List API: Display all Objects a User has Access to in an RBAC implementation

[landerss1]

Hi,

We have tried to implement a simple RBAC model for use in the Krakend API gateway, where we have developed a simple plugin that use the gRPC endpoint in Keto to check access. The model we have implemented in Keto is this:

A user is a member of one or more roles. The roles have access to policies. The policies are statements that the policy have either read or write access to an entire API, or a specific endpoint in the API. So we have User -> member -> Role -> access -> Policy -> read/write -> API -> parent -> Endpoint

An example with payloads:

{"namespace":"permissions","object":"/apis/my-api","relation":"parent","subject":"permissions:/apis/my-api/my-endpoint1#"}
{"namespace":"permissions","object":"/apis/my-api","relation":"parent","subject":"permissions:/apis/my-api/my-endpoint2#"}
{"namespace":"permissions","object":"/apis/my-api/my-endpoint1","relation":"read","subject":"permissions:/apis/my-api#read"}
{"namespace":"permissions","object":"/apis/my-api/my-endpoint1","relation":"write","subject":"permissions:/apis/my-api#write"}
{"namespace":"permissions","object":"/apis/my-api/my-endpoint2","relation":"read","subject":"permissions:/apis/my-api#read"}
{"namespace":"permissions","object":"/apis/my-api/my-endpoint2","relation":"write","subject":"permissions:/apis/my-api#write"}
{"namespace":"permissions","object":"/apis/my-api","relation":"read","subject":"policies:/system/my-api/*/rw#"}
{"namespace":"permissions","object":"/apis/my-api","relation":"write","subject":"policies:/system/my-api/*/rw#"}
{"namespace":"permissions","object":"/apis/my-api","relation":"read","subject":"policies:/system/my-api/*/rw#access"}
{"namespace":"permissions","object":"/apis/my-api","relation":"write","subject":"policies:/system/my-api/*/rw#access"}
{"namespace":"policies","object":"/system/my-api/*/rw","relation":"access","subject":"roles:/system/system-admin"}
{"namespace":"policies","object":"/system/my-api/*/rw","relation":"access","subject":"roles:/system/system-admin#member"}
{"namespace":"roles","object":"/system/system-admin","relation":"member","subject":"users:/my-tenant/[email protected]"}

Being new to the notion of relation tuples, I'm not sure if this is the intended way to implement RBAC, but it seems to work, even though I haven't tested it enough to be sure. But, with this model I can check if a certain user/role/policy has access to a specific endpoint in an API. And, using the expand API, I can see who has access to a specific endpoint. However, I can't figure out how to use the List API to see what endpoints a specific user/role/policy can access.

Is the List API supposed to support that type of queries? The expand API doesn't seem to work either in this scenario?

We intend to build a UI to support defining and maintaining roles and policies, and without being able to list the apis/endpoints that are accessible to a user/role/policy in an easy way it becomes tricky.

[zepatrik]

Nice, that looks very good 👍

One small thing: some of your tuples (e.g. {"namespace":"policies","object":"/system/my-api/*/rw","relation":"access","subject":"roles:/system/system-admin"}) are not actually what you think they are. The subject is not interpreted as a subject set, but as a subject ID instead because there is no #. But in general your tuples represent what you described 👍
Regarding naming, you might want to actually have the permissions namespace called apis or endpoints instead, but that is just from the, I assume, broken down example. It might make sense in the bigger picture that I don't see 😉

Regarding the list API, it's purpose is to list the tuples exactly as they are stored, so no expansion of subject sets. You can specify the parts of the relation tuple that you know. So calling GET /relation-tuples?namespace=permissions&subject=policies:/system/my-api/*/rw#access should return

[
  {"namespace":"permissions","object":"/apis/my-api","relation":"read","subject":"policies:/system/my-api/*/rw#access"},
  {"namespace":"permissions","object":"/apis/my-api","relation":"write","subject":"policies:/system/my-api/*/rw#access"}
]

which you then have to manually follow further (probably interactively through the UI). You probably already read the docs pages but I will link them for completeness:

• https://www.ory.sh/keto/docs/reference/rest-api#query-relation-tuples
• https://www.ory.sh/keto/docs/guides/list-api-display-objects

[landerss1]

Thanks for your reply. Yes, I understand the difference between a subject id and a subject set. I included them both in the model so I always can check if a specific subject has access to a permission. So, e.g., I can check if a policy has read access to an API, but I can also check if someone who has access to a policy also has read access to an API. That comes from a few hours of experimenting with the use of '#' and '#access' and '#read' etc. in the subject part of the relation tuples.

The bigger picture here, regarding permissions, is that we will keep all sorts of permissions here, not only apis and endpoints, but also permissions to access objects and attributes (referred to as data in our model). We'll start small, and work from there to evolve our model as needed.