mirror of
https://github.com/pomerium/pomerium.git
synced 2025-05-29 17:07:24 +02:00
sessions: add impersonate_session_id, remove legacy impersonation (#2407)
* sessions: add impersonate_session_id, remove legacy impersonation
* show impersonated user details
* fix headers
* address feedback
* only check impersonate id on non-nil pbSession
* Revert "only check impersonate id on non-nil pbSession"
This reverts commit a6f7ca5abd
.
This commit is contained in:
parent
2b6813dc95
commit
1a95036b8c
11 changed files with 116 additions and 216 deletions
|
@ -3,15 +3,23 @@ package rules
|
|||
|
||||
import "github.com/open-policy-agent/opa/ast"
|
||||
|
||||
// GetSession the session for the given id.
|
||||
// GetSession gets the session for the given id.
|
||||
func GetSession() *ast.Rule {
|
||||
return ast.MustParseRule(`
|
||||
get_session(id) = v {
|
||||
v = get_databroker_record("type.googleapis.com/user.ServiceAccount", id)
|
||||
v != null
|
||||
} else = iv {
|
||||
v = get_databroker_record("type.googleapis.com/session.Session", id)
|
||||
v != null
|
||||
object.get(v, "impersonate_session_id", "") != ""
|
||||
|
||||
iv = get_databroker_record("type.googleapis.com/session.Session", v.impersonate_session_id)
|
||||
iv != null
|
||||
} else = v {
|
||||
v = get_databroker_record("type.googleapis.com/session.Session", id)
|
||||
v != null
|
||||
object.get(v, "impersonate_session_id", "") == ""
|
||||
} else = {} {
|
||||
true
|
||||
}
|
||||
|
@ -22,9 +30,6 @@ get_session(id) = v {
|
|||
func GetUser() *ast.Rule {
|
||||
return ast.MustParseRule(`
|
||||
get_user(session) = v {
|
||||
v = get_databroker_record("type.googleapis.com/user.User", session.impersonate_user_id)
|
||||
v != null
|
||||
} else = v {
|
||||
v = get_databroker_record("type.googleapis.com/user.User", session.user_id)
|
||||
v != null
|
||||
} else = {} {
|
||||
|
@ -37,8 +42,6 @@ get_user(session) = v {
|
|||
func GetUserEmail() *ast.Rule {
|
||||
return ast.MustParseRule(`
|
||||
get_user_email(session, user) = v {
|
||||
v = session.impersonate_email
|
||||
} else = v {
|
||||
v = user.email
|
||||
} else = "" {
|
||||
true
|
||||
|
@ -50,9 +53,6 @@ get_user_email(session, user) = v {
|
|||
func GetDirectoryUser() *ast.Rule {
|
||||
return ast.MustParseRule(`
|
||||
get_directory_user(session) = v {
|
||||
v = get_databroker_record("type.googleapis.com/directory.User", session.impersonate_user_id)
|
||||
v != null
|
||||
} else = v {
|
||||
v = get_databroker_record("type.googleapis.com/directory.User", session.user_id)
|
||||
v != null
|
||||
} else = "" {
|
||||
|
@ -77,9 +77,6 @@ get_directory_group(id) = v {
|
|||
func GetGroupIDs() *ast.Rule {
|
||||
return ast.MustParseRule(`
|
||||
get_group_ids(session, directory_user) = v {
|
||||
v = session.impersonate_groups
|
||||
v != null
|
||||
} else = v {
|
||||
v = directory_user.group_ids
|
||||
v != null
|
||||
} else = [] {
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue