{"id":23772,"date":"2019-02-01T12:15:16","date_gmt":"2019-02-01T10:15:16","guid":{"rendered":"https:\/\/www.webcodegeeks.com\/?p=23772"},"modified":"2019-01-31T11:10:37","modified_gmt":"2019-01-31T09:10:37","slug":"opa-http-authorization","status":"publish","type":"post","link":"https:\/\/www.webcodegeeks.com\/python\/opa-http-authorization\/","title":{"rendered":"OPA for HTTP Authorization"},"content":{"rendered":"\n

Open Policy Agent[1] is a promising, light weight and very generic policy engine to govern authorization is any type of domain. I found this comparion[2] very attractive in evaluating OPA for a project I am currently working on, where they demonstrate how OPA can cater same functionality defined in RBAC, RBAC with Seperation of Duty, ABAC and XACML.  <\/p>\n\n\n\n

Here are the steps to a brief demonstration of OPA used for HTTP API authorization based on the sample [3], taking it another level up.<\/p>\n\n\n\n

Running OPA Server<\/h2>\n\n\n\n

First we need to download OPA from [4], based on the operating system we are running on. <\/p>\n\n\n\n

For linux,
\u00a0<\/code><\/p>\n\n\n\n

\n
\n\n\n\n
\n
1<\/div>\n<\/td>\n
\n
\n
curl -L -o opa https:<\/code>\/\/github.com\/open-policy-agent\/opa\/releases\/download\/v0.10.3\/opa_linux_amd64<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n\n\n\n

Make it executable,<\/p>\n\n\n\n

\n
\n\n\n\n
\n
1<\/div>\n<\/td>\n
\n
\n
chmod<\/code> 755 .\/opa<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n\n\n\n

Once done, we can start OPA policy engine as a server.<\/p>\n\n\n\n

\n
\n\n\n\n
\n
1<\/div>\n<\/td>\n
\n
\n
.\/opa run --server<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n\n\n\n

Define Data and Rules<\/h2>\n\n\n\n

Next we need to load data and authorization rules to the server, so it can make decisions. OPA defines these in files in the format of .rego. Below is a sample file I used.<\/p>\n\n\n\n

\n
\n\n\n\n
\n
01<\/div>\n
02<\/div>\n
03<\/div>\n
04<\/div>\n
05<\/div>\n
06<\/div>\n
07<\/div>\n
08<\/div>\n
09<\/div>\n
10<\/div>\n
11<\/div>\n
12<\/div>\n
13<\/div>\n
14<\/div>\n
15<\/div>\n
16<\/div>\n
17<\/div>\n
18<\/div>\n
19<\/div>\n
20<\/div>\n
21<\/div>\n
22<\/div>\n
23<\/div>\n
24<\/div>\n
25<\/div>\n
26<\/div>\n
27<\/div>\n
28<\/div>\n
29<\/div>\n
30<\/div>\n
31<\/div>\n
32<\/div>\n
33<\/div>\n
34<\/div>\n
35<\/div>\n
36<\/div>\n
37<\/div>\n
38<\/div>\n
39<\/div>\n<\/td>\n
\n
\n
package httpapi.authz<\/code><\/div>\n
 <\/div>\n
subordinates = {<\/code>\"alice\"<\/code>: [], <\/code>\"charlie\"<\/code>: [], <\/code>\"bob\"<\/code>: [<\/code>\"alice\"<\/code>], <\/code>\"betty\"<\/code>: [<\/code>\"charlie\"<\/code>]}<\/code><\/div>\n
 <\/div>\n
# HTTP API request<\/code><\/div>\n
import input <\/code>as<\/code> http_api<\/code><\/div>\n
# http_api = {<\/code><\/div>\n
#   <\/code>\"path\"<\/code>: [<\/code>\"finance\"<\/code>, <\/code>\"salary\"<\/code>, <\/code>\"alice\"<\/code>],<\/code><\/div>\n
#   <\/code>\"user\"<\/code>: <\/code>\"alice\"<\/code>,<\/code><\/div>\n
#   <\/code>\"method\"<\/code>: <\/code>\"GET\"<\/code><\/div>\n
#   <\/code>\"user_agent\"<\/code>: <\/code>\"cURL\/1.0\"<\/code><\/div>\n
#   <\/code>\"remote_addr\"<\/code>: <\/code>\"127.0.0.1\"<\/code><\/div>\n
# }<\/code><\/div>\n
 <\/div>\n
default<\/code> allow = false<\/code><\/div>\n
 <\/div>\n
# Allow users to get their own salaries.<\/code><\/div>\n
allow {<\/code><\/div>\n
  <\/code>http_api.method = <\/code>\"GET\"<\/code><\/div>\n
  <\/code>http_api.path = [<\/code>\"finance\"<\/code>, <\/code>\"salary\"<\/code>, username]<\/code><\/div>\n
  <\/code>username = http_api.user<\/code><\/div>\n
}<\/code><\/div>\n
 <\/div>\n
# Allow managers to get their subordinates' salaries.<\/code><\/div>\n
allow {<\/code><\/div>\n
  <\/code>http_api.method = <\/code>\"GET\"<\/code><\/div>\n
  <\/code>http_api.path = [<\/code>\"finance\"<\/code>, <\/code>\"salary\"<\/code>, username]<\/code><\/div>\n
  <\/code>subordinates[http_api.user][_] = username<\/code><\/div>\n
}<\/code><\/div>\n
 <\/div>\n
# Allow managers to edit their subordinates' salaries only <\/code>if<\/code> the request came<\/code><\/div>\n
# from user agent cURL <\/code>and<\/code> address 127.0.0.1.<\/code><\/div>\n
allow {<\/code><\/div>\n
  <\/code>http_api.method = <\/code>\"POST\"<\/code><\/div>\n
  <\/code>http_api.path = [<\/code>\"finance\"<\/code>, <\/code>\"salary\"<\/code>, username]<\/code><\/div>\n
  <\/code>subordinates[http_api.user][_] = username<\/code><\/div>\n
  <\/code>http_api.remote_addr = <\/code>\"127.0.0.1\"<\/code><\/div>\n
  <\/code>http_api.user_agent = <\/code>\"curl\/7.47.0\"<\/code><\/div>\n
}<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n\n\n\n

At first it defines a data set, which represents the relationship subordinates. For example as per this dataset, alice is a subordinate of bob. Then it defines 3 rules that will give feedback as ‘allow’.<\/p>\n\n\n\n