Documentation
¶
Index ¶
- Constants
- func Init(conf rbacconf.Config, policyPath string, authNconf config.Authentication, ...) (*casbin.SyncedCachedEnforcer, error)
- type Manager
- func (m *Manager) AddRolesForUser(user string, roles []string) error
- func (m *Manager) Authorize(ctx context.Context, principal *models.Principal, verb string, ...) error
- func (m *Manager) AuthorizeSilent(ctx context.Context, principal *models.Principal, verb string, ...) error
- func (m *Manager) CountNamespaceLocalRBAC(namespace string) (int, error)
- func (m *Manager) CreateRolesPermissions(roles map[string][]authorization.Policy) error
- func (m *Manager) DeleteRoles(roles ...string) error
- func (m *Manager) FilterAuthorizedResources(ctx context.Context, principal *models.Principal, verb string, ...) ([]string, error)
- func (m *Manager) GetRoles(names ...string) (map[string][]authorization.Policy, error)
- func (m *Manager) GetRolesForUserOrGroup(userName string, authType authentication.AuthType, isGroup bool) (map[string][]authorization.Policy, error)
- func (m *Manager) GetUsersOrGroupForRole(roleName string, authType authentication.AuthType, isGroup bool) ([]string, error)
- func (m *Manager) GetUsersOrGroupsWithRoles(isGroup bool, authType authentication.AuthType) ([]string, error)
- func (m *Manager) HasPermission(roleName string, permission *authorization.Policy) (bool, error)
- func (m *Manager) ListGroupingSubjects() ([]string, error)
- func (m *Manager) NamespaceLocalRBAC(namespace string) (roles []string, subjects []NamespaceSubject, err error)
- func (m *Manager) RemovePermissions(roleName string, permissions []*authorization.Policy) error
- func (m *Manager) Restore(b []byte) error
- func (m *Manager) RevokeRolesForUser(userName string, roles ...string) error
- func (m *Manager) Snapshot() ([]byte, error)
- func (m *Manager) UpdateRolesPermissions(roles map[string][]authorization.Policy) error
- type NamespaceSubject
Constants ¶
const ( SnapshotVersionV0 = iota SnapshotVersionLatest )
const AuditLogVersion = 2
const DEFAULT_POLICY_VERSION = "1.29.0"
const ( // MODEL is the used model for casbin to store roles, permissions, users and comparisons patterns. // docs: https://casbin.org/docs/syntax-for-models MODEL = `` /* 281-byte string literal not displayed */ )
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Manager ¶ added in v1.30.9
type Manager struct {
// contains filtered or unexported fields
}
func New ¶
func New(rbacStoragePath string, rbacConf rbacconf.Config, authNconf config.Authentication, namespacesEnabled bool, logger logrus.FieldLogger) (*Manager, error)
func (*Manager) AddRolesForUser ¶ added in v1.30.9
AddRolesFroUser NOTE: user has to be prefixed by user:, group:, key: etc. see func PrefixUserName(user) it will prefix username and nop-op if already prefixed
func (*Manager) Authorize ¶ added in v1.30.9
func (m *Manager) Authorize(ctx context.Context, principal *models.Principal, verb string, resources ...string) error
Authorize verify if the user has access to a resource to do specific action
func (*Manager) AuthorizeSilent ¶ added in v1.30.9
func (m *Manager) AuthorizeSilent(ctx context.Context, principal *models.Principal, verb string, resources ...string) error
AuthorizeSilent verify if the user has access to a resource to do specific action without audit logs to be used internally
func (*Manager) CountNamespaceLocalRBAC ¶ added in v1.38.3
CountNamespaceLocalRBAC returns the number of namespace-local roles plus direct-principal assignments in the namespace. Removal of a namespace entity is blocked while this is non-zero.
func (*Manager) CreateRolesPermissions ¶ added in v1.30.9
func (m *Manager) CreateRolesPermissions(roles map[string][]authorization.Policy) error
func (*Manager) DeleteRoles ¶ added in v1.30.9
func (*Manager) FilterAuthorizedResources ¶ added in v1.30.9
func (m *Manager) FilterAuthorizedResources(ctx context.Context, principal *models.Principal, verb string, resources ...string) ([]string, error)
FilterAuthorizedResources authorize the passed resources with best effort approach, it will return list of allowed resources, if none, it will return an empty slice
func (*Manager) GetRolesForUserOrGroup ¶ added in v1.32.5
func (m *Manager) GetRolesForUserOrGroup(userName string, authType authentication.AuthType, isGroup bool) (map[string][]authorization.Policy, error)
func (*Manager) GetUsersOrGroupForRole ¶ added in v1.32.5
func (*Manager) GetUsersOrGroupsWithRoles ¶ added in v1.32.5
func (*Manager) HasPermission ¶ added in v1.30.9
func (*Manager) ListGroupingSubjects ¶ added in v1.38.3
ListGroupingSubjects returns the subject key of every role-assignment row (each a `<prefix>:<user>` or `<prefix>:<group>` string).
func (*Manager) NamespaceLocalRBAC ¶ added in v1.38.3
func (m *Manager) NamespaceLocalRBAC(namespace string) (roles []string, subjects []NamespaceSubject, err error)
NamespaceLocalRBAC returns the namespace-local role names and the distinct direct (db/oidc) principals whose role assignments belong to namespace. It is the single source of "what RBAC belongs to a namespace": the removal-block gate counts this set and the delete cascade revokes/deletes exactly it, so the two stay consistent by construction. Group assignments are global and so are excluded — a namespace-named group can't block its namespace's removal.
func (*Manager) RemovePermissions ¶ added in v1.30.9
func (m *Manager) RemovePermissions(roleName string, permissions []*authorization.Policy) error
func (*Manager) RevokeRolesForUser ¶ added in v1.30.9
func (*Manager) UpdateRolesPermissions ¶ added in v1.30.9
func (m *Manager) UpdateRolesPermissions(roles map[string][]authorization.Policy) error
there is no different between UpdateRolesPermissions and CreateRolesPermissions, purely to satisfy an interface
type NamespaceSubject ¶ added in v1.38.3
type NamespaceSubject struct {
ID string
AuthType authentication.AuthType
}
NamespaceSubject is a direct (db/oidc) principal holding at least one role assignment bound to a namespace. ID is the user id without the auth-type prefix, e.g. "customer1:bob".
Source Files
Directories