Skip to content

feat: ability to add public routes that bypass authn middleware #601

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
strantalis merged 7 commits into from
Apr 22, 2024
Merged

feat: ability to add public routes that bypass authn middleware #601

strantalis merged 7 commits into from
Apr 22, 2024

Conversation

@strantalis
Copy link
Member

@strantalis strantalis commented Apr 17, 2024 •
edited
Loading

Adds the ability to allow extra public routes when extended the platform or if a route requires its own auth mechanism.

  • adds new wiremocks for jwks keys
  • new WithPublicRoutes options func for extending platform

@strantalis strantalis requested review from a team as code owners April 17, 2024 18:13
dmihalcik-virtru
dmihalcik-virtru requested changes Apr 17, 2024
View reviewed changes
jrschumacher
jrschumacher reviewed Apr 17, 2024
View reviewed changes
dmihalcik-virtru
dmihalcik-virtru approved these changes Apr 18, 2024
View reviewed changes
@strantalis strantalis requested a review from jrschumacher April 18, 2024 22:45
@jrschumacher jrschumacher linked an issue Apr 19, 2024 that may be closed by this pull request
Downstream platforms don't have control over auth and the gRPC and HTTP routes #512
Closed
@strantalis strantalis enabled auto-merge April 22, 2024 17:08
@strantalis strantalis added this pull request to the merge queue Apr 22, 2024
Merged via the queue into opentdf:main with commit 7c65308 Apr 22, 2024
@strantalis strantalis deleted the expose-auth-configuration branch April 22, 2024 17:50
@opentdf-automation opentdf-automation bot mentioned this pull request Apr 22, 2024
Merged
github-merge-queue bot pushed a commit that referenced this pull request Apr 23, 2024
@opentdf-automation
chore(main): release service 0.1.0 (#614)
934e8f0 
🤖 I have created a release *beep* *boop*
---


##
[0.1.0](service-v0.1.0...service/v0.1.0)
(2024-04-22)


### ⚠ BREAKING CHANGES

* Singular platform/service
([#511](#511))

### Features

* ability to add public routes that bypass authn middleware
([#601](#601))
([7c65308](7c65308))
* ability to set config key or config file from root cmd
([#502](#502))
([56a0131](56a0131))
* allow --insecure in provision keycloak cmd
([#629](#629))
([a672325](a672325))
* **kas:** support HSM and standard crypto
([#497](#497))
([f0cbe03](f0cbe03))
* **opa:** Adding jq OPA builtin for selection
([#527](#527))
([d4ab17a](d4ab17a))
* **policy:** add `created_at` and `updated_at` timestamps to metadata
([#538](#538))
([e812563](e812563))
* **policy:** update fixtures, proto comments, and proto field names to
reflect use of jq selector syntax within Conditions of Subject Sets
([#523](#523))
([16f40f7](16f40f7))
* **sdk:** don't require `client_id` in the auth token
([#544](#544))
([a1e70f9](a1e70f9))
* **sdk:** normalize token exchange
([#546](#546))
([9059dff](9059dff))


### Bug Fixes

* **authorization:** Hierarchy working in GetDecisions
([#519](#519))
([2856485](2856485))
* **core:** allow org-admin casbin role to call KAS rewrap endpoint
([#579](#579))
([a64c62a](a64c62a))
* **core:** fix panic on nil pointer dereference by passing KAS the SDK
instance on registration
([#574](#574))
([327bfca](327bfca))
* **core:** fixes fixtures provisioning after filepath change with repo
restructuring ([#521](#521))
([f128e9f](f128e9f))
* load extraprops for a service config with remainder values
([#524](#524))
([d3d72dc](d3d72dc))
* **PLAT-3069:** opentdf/platform, gRPC: Namespace with existed
attribute(s) can be deactivated w/o any prompts
([#489](#489))
([e5a3324](e5a3324))
* **policy:** remove hardcoded schema in goose migration 20240405000000
([#596](#596))
([36c3b16](36c3b16))
* **policy:** return `created_at` and `updated_at` timestamps in CREATE
metadata ([#557](#557))
([fcaaeea](fcaaeea))
* resolves issues auth policy configuration
([#498](#498))
([08e67cf](08e67cf))
* **service:** go.mod version fix sync
([#604](#604))
([6323efd](6323efd))
* url encode db password field to handle special characters
([#624](#624))
([5069f9d](5069f9d))


### Code Refactoring

* Singular platform/service
([#511](#511))
([40c8b97](40c8b97))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
tech-guru42 added a commit to tech-guru42/TDF that referenced this pull request Jun 3, 2024
@tech-guru42 @opentdf-automation
chore(main): release service 0.1.0 (#614)
8265316 
🤖 I have created a release *beep* *boop*
---


##
[0.1.0](opentdf/platform@service-v0.1.0...service/v0.1.0)
(2024-04-22)


### ⚠ BREAKING CHANGES

* Singular platform/service
([#511](opentdf/platform#511))

### Features

* ability to add public routes that bypass authn middleware
([#601](opentdf/platform#601))
([7c65308](opentdf/platform@7c65308))
* ability to set config key or config file from root cmd
([#502](opentdf/platform#502))
([56a0131](opentdf/platform@56a0131))
* allow --insecure in provision keycloak cmd
([#629](opentdf/platform#629))
([a672325](opentdf/platform@a672325))
* **kas:** support HSM and standard crypto
([#497](opentdf/platform#497))
([f0cbe03](opentdf/platform@f0cbe03))
* **opa:** Adding jq OPA builtin for selection
([#527](opentdf/platform#527))
([d4ab17a](opentdf/platform@d4ab17a))
* **policy:** add `created_at` and `updated_at` timestamps to metadata
([#538](opentdf/platform#538))
([e812563](opentdf/platform@e812563))
* **policy:** update fixtures, proto comments, and proto field names to
reflect use of jq selector syntax within Conditions of Subject Sets
([#523](opentdf/platform#523))
([16f40f7](opentdf/platform@16f40f7))
* **sdk:** don't require `client_id` in the auth token
([#544](opentdf/platform#544))
([a1e70f9](opentdf/platform@a1e70f9))
* **sdk:** normalize token exchange
([#546](opentdf/platform#546))
([9059dff](opentdf/platform@9059dff))


### Bug Fixes

* **authorization:** Hierarchy working in GetDecisions
([#519](opentdf/platform#519))
([2856485](opentdf/platform@2856485))
* **core:** allow org-admin casbin role to call KAS rewrap endpoint
([#579](opentdf/platform#579))
([a64c62a](opentdf/platform@a64c62a))
* **core:** fix panic on nil pointer dereference by passing KAS the SDK
instance on registration
([#574](opentdf/platform#574))
([327bfca](opentdf/platform@327bfca))
* **core:** fixes fixtures provisioning after filepath change with repo
restructuring ([#521](opentdf/platform#521))
([f128e9f](opentdf/platform@f128e9f))
* load extraprops for a service config with remainder values
([#524](opentdf/platform#524))
([d3d72dc](opentdf/platform@d3d72dc))
* **PLAT-3069:** opentdf/platform, gRPC: Namespace with existed
attribute(s) can be deactivated w/o any prompts
([#489](opentdf/platform#489))
([e5a3324](opentdf/platform@e5a3324))
* **policy:** remove hardcoded schema in goose migration 20240405000000
([#596](opentdf/platform#596))
([36c3b16](opentdf/platform@36c3b16))
* **policy:** return `created_at` and `updated_at` timestamps in CREATE
metadata ([#557](opentdf/platform#557))
([fcaaeea](opentdf/platform@fcaaeea))
* resolves issues auth policy configuration
([#498](opentdf/platform#498))
([08e67cf](opentdf/platform@08e67cf))
* **service:** go.mod version fix sync
([#604](opentdf/platform#604))
([6323efd](opentdf/platform@6323efd))
* url encode db password field to handle special characters
([#624](opentdf/platform#624))
([5069f9d](opentdf/platform@5069f9d))


### Code Refactoring

* Singular platform/service
([#511](opentdf/platform#511))
([40c8b97](opentdf/platform@40c8b97))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
passion-127 added a commit to passion-127/TDF that referenced this pull request Jun 6, 2024
@passion-127 @opentdf-automation
chore(main): release service 0.1.0 (#614)
1c13e46 
🤖 I have created a release *beep* *boop*
---


##
[0.1.0](opentdf/platform@service-v0.1.0...service/v0.1.0)
(2024-04-22)


### ⚠ BREAKING CHANGES

* Singular platform/service
([#511](opentdf/platform#511))

### Features

* ability to add public routes that bypass authn middleware
([#601](opentdf/platform#601))
([7c65308](opentdf/platform@7c65308))
* ability to set config key or config file from root cmd
([#502](opentdf/platform#502))
([56a0131](opentdf/platform@56a0131))
* allow --insecure in provision keycloak cmd
([#629](opentdf/platform#629))
([a672325](opentdf/platform@a672325))
* **kas:** support HSM and standard crypto
([#497](opentdf/platform#497))
([f0cbe03](opentdf/platform@f0cbe03))
* **opa:** Adding jq OPA builtin for selection
([#527](opentdf/platform#527))
([d4ab17a](opentdf/platform@d4ab17a))
* **policy:** add `created_at` and `updated_at` timestamps to metadata
([#538](opentdf/platform#538))
([e812563](opentdf/platform@e812563))
* **policy:** update fixtures, proto comments, and proto field names to
reflect use of jq selector syntax within Conditions of Subject Sets
([#523](opentdf/platform#523))
([16f40f7](opentdf/platform@16f40f7))
* **sdk:** don't require `client_id` in the auth token
([#544](opentdf/platform#544))
([a1e70f9](opentdf/platform@a1e70f9))
* **sdk:** normalize token exchange
([#546](opentdf/platform#546))
([9059dff](opentdf/platform@9059dff))


### Bug Fixes

* **authorization:** Hierarchy working in GetDecisions
([#519](opentdf/platform#519))
([2856485](opentdf/platform@2856485))
* **core:** allow org-admin casbin role to call KAS rewrap endpoint
([#579](opentdf/platform#579))
([a64c62a](opentdf/platform@a64c62a))
* **core:** fix panic on nil pointer dereference by passing KAS the SDK
instance on registration
([#574](opentdf/platform#574))
([327bfca](opentdf/platform@327bfca))
* **core:** fixes fixtures provisioning after filepath change with repo
restructuring ([#521](opentdf/platform#521))
([f128e9f](opentdf/platform@f128e9f))
* load extraprops for a service config with remainder values
([#524](opentdf/platform#524))
([d3d72dc](opentdf/platform@d3d72dc))
* **PLAT-3069:** opentdf/platform, gRPC: Namespace with existed
attribute(s) can be deactivated w/o any prompts
([#489](opentdf/platform#489))
([e5a3324](opentdf/platform@e5a3324))
* **policy:** remove hardcoded schema in goose migration 20240405000000
([#596](opentdf/platform#596))
([36c3b16](opentdf/platform@36c3b16))
* **policy:** return `created_at` and `updated_at` timestamps in CREATE
metadata ([#557](opentdf/platform#557))
([fcaaeea](opentdf/platform@fcaaeea))
* resolves issues auth policy configuration
([#498](opentdf/platform#498))
([08e67cf](opentdf/platform@08e67cf))
* **service:** go.mod version fix sync
([#604](opentdf/platform#604))
([6323efd](opentdf/platform@6323efd))
* url encode db password field to handle special characters
([#624](opentdf/platform#624))
([5069f9d](opentdf/platform@5069f9d))


### Code Refactoring

* Singular platform/service
([#511](opentdf/platform#511))
([40c8b97](opentdf/platform@40c8b97))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jrschumacher jrschumacher jrschumacher approved these changes

@dmihalcik-virtru dmihalcik-virtru dmihalcik-virtru approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Downstream platforms don't have control over auth and the gRPC and HTTP routes

3 participants

@strantalis @jrschumacher @dmihalcik-virtru