|
| 1 | +# Access Control Policies |
| 2 | + |
| 3 | +Hydra uses the Access Control Library [Ladon](https://github.com/ory-am/ladon). |
| 4 | +For a deep dive, it is a good idea to read the [Ladon Docs](https://github.com/ory-am/ladon#ladon). |
| 5 | + |
| 6 | +In Hydra, policy based access control is when you decide if: |
| 7 | + |
| 8 | +- Aaron (subject) is allowed (effect) to create (action) a new forum post (resource) when accessing the forum website from IP 192.168.178.3 (context). |
| 9 | +- Richard (subject) is allowed (effect) to delete (action) a status update (resource) when he is the author (context). |
| 10 | + |
| 11 | +Or, more *generalized:* **Who** is **able** to do **what** on **something** with some **context**. |
| 12 | + |
| 13 | +* **Who (Subject)**: An arbitrary unique subject name, for example "ken" or "printer-service.mydomain.com". |
| 14 | +* **Able (Effect)**: The effect which is always "allow" or "deny". |
| 15 | +* **What (Action)**: An arbitrary action name, for example "delete", "create" or "scoped:action:something". |
| 16 | +* **Something (Resource)**: An arbitrary unique resource name, for example "something", "resources:articles:1234" or some uniform resource name like "urn:isbn:3827370191". |
| 17 | +* **Context (Context)**: The current context which may environment information like the IP Address, request date, the resource owner name, the department ken is working in and anything you like. |
| 18 | + |
| 19 | +Policies are JSON documents managed via the [Policy API](http://docs.hdyra.apiary.io/#reference/policies). |
| 20 | + |
| 21 | +``` |
| 22 | +{ |
| 23 | + // A required unique identifier. Used primarily for database retrieval. |
| 24 | + "id": "68819e5a-738b-41ec-b03c-b58a1b19d043", |
| 25 | + |
| 26 | + // A optional human readable description. |
| 27 | + "description": "something humanly readable", |
| 28 | + |
| 29 | + // A subject can be an user or a service. It is the "who" in "who is allowed to do what on something". |
| 30 | + // As you can see here, you can use regular expressions inside < >. |
| 31 | + "subjects": ["user", "<peter|max>"], |
| 32 | + |
| 33 | + |
| 34 | + // Should access be allowed or denied? |
| 35 | + // Note: If multiple policies match an access request, ladon.DenyAccess will always override ladon.AllowAccess |
| 36 | + // and thus deny access. |
| 37 | + "effect": "allow", |
| 38 | + |
| 39 | + // Which resources this policy affects. |
| 40 | + // Again, you can put regular expressions in inside < >. |
| 41 | + "resources": ["articles:<[0-9]+>"], |
| 42 | + |
| 43 | + // Which actions this policy affects. Supports RegExp |
| 44 | + // Again, you can put regular expressions in inside < >. |
| 45 | + "actions": ["create","update"], |
| 46 | + |
| 47 | + // Under which conditions this policy is "active". |
| 48 | + "conditions": { |
| 49 | + "owner": { |
| 50 | + // In this example, the policy is only "active" when the requested subject is the owner of the resource as well. |
| 51 | + "type": "EqualsSubjectCondition", |
| 52 | + "options": {} |
| 53 | + } |
| 54 | + } |
| 55 | +} |
| 56 | +``` |
| 57 | + |
| 58 | +## Examples |
| 59 | + |
| 60 | +### Let everyone read public JWKs |
| 61 | + |
| 62 | +``` |
| 63 | +[ |
| 64 | + { |
| 65 | + "description": "Allow everyone including anonymous users to read JSON Web Keys having Key ID *public*.", |
| 66 | + "subject": ["<.*>"], |
| 67 | + "effect": "allow", |
| 68 | + "resources": [ |
| 69 | + "rn:hydra:keys:<[^:]+>:public" |
| 70 | + ], |
| 71 | + "permissions": [ |
| 72 | + "get" |
| 73 | + ] |
| 74 | + } |
| 75 | +] |
| 76 | +``` |
| 77 | + |
| 78 | +### Deny anyone from reading private JWKs |
| 79 | + |
| 80 | +``` |
| 81 | +[ |
| 82 | + { |
| 83 | + "description": "Explicitly deny everyone reading JSON Web Keys with Key ID *private*.", |
| 84 | + "subject": ["<.*>"], |
| 85 | + "effect": "allow", |
| 86 | + "resources": [ |
| 87 | + "rn:hydra:keys:<[^:]+>:private" |
| 88 | + ], |
| 89 | + "permissions": [ |
| 90 | + "get" |
| 91 | + ] |
| 92 | + } |
| 93 | +] |
| 94 | +``` |
0 commit comments