3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-08-03 08:50:42 +02:00
Code Issues Projects Releases Packages Wiki Activity

authorize/evaluator/opa/policy: fix allow rules with impersonate (#1094)

Browse source 
Currently, with impersonated request, the real user email/group still
has effects.

Example:

	data.route_policies as [{
	    "source": "example.com",
	    "allowed_users": ["x@example.com"]
	}] with
	input.databroker_data as {
	    "session": {
	        "user_id": "user1"
	    },
	    "user": {
	        "email": "x@example.com"
	    }
	} with
	input.http as { "url": "http://example.com" } with
	input.session as { "id": "session1", "impersonate_email": "y@example.com" }

Here user "x@example.com" is allowed, but was impersonated as
"y@example.com". As the rules indicated, the request must be denied,
because it only allows "x@example.com", not "y@example.com". The current
bug causes the request is still allowed.

To fix it, when evaluates rules for allowed email/group/domain, we must checking
that the impersonate email/groups is not set/empty.

Fixes #1091
This commit is contained in:
Cuong Manh Le 2020-07-17 22:07:11 +07:00 • committed by GitHub
parent 59c17fb497
commit 408f201d16
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 163 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

159
authorize/evaluator/opa/policy/authz_test.rego
View file

@ -8,14 +8,167 @@ test_email_allowed {
}] with
input.databroker_data as {
"session": {
"user_id": "user1"
},
"user_id": "user1"
},
"user": {
"email": "x@example.com"
}
} with
input.http as { "url": "http://example.com" } with
input.session as { "id": "session1" }
input.session as { "id": "session1", "impersonate_email": "" }
}
test_impersonate_email_not_allowed {
not allow with
data.route_policies as [{
"source": "example.com",
"allowed_users": ["x@example.com"]
}] with
input.databroker_data as {
"session": {
"user_id": "user1"
},
"user": {
"email": "x@example.com"
}
} with
input.http as { "url": "http://example.com" } with
input.session as { "id": "session1", "impersonate_email": "y@example.com" }
}
test_impersonate_email_allowed {
allow with
data.route_policies as [{
"source": "example.com",
"allowed_users": ["y@example.com"]
}] with
input.databroker_data as {
"session": {
"user_id": "user1"
},
"user": {
"email": "x@example.com"
}
} with
input.http as { "url": "http://example.com" } with
input.session as { "id": "session1", "impersonate_email": "y@example.com" }
}
test_group_allowed {
allow with
data.route_policies as [{
"source": "example.com",
"allowed_groups": ["1"]
}] with
input.databroker_data as {
"session": {
"user_id": "user1"
},
"user": {
"email": "x@example.com",
},
"directory_user": {
"groups": ["1"]
}
} with
input.http as { "url": "http://example.com" } with
input.session as { "id": "session1", "impersonate_groups": null }
}
test_impersonate_groups_not_allowed {
not allow with
data.route_policies as [{
"source": "example.com",
"allowed_groups": ["1"]
}] with
input.databroker_data as {
"session": {
"user_id": "user1"
},
"user": {
"email": "x@example.com"
},
"directory_user": {
"groups": ["1"]
}
} with
input.http as { "url": "http://example.com" } with
input.session as { "id": "session1", "impersonate_groups": ["2"] }
}
test_impersonate_groups_allowed {
allow with
data.route_policies as [{
"source": "example.com",
"allowed_groups": ["2"]
}] with
input.databroker_data as {
"session": {
"user_id": "user1"
},
"user": {
"email": "x@example.com"
},
"directory_user": {
"groups": ["1"]
}
} with
input.http as { "url": "http://example.com" } with
input.session as { "id": "session1", "impersonate_groups": ["2"] }
}
test_domain_allowed {
allow with
data.route_policies as [{
"source": "example.com",
"allowed_domains": ["example.com"]
}] with
input.databroker_data as {
"session": {
"user_id": "user1"
},
"user": {
"email": "x@example.com"
}
} with
input.http as { "url": "http://example.com" } with
input.session as { "id": "session1", "impersonate_email": "" }
}
test_impersonate_domain_not_allowed {
not allow with
data.route_policies as [{
"source": "example.com",
"allowed_domains": ["example.com"]
}] with
input.databroker_data as {
"session": {
"user_id": "user1"
},
"user": {
"email": "x@example.com"
}
} with
input.http as { "url": "http://example.com" } with
input.session as { "id": "session1", "impersonate_email": "y@example1.com" }
}
test_impersonate_domain_allowed {
allow with
data.route_policies as [{
"source": "example.com",
"allowed_domains": ["example1.com"]
}] with
input.databroker_data as {
"session": {
"user_id": "user1"
},
"user": {
"email": "x@example.com"
}
} with
input.http as { "url": "http://example.com" } with
input.session as { "id": "session1", "impersonate_email": "y@example1.com" }
}
test_example {