))


### Bug Fixes

* **authorization:** Hierarchy working in GetDecisions
([#519](#519))
([2856485](2856485))
* **core:** allow org-admin casbin role to call KAS rewrap endpoint
([#579](#579))
([a64c62a](a64c62a))
* **core:** fix panic on nil pointer dereference by passing KAS the SDK
instance on registration
([#574](#574))
([327bfca](327bfca))
* **core:** fixes fixtures provisioning after filepath change with repo
restructuring ([#521](#521))
([f128e9f](f128e9f))
* load extraprops for a service config with remainder values
([#524](#524))
([d3d72dc](d3d72dc))
* **PLAT-3069:** opentdf/platform, gRPC: Namespace with existed
attribute(s) can be deactivated w/o any prompts
([#489](#489))
([e5a3324](e5a3324))
* **policy:** remove hardcoded schema in goose migration 20240405000000
([#596](#596))
([36c3b16](36c3b16))
* **policy:** return `created_at` and `updated_at` timestamps in CREATE
metadata ([#557](#557))
([fcaaeea](fcaaeea))
* resolves issues auth policy configuration
([#498](#498))
([08e67cf](08e67cf))
* **service:** go.mod version fix sync
([#604](#604))
([6323efd](6323efd))
* url encode db password field to handle special characters
([#624](#624))
([5069f9d](5069f9d))


### Code Refactoring

* Singular platform/service
([#511](#511))
([40c8b97](40c8b97))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
tech-guru42 added a commit to tech-guru42/TDF that referenced this pull request Jun 3, 2024
@tech-guru42 @opentdf-automation
chore(main): release service 0.1.0 (#614)
8265316 
🤖 I have created a release *beep* *boop*
---


##
[0.1.0](opentdf/platform@service-v0.1.0...service/v0.1.0)
(2024-04-22)


### ⚠ BREAKING CHANGES

* Singular platform/service
([#511](opentdf/platform#511))

### Features

* ability to add public routes that bypass authn middleware
([#601](opentdf/platform#601))
([7c65308](opentdf/platform@7c65308))
* ability to set config key or config file from root cmd
([#502](opentdf/platform#502))
([56a0131](opentdf/platform@56a0131))
* allow --insecure in provision keycloak cmd
([#629](opentdf/platform#629))
([a672325](opentdf/platform@a672325))
* **kas:** support HSM and standard crypto
([#497](opentdf/platform#497))
([f0cbe03](opentdf/platform@f0cbe03))
* **opa:** Adding jq OPA builtin for selection
([#527](opentdf/platform#527))
([d4ab17a](opentdf/platform@d4ab17a))
* **policy:** add `created_at` and `updated_at` timestamps to metadata
([#538](opentdf/platform#538))
([e812563](opentdf/platform@e812563))
* **policy:** update fixtures, proto comments, and proto field names to
reflect use of jq selector syntax within Conditions of Subject Sets
([#523](opentdf/platform#523))
([16f40f7](opentdf/platform@16f40f7))
* **sdk:** don't require `client_id` in the auth token
([#544](opentdf/platform#544))
([a1e70f9](opentdf/platform@a1e70f9))
* **sdk:** normalize token exchange
([#546](opentdf/platform#546))
([9059dff](opentdf/platform@9059dff))


### Bug Fixes

* **authorization:** Hierarchy working in GetDecisions
([#519](opentdf/platform#519))
([2856485](opentdf/platform@2856485))
* **core:** allow org-admin casbin role to call KAS rewrap endpoint
([#579](opentdf/platform#579))
([a64c62a](opentdf/platform@a64c62a))
* **core:** fix panic on nil pointer dereference by passing KAS the SDK
instance on registration
([#574](opentdf/platform#574))
([327bfca](opentdf/platform@327bfca))
* **core:** fixes fixtures provisioning after filepath change with repo
restructuring ([#521](opentdf/platform#521))
([f128e9f](opentdf/platform@f128e9f))
* load extraprops for a service config with remainder values
([#524](opentdf/platform#524))
([d3d72dc](opentdf/platform@d3d72dc))
* **PLAT-3069:** opentdf/platform, gRPC: Namespace with existed
attribute(s) can be deactivated w/o any prompts
([#489](opentdf/platform#489))
([e5a3324](opentdf/platform@e5a3324))
* **policy:** remove hardcoded schema in goose migration 20240405000000
([#596](opentdf/platform#596))
([36c3b16](opentdf/platform@36c3b16))
* **policy:** return `created_at` and `updated_at` timestamps in CREATE
metadata ([#557](opentdf/platform#557))
([fcaaeea](opentdf/platform@fcaaeea))
* resolves issues auth policy configuration
([#498](opentdf/platform#498))
([08e67cf](opentdf/platform@08e67cf))
* **service:** go.mod version fix sync
([#604](opentdf/platform#604))
([6323efd](opentdf/platform@6323efd))
* url encode db password field to handle special characters
([#624](opentdf/platform#624))
([5069f9d](opentdf/platform@5069f9d))


### Code Refactoring

* Singular platform/service
([#511](opentdf/platform#511))
([40c8b97](opentdf/platform@40c8b97))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
passion-127 added a commit to passion-127/TDF that referenced this pull request Jun 6, 2024
@passion-127 @opentdf-automation
chore(main): release service 0.1.0 (#614)
1c13e46 
🤖 I have created a release *beep* *boop*
---


##
[0.1.0](opentdf/platform@service-v0.1.0...service/v0.1.0)
(2024-04-22)


### ⚠ BREAKING CHANGES

* Singular platform/service
([#511](opentdf/platform#511))

### Features

* ability to add public routes that bypass authn middleware
([#601](opentdf/platform#601))
([7c65308](opentdf/platform@7c65308))
* ability to set config key or config file from root cmd
([#502](opentdf/platform#502))
([56a0131](opentdf/platform@56a0131))
* allow --insecure in provision keycloak cmd
([#629](opentdf/platform#629))
([a672325](opentdf/platform@a672325))
* **kas:** support HSM and standard crypto
([#497](opentdf/platform#497))
([f0cbe03](opentdf/platform@f0cbe03))
* **opa:** Adding jq OPA builtin for selection
([#527](opentdf/platform#527))
([d4ab17a](opentdf/platform@d4ab17a))
* **policy:** add `created_at` and `updated_at` timestamps to metadata
([#538](opentdf/platform#538))
([e812563](opentdf/platform@e812563))
* **policy:** update fixtures, proto comments, and proto field names to
reflect use of jq selector syntax within Conditions of Subject Sets
([#523](opentdf/platform#523))
([16f40f7](opentdf/platform@16f40f7))
* **sdk:** don't require `client_id` in the auth token
([#544](opentdf/platform#544))
([a1e70f9](opentdf/platform@a1e70f9))
* **sdk:** normalize token exchange
([#546](opentdf/platform#546))
([9059dff](opentdf/platform@9059dff))


### Bug Fixes

* **authorization:** Hierarchy working in GetDecisions
([#519](opentdf/platform#519))
([2856485](opentdf/platform@2856485))
* **core:** allow org-admin casbin role to call KAS rewrap endpoint
([#579](opentdf/platform#579))
([a64c62a](opentdf/platform@a64c62a))
* **core:** fix panic on nil pointer dereference by passing KAS the SDK
instance on registration
([#574](opentdf/platform#574))
([327bfca](opentdf/platform@327bfca))
* **core:** fixes fixtures provisioning after filepath change with repo
restructuring ([#521](opentdf/platform#521))
([f128e9f](opentdf/platform@f128e9f))
* load extraprops for a service config with remainder values
([#524](opentdf/platform#524))
([d3d72dc](opentdf/platform@d3d72dc))
* **PLAT-3069:** opentdf/platform, gRPC: Namespace with existed
attribute(s) can be deactivated w/o any prompts
([#489](opentdf/platform#489))
([e5a3324](opentdf/platform@e5a3324))
* **policy:** remove hardcoded schema in goose migration 20240405000000
([#596](opentdf/platform#596))
([36c3b16](opentdf/platform@36c3b16))
* **policy:** return `created_at` and `updated_at` timestamps in CREATE
metadata ([#557](opentdf/platform#557))
([fcaaeea](opentdf/platform@fcaaeea))
* resolves issues auth policy configuration
([#498](opentdf/platform#498))
([08e67cf](opentdf/platform@08e67cf))
* **service:** go.mod version fix sync
([#604](opentdf/platform#604))
([6323efd](opentdf/platform@6323efd))
* url encode db password field to handle special characters
([#624](opentdf/platform#624))
([5069f9d](opentdf/platform@5069f9d))


### Code Refactoring

* Singular platform/service
([#511](opentdf/platform#511))
([40c8b97](opentdf/platform@40c8b97))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@strantalis strantalis strantalis approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@mkleene @jrschumacher @strantalis