3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-06-07 13:22:43 +02:00
Code Issues Projects Releases Packages Wiki Activity

fix headers

Browse source
This commit is contained in:
Caleb Doxsey 2021-07-29 14:50:14 -06:00
parent 3b9245214c
commit d54a30bb20
1 changed files with 14 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

31
authorize/evaluator/opa/policy/headers.rego
View file

@ -26,20 +26,25 @@ package pomerium.headers
# 5 minutes from now in seconds # 5 minutes from now in seconds
five_minutes := round((time.now_ns() / 1e9) + (60 * 5)) five_minutes := round((time.now_ns() / 1e9) + (60 * 5))
session = s { session = v {
s = get_databroker_record("type.googleapis.com/user.ServiceAccount", input.session.id) v = get_databroker_record("type.googleapis.com/user.ServiceAccount", input.session.id)
s != null v != null
} else = s { } else = iv {
s = get_databroker_record("type.googleapis.com/session.Session", input.session.id) v = get_databroker_record("type.googleapis.com/session.Session", input.session.id)
s != null v != null
object.get(v, "impersonate_session_id", "") != ""
iv = get_databroker_record("type.googleapis.com/session.Session", v.impersonate_session_id)
iv != null
} else = v {
v = get_databroker_record("type.googleapis.com/session.Session", input.session.id)
v != null
object.get(v, "impersonate_session_id", "") == ""
} else = {} { } else = {} {
true true
} }
user = u { user = u {
u = get_databroker_record("type.googleapis.com/user.User", session.impersonate_user_id)
u != null
} else = u {
u = get_databroker_record("type.googleapis.com/user.User", session.user_id) u = get_databroker_record("type.googleapis.com/user.User", session.user_id)
u != null u != null
} else = {} { } else = {} {
@ -47,9 +52,6 @@ user = u {
} }
directory_user = du { directory_user = du {
du = get_databroker_record("type.googleapis.com/directory.User", session.impersonate_user_id)
du != null
} else = du {
du = get_databroker_record("type.googleapis.com/directory.User", session.user_id) du = get_databroker_record("type.googleapis.com/directory.User", session.user_id)
du != null du != null
} else = {} { } else = {} {
@ -57,9 +59,6 @@ directory_user = du {
} }
group_ids = gs { group_ids = gs {
gs = session.impersonate_groups
gs != null
} else = gs {
gs = directory_user.group_ids gs = directory_user.group_ids
gs != null gs != null
} else = [] { } else = [] {
@ -119,8 +118,6 @@ jwt_payload_user = v {
} }
jwt_payload_email = v { jwt_payload_email = v {
v = session.impersonate_email
} else = v {
v = directory_user.email v = directory_user.email
} else = v { } else = v {
v = user.email v = user.email