authorizer

package
v1.3.0-alpha.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 21, 2016 License: Apache-2.0 Imports: 15 Imported by: 0

Documentation

Index

Constants

View Source 
const DefaultProjectRequestForbidden = "You may not request a new project via this API."

Variables

This section is empty.

Functions

func IsPersonalAccessReview added in v0.4.2 

func IsPersonalAccessReview(a AuthorizationAttributes) (bool, error)

Types

type AuthorizationAttributeBuilder 

type AuthorizationAttributeBuilder interface {
	GetAttributes(request *http.Request) (AuthorizationAttributes, error)
}

func NewAuthorizationAttributeBuilder 

func NewAuthorizationAttributeBuilder(contextMapper kapi.RequestContextMapper, infoResolver RequestInfoResolver) AuthorizationAttributeBuilder

type AuthorizationAttributes 

type AuthorizationAttributes interface {
	GetVerb() string
	GetAPIVersion() string
	GetAPIGroup() string
	// GetResource returns the resource type.  If IsNonResourceURL() is true, then GetResource() is "".
	GetResource() string
	GetResourceName() string
	// GetRequestAttributes is of type interface{} because different verbs and different Authorizer/AuthorizationAttributeBuilder pairs may have different contract requirements.
	GetRequestAttributes() interface{}
	// IsNonResourceURL returns true if this is not an action performed against the resource API
	IsNonResourceURL() bool
	// GetURL returns the URL path being requested, including the leading '/'
	GetURL() string
}

type Authorizer 

type Authorizer interface {
	Authorize(ctx kapi.Context, a AuthorizationAttributes) (allowed bool, reason string, err error)
	GetAllowedSubjects(ctx kapi.Context, attributes AuthorizationAttributes) (sets.String, sets.String, error)
}

func NewAuthorizer 

func NewAuthorizer(ruleResolver rulevalidation.AuthorizationRuleResolver, forbiddenMessageMaker ForbiddenMessageMaker) Authorizer

type DefaultAuthorizationAttributes added in v0.3.1 

type DefaultAuthorizationAttributes struct {
	Verb              string
	APIVersion        string
	APIGroup          string
	Resource          string
	ResourceName      string
	RequestAttributes interface{}
	NonResourceURL    bool
	URL               string
}

func CoerceToDefaultAuthorizationAttributes 

func CoerceToDefaultAuthorizationAttributes(passedAttributes AuthorizationAttributes) *DefaultAuthorizationAttributes

TODO this may or may not be the behavior we want for managing rules. As a for instance, a verb might be specified that our attributes builder will never satisfy. For now, I think gets us close. Maybe a warning message of some kind?

func ToDefaultAuthorizationAttributes added in v1.0.5 

func ToDefaultAuthorizationAttributes(in authorizationapi.AuthorizationAttributes) DefaultAuthorizationAttributes

ToDefaultAuthorizationAttributes coerces AuthorizationAttributes to DefaultAuthorizationAttributes. Namespace is not included because the authorizer takes that information on the context

func (DefaultAuthorizationAttributes) GetAPIGroup added in v1.0.7 

func (a DefaultAuthorizationAttributes) GetAPIGroup() string

func (DefaultAuthorizationAttributes) GetAPIVersion added in v0.4.4 

func (a DefaultAuthorizationAttributes) GetAPIVersion() string

func (DefaultAuthorizationAttributes) GetRequestAttributes added in v0.3.1 

func (a DefaultAuthorizationAttributes) GetRequestAttributes() interface{}

func (DefaultAuthorizationAttributes) GetResource added in v0.3.1 

func (a DefaultAuthorizationAttributes) GetResource() string

func (DefaultAuthorizationAttributes) GetResourceName added in v0.3.1 

func (a DefaultAuthorizationAttributes) GetResourceName() string

func (DefaultAuthorizationAttributes) GetURL added in v0.3.2 

func (a DefaultAuthorizationAttributes) GetURL() string

func (DefaultAuthorizationAttributes) GetVerb added in v0.3.1 

func (a DefaultAuthorizationAttributes) GetVerb() string

func (DefaultAuthorizationAttributes) IsNonResourceURL added in v0.3.2 

func (a DefaultAuthorizationAttributes) IsNonResourceURL() bool

func (DefaultAuthorizationAttributes) RuleMatches added in v0.3.1 

func (a DefaultAuthorizationAttributes) RuleMatches(rule authorizationapi.PolicyRule) (bool, error)

type ForbiddenMessageMaker added in v0.5.3 

type ForbiddenMessageMaker interface {
	MakeMessage(ctx MessageContext) (string, error)
}

ForbiddenMessageMaker creates a forbidden message from a MessageContext

type ForbiddenMessageResolver added in v0.5.3 

type ForbiddenMessageResolver struct {
	// contains filtered or unexported fields
}

func NewForbiddenMessageResolver added in v0.5.3 

func NewForbiddenMessageResolver(projectRequestForbiddenTemplate string) *ForbiddenMessageResolver

func (*ForbiddenMessageResolver) MakeMessage added in v0.5.3 

func (m *ForbiddenMessageResolver) MakeMessage(ctx MessageContext) (string, error)

type MessageContext added in v0.5.3 

type MessageContext struct {
	User       user.Info
	Namespace  string
	Attributes AuthorizationAttributes
}

MessageContext contains sufficient information to create a forbidden message. It is bundled in this one object to make it easy and obvious how to build a golang template

type RequestInfoResolver added in v1.2.0 

type RequestInfoResolver interface {
	GetRequestInfo(req *http.Request) (kapiserver.RequestInfo, error)
}

func NewBrowserSafeRequestInfoResolver added in v1.2.0 

func NewBrowserSafeRequestInfoResolver(contextMapper kapi.RequestContextMapper, authenticatedGroups sets.String, infoResolver RequestInfoResolver) RequestInfoResolver

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.