eko/authz

🛡️ Authorization backend that comes with a UI for RBAC and ABAC permissions

Hi 👋

I'm Vincent. I work with open-source for so many years and I love to discover, contribute and share new things with other developers!

🌱 My latest projects

• eko/asdf-tctl - Temporal tctl plugin for the asdf plugin manager
• eko/asdf-temporalite - Temporalite plugin for the asdf plugin manager
• eko/authz-nodejs-sdk - Authz NodeJS SDK
• eko/authz-php-sdk - Authz PHP SDK
• eko/authz-python-sdk - Authz Python SDK

📜 My recent blog posts

• LLM with Ollama and similarity search with Qdrant, vector database (4 months ago)
• Construct robust workflows with Temporal.io using Go (1 year ago)
• Authz: Authorization backend using ABAC and RBAC (2 years ago)
• Dependency injection in Go with uber-go/fx (2 years ago)
• OpenTelemetry: Trace and instrument your application code (2 years ago)

🔭 Latest releases I've contributed to

• etf1/kafka-transformer (v0.0.7, 1 week ago) - kafka-transformer is a library for simplyfing message transformation tasks when using kafka
• eko/gocache (store/hazelcast/v4.2.0, 1 month ago) - ☔️ A complete Go cache library that brings you multiple ways of managing your caches
• eko/FeedBundle (2.2.0, 6 months ago) - A Symfony bundle to build RSS feeds from your entities

💬 Feedback

Everyone likes feedback! So if you are using one of my projects, please do not hesitate to hear your voice.

📫 How to reach me

• Website: https://vincent.composieux.fr
• Twitter: https://twitter.com/vcomposieux
• LinkedIn: https://www.linkedin.com/in/vincentcomposieux/

authz's Issues

Can't install Go SDK

env:

go version
go version go1.19.4 darwin/amd64

~env | grep GO
GOBIN=/Users/ltagliamonte/go/bin
GOPATH=/Users/ltagliamonte/go

Following the instructions at this link i get an import error:

go get github.com/eko/authz/sdk@latest
go: github.com/eko/authz/[email protected]: reading github.com/eko/authz/backend/go.mod at revision backend/v0.0.0: unknown revision backend/v0.0.0

no luck also trying also:

go get -u github.com/eko/authz/sdk
go: downloading github.com/eko/authz/sdk v0.0.0-20230430134208-23688ec53c7c
go: downloading github.com/eko/authz v0.8.1
go: github.com/eko/authz/[email protected]: reading github.com/eko/authz/backend/go.mod at revision backend/v0.0.0: unknown revision backend/v0.0.0

Prevent Resources to be auto created by Policies

The creation of a Policy auto creates the associated Resource.
In terms of user experience it sort of hides the required connection between a Policy and a Resource object.
How to replicate:

docker run --rm \
    -e database_driver=sqlite \
    -e database_name=:memory: \
    -p 8080:8080 \
    -p 8081:8081 \
    -p 3000:80 \
    ekofr/authz:v0.8.3-standalone

login to http://localhost:3000/ with default username/pwd.

Navigate to: Policies -> Create New Policy
Fill the Form and Submit:
Name: deploy
Association: deploy.*
Actions: get

Navigate to Resources and the Resource deploy got automatically created.

Restricted Admin Access and Field Checks in Authz

Hello @eko,

I am working with Authz for managing authorizations across several applications, and I've encountered an issue related to restricted admin access and custom field checks.
I have several administrators for multiple applications, including Authz. I wish to allow these admins to access Authz, but with the restriction that they can only add new principals and assign them roles specific to their application. To implement this, I've added a custom field (e.g., application1=true) in the principal entity.

For role assignment, I've created roles with policies that check for the existence of this new field in the principal and restrict all access except for the principal list. However, when logging in with this new admin user, I expected to see the principal list but instead received an "access denied" error.

Questions/Requests:
Usecase Feasibility: Is my use case possible with Authz's current capabilities? Specifically, can I restrict admin users to only add new principals and assign roles based on a custom field in the principal?

Custom Field Checks: In addition to checking for equality, is there a way to implement a "contains" check for custom fields in Authz? This feature would be particularly useful for scenarios where a principal might belong to multiple applications.

Steps to Reproduce:

1. Create a principal with a custom field (e.g., application1=true).
2. Assign a role to this principal with policies that allow listing principals but restrict other accesses, checking for the custom field.
3. Log in as the principal and attempt to access the principal list.

Expected Behavior:
The admin user should be able to see and manage the principal list based on the custom field's condition.

Actual Behavior:
Received an "access denied" error when attempting to access the principal list.

I appreciate any guidance or suggestions you can provide to resolve these issues or implement these features.

GoFiber Middleware

Hello @eko I was wondering if you have thought about making a contrib GoFiber middleware for authz?

Your site is down

Title :)

Prevent admin user deletion

Currently it is possible to delete the admin user, effectively making an installation useless.
Would be nice to have a check to prevent the admin user to be deleted.

Steps to reproduce:

• login
• select User tab
• select Bin icon next to admin user
• select Ok