Access Control Service

Build Status Dependencies Coverage Status

A microservice for access control part of the Restorecommerce.

Features

  • Attribute-based access control inspired by XACML.

  • Implementing the PAP (partially), PDP, PRP.

  • Supports arbitrary policies based on arbitrary attributes such as scoped roles as supported. by the Identity Service.

  • Control access to distributed resources centrally using. Rule, Policy and PolicySet.

  • Authorization policies can be updated at run time.

  • Emits events to trigger cache invalidation of the acs-client via flushCacheCommand event.

  • Mechanism to calculate hierarchical scopes for subject using Kafka, caching of subject and hierarchical scopes and invalidating the cache.

  • Support for access control list.

A detailed description on how ABAC is implemented in Restorecommerce.

Configuration

A GraphQL adapter has been integrated into the service for executing context queries io.restorecommerce.rule.ContextQuery to obtain required information to make the access decision. This GraphQL endpoint can be configured using adapter.graphql.url property in the configuration.

API

This microservice exposes the following gRPC endpoints:

Rule

A Rule resource.

io.restorecommerce.rule.Rule

Field Type Label Description

id

string

optional

Rule ID

name

string

optional

Rule name

description

string

optional

Rule description

target

io.restorecommerce.access_control.Target

optional

Rule target

context_query

io.restorecommerce.rule.ContextQuery

optional

GraphQL query which can be performed to obtain required info for request

condition

string

optional

Custom Javascript code to check if rule is applicable

effect

io.restorecommerce.access_control.Effect

optional

Rule effect; possible values are PERMIT and DENY

io.restorecommerce.access_control.Target

Field Type Label Description

subjects

io.restorecommerce.attribute.Attribute

optional

Entity requesting access

resources

io.restorecommerce.attribute.Attribute

optional

Resources to be accessed

actions

io.restorecommerce.attribute.Attribute

optional

Action to be performed on resources

io.restorecommerce.attribute.Attribute

Field Type Label Description

id

string

optional

Attribute ID

value

string

optional

Attribute value

attributes

[ ] io.restorecommerce.attribute.Attribute

optional

Nested Attributes

io.restorecommerce.rule.ContextQuery

Field Type Label Description

query

string

required

Query to retrieve external resources

filters

io.restorecommerce.filter.FilterOp

optional

List of argument keys to be passed from Request#context to query

Policy

A Policy resource consisting of set of Rules.

io.restorecommerce.policy.Policy

Field Type Label Description

id

string

optional

Policy ID

name

string

optional

Policy name

description

string

optional

Policy description

target

io.restorecommerce.access_control.Target

optional

Policy target

rules

[ ] io.restorecommerce.rule.Rule

optional

List of rules bounded to a policy

combining_algorithm

string

optional

Combining algorithm to be applied to the rules set

PolicySet

A PolicySet resource consisting of set of Policies.

io.restorecommerce.policy_set.PolicySet

Field Type Label Description

id

string

optional

Policy ID

name

string

optional

Policy name

description

string

optional

Policy description

target

io.restorecommerce.access_control.Target

optional

Policy target

policies

[ ] io.restorecommerce.policy.Policy

optional

List of policies binded to a policy set

combining_algorithm

string

optional

Combining algorithm to be applied to the policy set

IsAllowed

This operation is used when the target resource is known and it decides the outcome of an access control request. The policy or policy set is found to apply to a given request, its rules are evaluated to determine the access decision and response. Requests are performed providing io.restorecommerce.access_control.Request protobuf message as input and responses are a io.restorecommerce.access_control.Response message.

io.restorecommerce.access_control.Request

Field Type Label Description

target

io.restorecommerce.access_control.Target

required

Request target

context

io.restorecommerce.access_control.Context

required

Context variables for access control decisions based on custom scripts

io.restorecommerce.access_control.Context

Field Type Label Description

subject

google.protobuf.Any

required

Subject requesting access

resources

google.protobuf.Any

required

Resources to access

security

google.protobuf.Any

optional

security context

io.restorecommerce.access_control.Response

Field Type Label Description

decision

io.restorecommerce.access_control.Decision

required

Access decision; possible values are PERMIT, DENY and INDETERMINATE

obligation

io.restorecommerce.attribute.Attribute [ ]

optional

list of Obligation attached to decision

operation_status

io.restorecommerce.status.OperationStatus

required

operation status code and message

WhatIsAllowed

This operation is used when there is not a specific target resource for a request. It returns a reverse query containing only the policies and rules applicable to a given request. They can then be used on the client side to infer permissions. Requests are performed providing io.restorecommerce.access_control.Request protobuf message as input and responses are a io.restorecommerce.access_control.ReverseQuery message.

NOTE : For IsAllowed and WhatIsAllowed operations if context contains the subject token and identifier, then the service will emit a message to Kafka-topic with event name hierarchicalScopesRequest and service resonsible for creating the hierarchical scopes will consume this message and send back hierarchicalScopesResponse which is then saved to redis subject cache by this service. If the Subject role associations are modified then this service invalidates both the subject cache and acs-client cache. This cache for storing subject and hierarchical scopes is mandatory for optimal performance of the service.

io.restorecommerce.access_control.Request

Field Type Label Description

target

io.restorecommerce.access_control.Target

required

Request target

context

io.restorecommerce.access_control.Context

required

Context variables for access control decisions based on custom scripts

io.restorecommerce.access_control.ReverseQuery

Field Type Label Description

policy_sets

io.restorecommerce.policy_set.PolicySetRQ

optional

List of applicable policy sets

obligations

io.restorecommerce.attribute.Attribute [ ]

optional

Obligations attached to rules / policies

operation_status

io.restorecommerce.status.OperationStatus

required

operation status code and message

io.restorecommerce.policy_set.PolicySetRQ

Field Type Label Description

id

string

optional

Policy Set ID

target

io.restorecommerce.access_control.Target

optional

Policy set target

combining_algorithm

string

optional

Combining algorithm

effect

io.restorecommerce.access_control.Effect

optional

A policy target’s effect (only applicable if there are no rules)

policies

io.restorecommerce.policy.PolicyRQ

optional

List of policies bound to a policy set

io.restorecommerce.policy.PolicyRQ

Field Type Label Description

id

string

optional

Policy ID

target

io.restorecommerce.access_control.Target

optional

Policy target

combining_algorithm

string

optional

Combining algorithm

effect

io.restorecommerce.access_control.Effect

optional

A policy’s effect (only applicable if there are no rules)

has_rules

bool

optional

Flag to infer if effect should be considered or not

rules

io.restorecommerce.rule.RuleRQ

optional

List of policies bound to a policy set

io.restorecommerce.rule.RuleRQ

Field Type Label Description

id

string

optional

Policy Set ID

target

io.restorecommerce.access_control.Target

optional

Policy set target

effect

io.restorecommerce.access_control.Effect

optional

A policy’s effect (only applicable if there are no rules)

CRUD Operations

The microservice exposes the below CRUD operations for creating or modifying Rule, Policy and PolicySet resources.

Method Name Request Type Response Type Description

Create

io.restorecommerce.<resource>.<resourceName>

io.restorecommerce.<resource>.<resourceName>

List of \<resourceName> be created

Read

io.restorecommerce.resourcebase.ReadRequest

io.restorecommerce.<resource>.<resourceName>

List of \<resourceName>

Update

io.restorecommerce.<resource>.<resourceName>

io.restorecommerce.<resource>.<resourceName>

List of \<resourceName> to be updated

Upsert

io.restorecommerce.<resource>.<resourceName>

io.restorecommerce.<resource>.<resourceName>

List of \<resourceName> to be created or updated

Delete

io.restorecommerce.resourcebase.DeleteRequest

google.protobuf.Empty

List of resource IDs to be deleted

For detailed fields of protobuf messages io.restorecommerce.resourcebase.ReadRequest and io.restorecommerce.resourcebase.DeleteRequest refer resource-base-interface.

Events

Emitted

List of events emitted by this microservice for below topics:

Topic Name Event Name Description

io.restorecommerce.command

restoreResponse

system restore response

resetResponse

system reset response

healthCheckResponse

system health check response

versionResponse

system version response

configUpdateResponse

configuration update response

flushCacheCommand

Command event to flush ACS Cache

flushCacheResponse

flush ACS Cache response

setApiKeyResponse

set API Key response

io.restorecommerce.policy_sets.resource

policy_setCreated

emitted when policy_set is created

policy_setModified

emitted when policy_set is modified

policy_setDeleted

emitted when policy_set is deleted

io.restorecommerce.policies.resource

policyCreated

emitted when policy is created

policyModified

emitted when policy is modified

policyDeleted

emitted when policy is deleted

io.restorecommerce.rules.resource

ruleCreated

emitted when rule is created

ruleModified

emitted when rule is modified

ruleDeleted

emitted when rule is deleted

io.restorecommerce.user

hierarchicalScopesRequest

emitted when HierarchicalScope does not exist in subject context

Consumed

This microservice consumes messages for the following events by topic:

Topic Name Event Name Description

io.restorecommerce.command

restoreCommand

used for system restore

resetCommand

used for system reset

healthCheckCommand

to get system health check

versionCommand

to get system version

flushCacheCommand

flushes ACS Cache

configUpdateCommand

used to update configurations

setApiKeyCommand

used to set API key

io.restorecommerce.user

hierarchicalScopesResponse

emitted when HierarchicalScope response is received