cfpb/kratos

:warning: THIS PROJECT IS DEPRECATED :warning: – pluggable authorization management

CFPB/Kratos

Zeus's winged enforcer.

A pluggable microservice to enforce authorization across the entire enterprise. One of the Pantheon of CFPB microservices.

Kratos keeps tracks of three things: (1) teams, (2) which users have which roles on those teams, and (3) which assets are available to the team. It can then, based on it's database of teams/users/assets, setup teams, users and permissions on other resources.

Kratos is built with Pantheon-Helpers, so it is built on an evented architucture using NodeJS and CouchDB. In order for kratos to enforce authorization on other resources, you must create a resource adapter. A resource adapter consists of: (1) authorization and (2) validation functions for asset management and (3) worker handlers.

This document explains generally how kratos works, and specifically how to create an adapter.

General Architecture

Kratos is built with Pantheon-Helpers. You should familiarize yourself with Pantheon-helpers documentation before continuing.

Authorization model

Users can have two different types of roles. A user with a particular Team Role only has that role on a particular team. If a user has a Resource role, they have that role system-wide. Assets can be assigned to teams (and soon, hopefully, users).

An example of a resource role might be gh|user. It conveys that the user has fulfilled all requirements necessary to be allowed to access the public github. An example of a Team Role might be administrator of the Pantheon Team. The Github resource adapter then defines how to map resource and team roles to github permissions. The Github resource adapter specifies that a user gets read/write access to a repo if (1) they have the gh|user resource role, and (2) they are a member or administrator of the team that ownes the repo.

which is All authenticated users have an entry in the _users database.

Kratos uses to CouchDB databases: the _users database and the t

An asset is provided by a service. So, for example, if you want kratos to manage

Kratos defines a number of actions for manipulating these three things.

kratos's Issues

Outdated Third Party Libraries (jQuery)

I noted that this source code uses an outdated version of jQuery (jquery-1.6.1.min.js). I believe that we should be updating to the latest version of the library for security best practices.

return proper http codes/content_type headers

Squash new repos' history

Kratos creates a new GH repo by pulling down the OSPT repo. This works great but it causes new projects to start with OSPT's entire git history which isn't good.

The simplest way to reset new repos' history seems to be: git reset $(git commit-tree HEAD^{tree} -m "Initial commit") as seen here. Will this command work on prod? Or will it fail when it tries to commit because a git user hasn't been configured on the server?

Get Team Details with hashResolveAll

get_team_details is an API endpoint currently in development to return resource details for a team.

Since there are several potential categories of resources, it doesn't make sense to fail the entire request if one resource is unavailable (e.g. if moirai is down, but github is not). Investigate the possibility of using hashResolveAll to provide partial resource results in the event that one endpoint is failing.

switch from couch to postgresql

refactor so all resource code is in one place

currently resource files are all over. Each resource should be in a single directory. This will be much easier once we switch away from couch.

think hard about async vs sync w/ remove/add asset

perhaps we need an a+ handler as well as a synchronous add asset method.

handle 409 in couch update handlers

I had thought update handlers dealt with 409s for you. but they do not.

enforce github

We can attempt to watch the github change feed. or we can do like puppet and read state every 30 minutes. I'm leaning towards the latter as I think it will be more robust.

switch from doc._id.slice... to doc.name

see #20 (diff)

replace teams.getTeamRolesForUser with a couchdb view

README is incomplete

The second to last line of the readme says:

An asset is provided by a service. So, for example, if you want kratos to manage

if I want kratos to manage WHAT?

first code review

@sephcoster and I spent an entire day reviewing the initial commit. Many fixes were made during the review. PR #1 addresses the remaining issue raised by the review.