Examples with Principal io.envoyproxy.envoy.config.rbac.v3.Principal used on opensource projects

Example 1 with Principal

use of io.envoyproxy.envoy.config.rbac.v3.Principal in project grpc-java by grpc.

the class RbacFilterTest method compositeRules.

@Test
@SuppressWarnings("unchecked")
public void compositeRules() {
    MetadataMatcher metadataMatcher = MetadataMatcher.newBuilder().build();
    List<Permission> permissionList = Arrays.asList(Permission.newBuilder().setOrRules(Permission.Set.newBuilder().addRules(Permission.newBuilder().setMetadata(metadataMatcher).build()).build()).build());
    List<Principal> principalList = Arrays.asList(Principal.newBuilder().setNotId(Principal.newBuilder().setMetadata(metadataMatcher).build()).build());
    ConfigOrError<? extends FilterConfig> result = parse(permissionList, principalList);
    assertThat(result.errorDetail).isNull();
    assertThat(result.config).isInstanceOf(RbacConfig.class);
    ServerCall<Void, Void> serverCall = mock(ServerCall.class);
    GrpcAuthorizationEngine engine = new GrpcAuthorizationEngine(((RbacConfig) result.config).authConfig());
    AuthDecision decision = engine.evaluate(new Metadata(), serverCall);
    assertThat(decision.decision()).isEqualTo(GrpcAuthorizationEngine.Action.ALLOW);
}

Example 2 with Principal

use of io.envoyproxy.envoy.config.rbac.v3.Principal in project grpc-java by grpc.

the class RbacFilterTest method portRangeParser.

@Test
@SuppressWarnings({ "unchecked", "deprecation" })
public void portRangeParser() {
    List<Permission> permissionList = Arrays.asList(Permission.newBuilder().setDestinationPortRange(Int32Range.newBuilder().setStart(1010).setEnd(65535).build()).build());
    List<Principal> principalList = Arrays.asList(Principal.newBuilder().setRemoteIp(CidrRange.newBuilder().setAddressPrefix("10.10.10.0").setPrefixLen(UInt32Value.of(24)).build()).build());
    ConfigOrError<?> result = parse(permissionList, principalList);
    assertThat(result.errorDetail).isNull();
    ServerCall<Void, Void> serverCall = mock(ServerCall.class);
    Attributes attributes = Attributes.newBuilder().set(Grpc.TRANSPORT_ATTR_REMOTE_ADDR, new InetSocketAddress("10.10.10.0", 1)).set(Grpc.TRANSPORT_ATTR_LOCAL_ADDR, new InetSocketAddress("10.10.10.0", 9090)).build();
    when(serverCall.getAttributes()).thenReturn(attributes);
    when(serverCall.getMethodDescriptor()).thenReturn(method().build());
    GrpcAuthorizationEngine engine = new GrpcAuthorizationEngine(((RbacConfig) result.config).authConfig());
    AuthDecision decision = engine.evaluate(new Metadata(), serverCall);
    assertThat(decision.decision()).isEqualTo(GrpcAuthorizationEngine.Action.DENY);
}

Example 3 with Principal

use of io.envoyproxy.envoy.config.rbac.v3.Principal in project grpc-java by grpc.

the class RbacFilterTest method authenticatedParser.

@Test
@SuppressWarnings("unchecked")
public void authenticatedParser() throws Exception {
    List<Permission> permissionList = Arrays.asList(Permission.newBuilder().setNotRule(Permission.newBuilder().setRequestedServerName(STRING_MATCHER).build()).build());
    List<Principal> principalList = Arrays.asList(Principal.newBuilder().setAuthenticated(Authenticated.newBuilder().setPrincipalName(STRING_MATCHER).build()).build());
    ConfigOrError<?> result = parse(permissionList, principalList);
    assertThat(result.errorDetail).isNull();
    SSLSession sslSession = mock(SSLSession.class);
    X509Certificate mockCert = mock(X509Certificate.class);
    when(sslSession.getPeerCertificates()).thenReturn(new X509Certificate[] { mockCert });
    when(mockCert.getSubjectAlternativeNames()).thenReturn(Arrays.<List<?>>asList(Arrays.asList(2, "/" + PATH)));
    Attributes attributes = Attributes.newBuilder().set(Grpc.TRANSPORT_ATTR_SSL_SESSION, sslSession).build();
    ServerCall<Void, Void> serverCall = mock(ServerCall.class);
    when(serverCall.getAttributes()).thenReturn(attributes);
    GrpcAuthorizationEngine engine = new GrpcAuthorizationEngine(((RbacConfig) result.config).authConfig());
    AuthDecision decision = engine.evaluate(new Metadata(), serverCall);
    assertThat(decision.decision()).isEqualTo(GrpcAuthorizationEngine.Action.DENY);
}

Example 4 with Principal

use of io.envoyproxy.envoy.config.rbac.v3.Principal in project grpc-java by grpc.

the class AuthorizationPolicyTranslator method parseRules.

private static Map<String, Policy> parseRules(List<Map<String, ?>> objects, String name) throws IllegalArgumentException {
    Map<String, Policy> policies = new LinkedHashMap<String, Policy>();
    for (Map<String, ?> object : objects) {
        String policyName = JsonUtil.getString(object, "name");
        if (policyName == null || policyName.isEmpty()) {
            throw new IllegalArgumentException("rule \"name\" is absent or empty");
        }
        List<Principal> principals = new ArrayList<>();
        Map<String, ?> source = JsonUtil.getObject(object, "source");
        if (source != null) {
            principals.add(parseSource(source));
        } else {
            principals.add(Principal.newBuilder().setAny(true).build());
        }
        List<Permission> permissions = new ArrayList<>();
        Map<String, ?> request = JsonUtil.getObject(object, "request");
        if (request != null) {
            permissions.add(parseRequest(request));
        } else {
            permissions.add(Permission.newBuilder().setAny(true).build());
        }
        Policy policy = Policy.newBuilder().addAllPermissions(permissions).addAllPrincipals(principals).build();
        policies.put(name + "_" + policyName, policy);
    }
    return policies;
}

Example 5 with Principal

use of io.envoyproxy.envoy.config.rbac.v3.Principal in project grpc-java by grpc.

the class RbacFilterTest method handleException.

@Test
public void handleException() {
    PathMatcher pathMatcher = PathMatcher.newBuilder().setPath(StringMatcher.newBuilder().build()).build();
    List<Permission> permissionList = Arrays.asList(Permission.newBuilder().setUrlPath(pathMatcher).build());
    List<Principal> principalList = Arrays.asList(Principal.newBuilder().setUrlPath(pathMatcher).build());
    ConfigOrError<?> result = parse(permissionList, principalList);
    assertThat(result.errorDetail).isNotNull();
    permissionList = Arrays.asList(Permission.newBuilder().build());
    principalList = Arrays.asList(Principal.newBuilder().build());
    result = parse(permissionList, principalList);
    assertThat(result.errorDetail).isNotNull();
    Message rawProto = io.envoyproxy.envoy.extensions.filters.http.rbac.v3.RBAC.newBuilder().setRules(RBAC.newBuilder().setAction(Action.DENY).putPolicies("policy-name", Policy.newBuilder().setCondition(Expr.newBuilder().build()).build()).build()).build();
    result = new RbacFilter().parseFilterConfig(Any.pack(rawProto));
    assertThat(result.errorDetail).isNotNull();
}