rbac

Documentation

Index

• Variables
• type Action
  • func Str2Action(str string) (Action, error)
• type Decision
• type Engine
  • func NewEngine(roles []Role, roleBindings []RoleBinding) Engine
• type Request
• type Resource
  • func Str2Resource(str string) (Resource, error)
• type Role
  • func (role Role) Match(a Action, r Resource) bool
• type RoleBinding
  • func NewRoleBindingFromBytes(data []byte) (*RoleBinding, error)
• type Rule
• type Subject
• type SubjectType

Variables

var (
	ReadOnlyRole = Role{
		Name:        "readonly",
		DisplayName: "ReadOnly",
		Rules: []Rule{
			{
				Resources: []Resource{BucketResource, ObjectResource},
				Actions:   []Action{List, Get},
			},
		},
	}

	UserRole = Role{
		Name:        "user",
		DisplayName: "User",
		Rules: []Rule{
			{
				Resources: []Resource{BucketResource},
				Actions:   []Action{List, Get},
			},
			{
				Resources: []Resource{ObjectResource},
				Actions:   []Action{List, Get, Create, Delete, Update},
			},
		},
	}

	EditorRole = Role{
		Name:        "editor",
		DisplayName: "Editor",
		Rules: []Rule{
			{
				Resources: []Resource{BucketResource},
				Actions:   []Action{List, Get, Create, Delete, Update, Publish, Unpublish},
			},
			{
				Resources: []Resource{ObjectResource},
				Actions:   []Action{List, Get, Create, Delete, Update},
			},
		},
	}

	AdminRole = Role{
		Name:        "admin",
		DisplayName: "Admin",
		Rules: []Rule{
			{
				Resources: []Resource{BucketResource},
				Actions:   []Action{List, Get, Create, Delete, Update, Publish, Unpublish},
			},
			{
				Resources: []Resource{ObjectResource},
				Actions:   []Action{List, Get, Create, Delete, Update},
			},
			{
				Resources: []Resource{RoleResource},
				Actions:   []Action{List, Get},
			},
			{
				Resources: []Resource{BucketAclResource},
				Actions:   []Action{List, Get, Create, Delete, Update},
			},
			{
				Resources: []Resource{RoleBindingResource},
				Actions:   []Action{List, Get, Update, Create, Delete},
			},
		},
	}
)

var DefaultRoles = []Role{
	ReadOnlyRole,
	UserRole,
	EditorRole,
	AdminRole,
}

TODO manage roles in etcd store (TIPC-958)

Types

type Action

type Action string

const (
	Create Action = "create"
	Update Action = "update"
	List   Action = "list"
	Get    Action = "get"
	Delete Action = "delete"

	Publish   Action = "publish"   // Action specific for bucket only, publish a path in the buckets
	Unpublish Action = "unpublish" // un-publish a path in the bucket
)

func Str2Action

func Str2Action(str string) (Action, error)

type Decision

type Decision string

var (
	PermitDecision Decision = "permit"
	DenyDecision   Decision = "deny"
)

type Engine

type Engine interface {
	// Evaluate returns the decision of the engine against the given request
	Evaluate(r Request) Decision
}

Engine defines the API for RBAC engine

func NewEngine

func NewEngine(roles []Role, roleBindings []RoleBinding) Engine

NewEngine creates a new RBAC evaluation engine with defined roles and role-bindings

type Request

type Request struct {
	UserID string   `json:"userId"` // user identifier, i.e. KPN ruisnaam
	Groups []string `json:"groups"` // available groups that the user belongs to
	Action Action   `json:"action"`
	Target Resource `json:"target"`
}

Request represents the RBAC authorization request

type Resource

type Resource string

const (
	BucketResource      Resource = "oss:bucket"
	BucketAclResource   Resource = "oss:bucket-acl"
	ObjectResource      Resource = "oss:object"
	RoleResource        Resource = "oss:role"
	RoleBindingResource Resource = "oss:role-binding"
	CustomerResource    Resource = "oss:customer"

	UnknownResource Resource = "oss:unknown"
)

func Str2Resource

func Str2Resource(str string) (Resource, error)

type Role

type Role struct {
	Name        string `json:"name"`
	DisplayName string `json:"displayName"`
	Rules       []Rule `json:"rules"`
}

Role represents a role element in the RBAC model

func (Role) Match

func (role Role) Match(a Action, r Resource) bool

Match checks if the given <resource, action> matches to the role

type RoleBinding

type RoleBinding struct {
	Name      string    `json:"name"`
	CreatedAt time.Time `json:"createdAt,omitempty"` // default is IS8601 (RFC3339) date format
	Subjects  []Subject `json:"subjects"`
	RoleRef   string    `json:"roleRef"`
}

RoleBinding defines the link from Role with specific permissions to the given subjects, which can be either users or group of users

func NewRoleBindingFromBytes

func NewRoleBindingFromBytes(data []byte) (*RoleBinding, error)

NewRoleBindingFromBytes deserializes RoleBinding object from byte array

type Rule

type Rule struct {
	Resources []Resource `json:"resources"`
	Actions   []Action   `json:"actions"`
}

type Subject

type Subject struct {
	Type  SubjectType `json:"type"`
	Value string      `json:"value"`
}

type SubjectType

type SubjectType string

const (
	UserType  SubjectType = "user"
	GroupType SubjectType = "group"
)