-
Notifications
You must be signed in to change notification settings - Fork 22
docs(admin-ui): access control using cedarling docs #2444
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from 3 commits
Commits
Show all changes
10 commits
Select commit
Hold shift + click to select a range
94e4149
docs: cedarling docs
duttarnab e622775
docs: correcting the sentences
duttarnab f93e5bd
docs: correcting the sentences
duttarnab efe29ff
feat: adding diagram
duttarnab 54a8d0d
docs: improving description
duttarnab 970843a
docs: fix code-rabbit suggeations
duttarnab ffa931e
docs: fix code-rabbit suggeations
duttarnab 88aa65c
docs: address code-rabbit suggestion
duttarnab d5403a8
docs: address code-rabbit suggestion
duttarnab b57f743
Merge branch 'main' into admin-ui-2322-cedarling-docs
moabu File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Some comments aren't visible on the classic Files Changed page.
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,196 @@ | ||
| --- | ||
| tags: | ||
| - administration | ||
| - admin-ui | ||
| - access control | ||
| - cedarling | ||
| - security | ||
| --- | ||
|
|
||
| # Access Control in Admin UI | ||
|
|
||
| The role of the user logged-in to Gluu Flex Admin UI decides if the user will have access to a certain Admin UI's feature or not. After user authentication the user's role and other claims are packed in bundle of tokens (access_token, id_token and userinfo_token). [Cedarling](https://docs.jans.io/stable/cedarling) PDP embedded with GUI, processes the tokens and decides if the action (like Read, Write or Delete) is allowed on this resource (feature). The Cedarling's Token Based Access Control (TBAC) is used for managing access control in Gluu Flex Admin UI. | ||
|
|
||
| ## Admin UI Features (Resources) | ||
|
|
||
| The Admin UI features (or resources) are categorised into following parent groups. This categorization is done for resource grouping in cedar policies used for governing the authorization decision taken by Cedarling. | ||
|
|
||
| - System and monitoring | ||
| - Dashboard | ||
| - Health | ||
| - License | ||
| - MAU | ||
| - Settings | ||
| - Security | ||
| - Webhooks | ||
| - Assests | ||
| - AuditLogs | ||
| - AuthServer and configuration | ||
| - Clients | ||
| - Scopes | ||
| - Keys | ||
| - AuthServerProperties | ||
| - Logging | ||
| - SSA | ||
| - Authn | ||
| - ConfigAPIPropeties | ||
| - Sesisons | ||
| - Identity and Access | ||
| - Users | ||
| - Scripts | ||
| - UserClaims | ||
| - Service | ||
| - Cache | ||
| - Persistance | ||
| - SMTP | ||
| - SCIM | ||
| - FIDO | ||
| - SAML | ||
| - Lock | ||
duttarnab marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| In the Policy Store we use [default_entities](https://docs.jans.io/stable/cedarling/cedarling-policy-store/#default-entities) to map the parent group with the sub features. For e.g. here we are showing the default entity json to map the features under `System and monitoring` parent group. | ||
|
|
||
| ```json | ||
| { | ||
| "1694c954f8d9": { | ||
| "uid": { | ||
| "type": "Gluu::Flex::AdminUI::Resources::Features", | ||
| "id": "Dashboard" | ||
| }, | ||
| "attrs": {}, | ||
| "parents": [ | ||
| { | ||
| "type": "Gluu::Flex::AdminUI::Resources::ParentResource", | ||
| "id": "SystemAndMonitoring" | ||
| } | ||
| ] | ||
| }, | ||
| "2694c954f8d8": { | ||
| "uid": { | ||
| "type": "Gluu::Flex::AdminUI::Resources::Features", | ||
| "id": "License" | ||
| }, | ||
| "attrs": {}, | ||
| "parents": [ | ||
duttarnab marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| { | ||
| "type": "Gluu::Flex::AdminUI::Resources::ParentResource", | ||
| "id": "SystemAndMonitoring" | ||
| } | ||
| ] | ||
| }, | ||
| "3694c954f8d7": { | ||
| "uid": { | ||
| "type": "Gluu::Flex::AdminUI::Resources::Features", | ||
| "id": "MAU" | ||
| }, | ||
| "attrs": {}, | ||
| "parents": [ | ||
| { | ||
| "type": "Gluu::Flex::AdminUI::Resources::ParentResource", | ||
| "id": "SystemAndMonitoring" | ||
| } | ||
| ] | ||
| }, | ||
| "4694c954f8d6": { | ||
| "uid": { | ||
| "type": "Gluu::Flex::AdminUI::Resources::Features", | ||
| "id": "Security" | ||
| }, | ||
| "attrs": {}, | ||
| "parents": [ | ||
| { | ||
| "type": "Gluu::Flex::AdminUI::Resources::ParentResource", | ||
| "id": "SystemAndMonitoring" | ||
| } | ||
| ] | ||
| }, | ||
| "6494c954f8d6": { | ||
| "uid": { | ||
| "type": "Gluu::Flex::AdminUI::Resources::Features", | ||
| "id": "Settings" | ||
| }, | ||
| "attrs": {}, | ||
| "parents": [ | ||
| { | ||
| "type": "Gluu::Flex::AdminUI::Resources::ParentResource", | ||
| "id": "SystemAndMonitoring" | ||
| } | ||
| ] | ||
| }, | ||
| ... | ||
| } | ||
| ``` | ||
duttarnab marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| ## Managing Admin UI's Policy Store | ||
|
|
||
| After installation, Admin UI uses a default Policy Store for GUI access control. The logged-in user can use the [Cedarling configuration screen](./configuration.md#cedarling-configuration) to configure a remote Policy Store generated by [Agama-Lab](https://cloud.gluu.org/agama-lab) using its URL. When the Policy Store URL is configured, the backend parses the Policy Store to determine the roles and the role-to-scope mappings. The Policy Store is used for managing GUI access control. The aggregated role-to-scope mapping (obtained by parsing the Policy Store) ensures that only the mapped scopes are added in the authorization tokens to access the appropriate protected Config API endpoints. | ||
|
|
||
| ## Policies | ||
|
|
||
| The Cedar policies in the Policy Store empowers the administrator with following: | ||
|
|
||
| ### MAnage the access control in Admin UI | ||
|
|
||
| The Cedar policies are rules which decides if the logged in user can perform Read, Write or Delete action on a feature or not. By writing the appropriate cedar policies the administrator can manage access control in Admin UI. For e.g the below policy allows the user with role **admin** to perform **Read**, **Write** or **Delete** actions on all the features under the parent group **AuthServerAndConfiguration**. | ||
|
|
||
| ``` | ||
coderabbitai[bot] marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
| @id("AdminCanManageAuthServerConfiguration") | ||
| permit ( | ||
| principal in Gluu::Flex::AdminUI::Role::"admin", | ||
| action in [Gluu::Flex::AdminUI::Action::"read", | ||
| Gluu::Flex::AdminUI::Action::"write", | ||
| Gluu::Flex::AdminUI::Action::"delete"], | ||
| resource in Gluu::Flex::AdminUI::Resources::ParentResource::"AuthServerAndConfiguration" | ||
| ); | ||
| ``` | ||
duttarnab marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| Below policy gives the users with role **viewer** the **Read** access to all the features under the **IdentityAndAccess** parent group. | ||
|
|
||
| ``` | ||
| @id("ViewerCanViewUserIdentityAndAccess") | ||
| permit ( | ||
| principal in Gluu::Flex::AdminUI::Role::"viewer", | ||
| action in Gluu::Flex::AdminUI::Action::"read", | ||
| resource in Gluu::Flex::AdminUI::Resources::ParentResource::"IdentityAndAccess" | ||
| ); | ||
| ``` | ||
|
|
||
| Below policy gives the users with role **auditor** the **Read**, **Write** and **Delete** access to only the **Clients** feature of Admin UI. | ||
|
|
||
| ``` | ||
| @id("AuditorCanManageClients") | ||
| permit ( | ||
| principal in Gluu::Flex::AdminUI::Role::"auditor", | ||
| action in [Gluu::Flex::AdminUI::Action::"read", | ||
| Gluu::Flex::AdminUI::Action::"write", | ||
| Gluu::Flex::AdminUI::Action::"delete"], | ||
| resource in Gluu::Flex::AdminUI::Resources::Features::"Clients" | ||
| ); | ||
| ``` | ||
|
|
||
| ### Adding new Roles in Admin UI | ||
|
|
||
| To add new Admin UI user roles, the administrator just need to introduce the policies associated with those roles in the Policy Store. On saving the Policy Store the Admin UI parses it and aggregates the roles and role-to-scope mapping. The aggregated data is saved into the persistence. | ||
|
|
||
| ### Writing policies for Admin UI | ||
|
|
||
| The principal element in a [Cedar policy](https://docs.cedarpolicy.com/) represents a user, service, or other identity that can make a request to perform an action on a resource in your application. We will learn how to write an Admin UI policy using a sample scenario: a logged-in user with the **admin** role can manage the **Auth Server and its configuration**. | ||
|
|
||
| ``` | ||
| @id("AdminCanManageAuthServerConfiguration") | ||
| permit ( | ||
| principal in Gluu::Flex::AdminUI::Role::"admin", | ||
| action in [Gluu::Flex::AdminUI::Action::"read", | ||
| Gluu::Flex::AdminUI::Action::"write", | ||
| Gluu::Flex::AdminUI::Action::"delete"], | ||
| resource in Gluu::Flex::AdminUI::Resources::ParentResource::"AuthServerAndConfiguration" | ||
| ); | ||
| ``` | ||
| **Principal :** | ||
| We are using the administrator's **role** as principal while writing the policies for Admin UI. Here `Gluu::Flex::AdminUI::` is the namespace in cedar schema where the `Role` entity resides. The **admin** surrounded by inverted commas is the Entity Id of the **Role** entity and is basically the role name. | ||
|
|
||
| **Action :** | ||
| In this policy, we are allowing **Read**, **Write** and **Delete** actions on the resource. Here we have `action in [Gluu::Flex::AdminUI::Action::"read", Gluu::Flex::AdminUI::Action::"write", Gluu::Flex::AdminUI::Action::"delete"]`. The `Gluu::Flex::AdminUI::` is the namespace where all action entities reside. | ||
|
|
||
| **Resource :** | ||
| As we have categorised Admin UI features (or resources) into the parent groups, `resource in Gluu::Flex::AdminUI::Resources::ParentResource::"AuthServerAndConfiguration"` allows the user with role **admin** to perform **Read**, **Write** and **Delete** actions on all the features under **AuthServerAndConfiguration** parent group. Here `Gluu::Flex::AdminUI::Resources::` is the namespace where **ParentResource** entity resides. The **ParentResource** entity represents the parent group and **AuthServerAndConfiguration** in inverted commas is the entity id representing name of the parent group. | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.