3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-05-01 19:36:32 +02:00
Code Issues Projects Releases Packages Wiki Activity

evaluator: use impersonate groups if impersonate email is set (#1701)

Browse source
This commit is contained in:
Caleb Doxsey 2020-12-21 09:47:12 -07:00 • committed by GitHub
parent c367498fbc
commit 4eec2ed1d5
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 13 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
authorize/evaluator/opa/policy/authz.rego
View file

@ -14,6 +14,8 @@ all_allowed_groups := get_allowed_groups(route_policy)
all_allowed_users := get_allowed_users(route_policy) all_allowed_users := get_allowed_users(route_policy)
all_allowed_idp_claims := get_allowed_idp_claims(route_policy) all_allowed_idp_claims := get_allowed_idp_claims(route_policy)
is_impersonating := count(input.session.impersonate_email) > 0
# allow public # allow public
allow { allow {
route_policy.AllowPublicUnauthenticatedAccess == true route_policy.AllowPublicUnauthenticatedAccess == true
@ -35,25 +37,27 @@ allow {
# allow by email # allow by email
allow { allow {
not is_impersonating
user.email == all_allowed_users[_] user.email == all_allowed_users[_]
input.session.impersonate_email == ""
} }
# allow group # allow group
allow { allow {
not is_impersonating
some group some group
groups[_] = group groups[_] = group
all_allowed_groups[_] = group all_allowed_groups[_] = group
input.session.impersonate_groups == null
} }
# allow by impersonate email # allow by impersonate email
allow { allow {
is_impersonating
all_allowed_users[_] = input.session.impersonate_email all_allowed_users[_] = input.session.impersonate_email
} }
# allow by impersonate group # allow by impersonate group
allow { allow {
is_impersonating
some group some group
input.session.impersonate_groups[_] = group input.session.impersonate_groups[_] = group
all_allowed_groups[_] = group all_allowed_groups[_] = group
@ -61,13 +65,14 @@ allow {
# allow by domain # allow by domain
allow { allow {
not is_impersonating
some domain some domain
email_in_domain(user.email, all_allowed_domains[domain]) email_in_domain(user.email, all_allowed_domains[domain])
input.session.impersonate_email == ""
} }
# allow by impersonate domain # allow by impersonate domain
allow { allow {
is_impersonating
some domain some domain
email_in_domain(input.session.impersonate_email, all_allowed_domains[domain]) email_in_domain(input.session.impersonate_email, all_allowed_domains[domain])
} }

10
authorize/evaluator/opa/policy/authz_test.rego
View file

@ -70,7 +70,7 @@ test_group_allowed {
"groups": ["1"] "groups": ["1"]
} with } with
input.http as { "url": "http://example.com" } with input.http as { "url": "http://example.com" } with
input.session as { "id": "session1", "impersonate_groups": null } input.session as { "id": "session1" }
} }
test_impersonate_groups_not_allowed { test_impersonate_groups_not_allowed {
@ -86,12 +86,10 @@ test_impersonate_groups_not_allowed {
"user": { "user": {
"email": "x@example.com" "email": "x@example.com"
}, },
"directory_user": { "groups": ["1"]
"groups": ["1"]
}
} with } with
input.http as { "url": "http://example.com" } with input.http as { "url": "http://example.com" } with
input.session as { "id": "session1", "impersonate_groups": ["2"] } input.session as { "id": "session1", "impersonate_email": "y@example.com", "impersonate_groups": ["2"] }
} }
test_impersonate_groups_allowed { test_impersonate_groups_allowed {
@ -112,7 +110,7 @@ test_impersonate_groups_allowed {
} }
} with } with
input.http as { "url": "http://example.com" } with input.http as { "url": "http://example.com" } with
input.session as { "id": "session1", "impersonate_groups": ["2"] } input.session as { "id": "session1", "impersonate_email": "y@example.com", "impersonate_groups": ["2"] }
} }
test_domain_allowed { test_domain_allowed {

2
authorize/evaluator/opa/policy/statik.go
View file

File diff suppressed because one or more lines are too long