-
Notifications
You must be signed in to change notification settings - Fork 9
/
Copy pathapi_auth.yaml
65 lines (59 loc) · 4.05 KB
/
api_auth.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
drivers:
daemon:
services:
api:
auth-providers:
- auth-simple
auth:
casbin:
models:
- |
[request_definition]
r = sub, obj, act, provider
[policy_definition]
p = sub, obj, act, provider
[role_definition]
g = _, _
g2 = _, _
g3 = _, _
[policy_effect]
e = some(where (p.eft == allow))
[matchers]
m = (r.sub == p.sub && r.obj == p.obj && r.act == p.act && r.provider == p.provider) \
|| (g(r.sub, p.sub) && g2(r.obj, p.obj) && r.act == p.act && r.provider == p.provider) \
|| (g(r.sub, p.sub) && r.obj == p.obj && r.act == p.act && r.provider == p.provider) \
|| (r.sub == p.sub && g2(r.obj, p.obj) && r.act == p.act && r.provider == p.provider) \
|| (r.sub == p.sub && r.obj == p.obj && g3(r.act, p.act) && r.provider == p.provider) \
|| (g(r.sub, p.sub) && g2(r.obj, p.obj) && g3(r.act, p.act) && r.provider == p.provider) \
|| (g(r.sub, p.sub) && r.obj == p.obj && g3(r.act, p.act) && r.provider == p.provider) \
|| (r.sub == p.sub && g2(r.obj, p.obj) && g3(r.act, p.act) && r.provider == p.provider) \
|| (r.sub == p.sub && r.obj == p.obj && g3(r.act, 'read') && p.act == 'write' && r.provider == p.provider) \
|| (g(r.sub, p.sub) && g2(r.obj, p.obj) && g3(r.act, 'read') && p.act == 'write' && r.provider == p.provider) \
|| (g(r.sub, p.sub) && r.obj == p.obj && g3(r.act, 'read') && p.act == 'write' && r.provider == p.provider) \
|| (r.sub == p.sub && g2(r.obj, p.obj) && g3(r.act, 'read') && p.act == 'write' && r.provider == p.provider) \
|| (g(r.sub, p.sub) && p.obj == 'everything' && r.act == p.act && r.provider == p.provider) \
|| (r.sub == p.sub && p.obj == 'everything' && r.act == p.act && r.provider == p.provider) \
|| (g(r.sub, p.sub) && p.obj == 'everything' && g3(r.act, p.act) && r.provider == p.provider) \
|| (r.sub == p.sub && p.obj == 'everything' && g3(r.act, p.act) && r.provider == p.provider) \
|| (g(r.sub, p.sub) && p.obj == 'everything' && g3(r.act, 'read') && p.act == 'write' && r.provider == p.provider) \
|| (r.sub == p.sub && p.obj == 'everything' && g3(r.act, 'read') && p.act == 'write' && r.provider == p.provider) \
|| (p.sub == 'everyone' && r.obj == p.obj && r.act == p.act && r.provider == p.provider) \
|| (p.sub == 'everyone' && g2(r.obj, p.obj) && r.act == p.act && r.provider == p.provider) \
|| (p.sub == 'everyone' && r.obj == p.obj && g3(r.act, p.act) && r.provider == p.provider) \
|| (p.sub == 'everyone' && g2(r.obj, p.obj) && g3(r.act, p.act) && r.provider == p.provider) \
|| (p.sub == 'everyone' && r.obj == p.obj && g3(r.act, 'read') && p.act == 'write' && r.provider == p.provider) \
|| (p.sub == 'everyone' && g2(r.obj, p.obj) && g3(r.act, 'read') && p.act == 'write' && r.provider == p.provider) \
|| (p.sub == 'everyone' && p.obj == 'everything' && r.act == p.act && r.provider == p.provider) \
|| (p.sub == 'everyone' && p.obj == 'everything' && g3(r.act, p.act) && r.provider == p.provider) \
|| (p.sub == 'everyone' && p.obj == 'everything' && g3(r.act, 'read') && p.act == 'write' && r.provider == p.provider) \
|| (r.sub == 'admin')
policies:
- |
# define action groups
g3, GET, read
g3, POST, write
g3, PUT, write
# define basic policy effects
p, viewer, everything, read, auth-simple
p, editor, everything, write, auth-simple
p, everyone, everything, write, auth-gcp-iap