security

package
v1.1.1-0...-d146046 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Nov 3, 2023 License: Apache-2.0 Imports: 17 Imported by: 0

Documentation

Index

Constants

View Source
const (
	RoleUserManager       = "userManager"
	RoleCollectionManager = "collectionManager"
	RoleBackupDownloader  = "backupDownloader"
	RoleBackupUploader    = "backupUploader"

	// RoleUploadsAnytime allows uploading versions regardless of Backup Windows
	RoleUploadsAnytime = "uploadsAnytime"
	RoleSysAdmin       = "systemAdmin"
)
View Source
const (
	ActionDownload      = "file.download"
	ActionUpload        = "file.upload"
	ActionUploadAnytime = "file.upload-anytime"
	ActionViewProfile   = "profile.view"
)
View Source
const (
	IdentityKeyClaimIndex = "login"
	AccessKeyClaimIndex   = "accessKeyName"
	ScopeClaimIndex       = "operationsScope"
)
View Source
const KindGrantedAccess = "grantedaccesses"

Variables

Functions

func CanThoseRolesPerformAction

func CanThoseRolesPerformAction(roles []string, action string) bool

CanThoseRolesPerformAction checks if any listed role is allowing to perform action

func CompareFastCryptoHash

func CompareFastCryptoHash(plain string, hash string) bool

func ComparePassword

func ComparePassword(password string, hash string) (bool, error)

ComparePassword is used to compare a user-inputted password to a hash to see if the password matches or not.

func CreateHashFromPassword

func CreateHashFromPassword(password string) (string, error)

CreateHashFromPassword is used to generate a new password hash for storing and comparing at a later date.

func DecideCanDo

func DecideCanDo(dr *DecisionRequest) bool

DecideCanDo is taking a decision if specific Action can be made on by Actor on a Subject

Logic:

  1. Subject defines who can access it and how

  2. There are SYSTEM-WIDE roles defined on the user that allows globally do everything

  3. User can generate a LIMITED SCOPE JWT token with /auth/login endpoint. This kind of token can define that in context of given Subject the roles should be limited to specific ones Important! Those roles cannot be higher than defined on the Subject or on the Actor in its profile

Cases:

Has limited token: User generates JWT with "backupDownloader" role in context of "iwa-ait" collection.
                   So even if that User is a "collectionManager" for this collection, with that specific JWT token
                   its possible to only download backups.

func ExtractLoginFromJWT

func ExtractLoginFromJWT(jwt string) (string, string)

ExtractLoginFromJWT returns username of a user that owns this token

func FillPasswordFromKindSecret

func FillPasswordFromKindSecret(r config.ConfigurationProvider, ref *PasswordFromSecretRef, setterCallback func(secret string)) error

FillPasswordFromKindSecret is able to fill up object from a data retrieved from `kind: Secret` in Kubernetes

func GetRolesActions

func GetRolesActions() map[string][]string

func GetRolesInheritance

func GetRolesInheritance() map[string][]string

func HashJWT

func HashJWT(jwt string) string

func HashSha256

func HashSha256(input string) string

func InitializeModel

func InitializeModel(db *gorm.DB) error

Types

type AccessControlList

type AccessControlList []AccessControlObject

func (AccessControlList) IsPermitted

func (acl AccessControlList) IsPermitted(name string, objType string, action string) bool

IsPermitted checks if given user is granted a role in this list

type AccessControlObject

type AccessControlObject struct {
	Name  string `json:"name"`
	Type  string `json:"type"`
	Roles Roles  `json:"roles"`
}

type Actor

type Actor interface {
	IsInAccessKeyContext() bool
	GetAccessKeyRolesInContextOf(Subject) Roles
	GetRoles() Roles
	GetEmail() string
	GetName() string
	GetTypeName() string
	GetSessionLimitedOperationsScope() *SessionLimitedOperationsScope
}

type Argon2Config

type Argon2Config struct {
	// contains filtered or unexported fields
}

func CreateDefaultPasswordConfig

func CreateDefaultPasswordConfig() *Argon2Config

type DecisionRequest

type DecisionRequest struct {
	Actor   Actor
	Subject Subject
	Action  string
}

type GrantedAccess

type GrantedAccess struct {
	CreatedAt time.Time
	UpdatedAt time.Time
	DeletedAt gorm.DeletedAt `gorm:"index"`

	ID            string    `json:"id"            structs:"id" sql:"type:string;primary_key;default:uuid_generate_v4()"`
	ExpiresAt     time.Time `json:"expiresAt"     structs:"expiresAt"`
	Deactivated   bool      `json:"deactivated"   structs:"deactivated"`
	Description   string    `json:"description"   structs:"description"`
	RequesterIP   string    `json:"requesterIP"   structs:"requesterIP"`
	User          string    `json:"user"          structs:"user"`
	AccessKeyName string    `json:"accessKeyName" structs:"accessKeyName"`
}

GrantedAccess stores information about generated JWT tokens (successful logins to the system)

func NewGrantedAccess

func NewGrantedAccess(jwt string, expiresAt time.Time, deactivated bool, description string, requesterIP string, username string, accessKeyName string) GrantedAccess

func (GrantedAccess) IsNotExpired

func (ga GrantedAccess) IsNotExpired() bool

func (GrantedAccess) IsValid

func (ga GrantedAccess) IsValid() bool

type GrantedAccessRepository

type GrantedAccessRepository struct {
	// contains filtered or unexported fields
}

type PasswordFromSecretRef

type PasswordFromSecretRef struct {
	Name  string `json:"name"`
	Entry string `json:"entry"`
}

PasswordFromSecretRef references passwords stored in ConfigMaps

Name is the ConfigMap name
Entry is the key name in .data

type Roles

type Roles []string

func (Roles) HasRole

func (p Roles) HasRole(name string) bool

func (Roles) IsEmpty

func (p Roles) IsEmpty() bool

type ScopedElement

type ScopedElement struct {
	Type  string   `form:"type" json:"type" binding:"required"`
	Name  string   `form:"name" json:"name" binding:"required"`
	Roles []string `form:"roles" json:"roles" binding:"required"`
}

type Service

type Service struct {
	// contains filtered or unexported fields
}

func NewService

func NewService(db *gorm.DB) Service

func (Service) GetAllGrantedAccessesForUserByUsername

func (s Service) GetAllGrantedAccessesForUserByUsername(name string) []GrantedAccess

func (Service) GetGrantedAccessInformation

func (s Service) GetGrantedAccessInformation(jwt string) (GrantedAccess, error)

func (Service) GetGrantedAccessInformationBySessionId

func (s Service) GetGrantedAccessInformationBySessionId(sessionId string) (GrantedAccess, error)

func (Service) IsTokenStillValid

func (s Service) IsTokenStillValid(jwt string) bool

func (Service) RevokeSessionByJWT

func (s Service) RevokeSessionByJWT(jwt string) error

func (Service) RevokeSessionBySessionId

func (s Service) RevokeSessionBySessionId(sessionId string) error

func (Service) StoreJWTAsGrantedAccess

func (s Service) StoreJWTAsGrantedAccess(token string, expire time.Time, ip string, description string, username string, accessKeyName string) string

type SessionLimitedOperationsScope

type SessionLimitedOperationsScope struct {
	Elements []ScopedElement `form:"elements" json:"elements"`
}

SessionLimitedOperationsScope allows to define additional limitations on the user's JWT token, so even if user has higher permissions we can limit those permissions per JWT token

func ExtractScopeFromString

func ExtractScopeFromString(asJson string) (*SessionLimitedOperationsScope, error)

func ExtractSessionLimitedOperationsScopeFromJWT

func ExtractSessionLimitedOperationsScopeFromJWT(jwt string) (*SessionLimitedOperationsScope, error)

type Subject

type Subject interface {
	GetId() string
	GetTypeName() string
	GetAccessControlList() *AccessControlList
}

type UserIdentity

type UserIdentity struct {
	Username      string
	AccessKeyName string
}

func NewUserIdentityFromString

func NewUserIdentityFromString(login string) UserIdentity

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL