Авторизация для бедных или как сделать RBAC для REST API с помощью OPA

load_module modules/ngx_http_js_module.so;

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/conf.d/*.conf;
}

## jwt
js_import /etc/nginx/conf.d/jwt.js;

js_set $generateJwt jwt.generateJwt;

server {
    listen 8081;

    ### jwt view roles
    location /jwt/roles {
        return 200 $jwt_payload_roles;
    }

    ### create jwt token
    location /jwt/create {
        return 200 $generateJwt;
    }
}

function generate_hs256_jwt(claims, key, valid) {
    var header = { typ: "JWT",  alg: "HS256" };
    var claims = Object.assign(claims, {exp: Math.floor(Date.now()/1000) + valid});

    var s = [header, claims].map(JSON.stringify)
                            .map(v=>v.toString('base64url'))
                            .join('.');

    var h = require('crypto').createHmac('sha256', key);

    return s + '.' + h.update(s).digest('base64url');
}

function generateJwt(r) {
    var uri = ""
    if (r.uri != "/jwt/create") {
        uri = r.uri.replace('/jwt/create/','');
    }
    
    var token = jwt([uri]);

    return token;
}

function jwt(roles) {
    var claims = {
        iss: "nginx",
        sub: "alice",
        foo: 123,
        bar: "qq",
        zyx: false,
        realm_access: {
            roles: roles
        }
    };

    return generate_hs256_jwt(claims, 'foo', 600);
}

export default {generateJwt};

function getReponse(r) {
    r.return(200, "Success!");
}

export default {getReponse};

package httpapi.rbac

import input as req

import data.roles

default allow = false

allow {
  # check role
  role := req.user[_]
  user_roles = roles[role]

  # check route
  user_roles[k]
  glob.match(k, [], req.path)

  # check method
  user_roles[k][_] = req.method
}

js_import /etc/nginx/conf.d/rbac.js;
js_import /etc/nginx/conf.d/api.js;

js_set $jwt_payload_roles rbac.jwt_payload_roles;

server {
    listen 8080;

    # proxy to jwt api
    location /jwt {
        proxy_pass http://127.0.0.1:8081/jwt;
    }

    # sample api
    location /security {
        auth_request /_authz;
        js_content api.getReponse;
    }

    ### authorization
    location = /_authz {
        internal;
        js_content rbac.authz;
    }

    location = /_opa {
        internal;
        proxy_pass http://opa:8181/v1/data/httpapi/rbac;
    }
}

function authz(req, res) {
  // get roles
  var roles = jwt_payload_roles(req)
  if(roles == null) {
    req.return(401);
    return;
  }

  var opa_data = {
    "input": {
      "user": roles,
      "path": req.variables.request_uri,
      "method": req.variables.request_method
    }
  };

  var opts = {
    method: "POST",
    body: JSON.stringify(opa_data)
  };

  req.subrequest("/_opa", opts, function(opa) {
    req.error("OPA response: " + opa.responseBody);

    var body = JSON.parse(opa.responseBody);
    if (!body.result)  {
      req.return(403);
      return;
    }

    if (!body.result.allow) {
      req.return(403);
      return;
    } else {
      req.return(200);
    }
  });
}

function jwt(data) {
  var parts = data.split('.').slice(0,2)
      .map(v=>Buffer.from(v, 'base64url').toString())
      .map(JSON.parse);
  return { headers:parts[0], payload: parts[1] };
}

function jwt_payload_roles(r) {
  if (r.headersIn.Authorization == null) {
    return
  }

  return jwt(r.headersIn.Authorization.slice(7)).payload.realm_access.roles;
  // when the token is provided as the "myjwt" argument
  // return jwt(r.args.myjwt).payload.sub;
}

export default {authz, jwt_payload_roles};

{"info":{"_postman_id":"bf317dda-05db-4c0e-bbae-8b745aa65981","name":"Nginx And Opa Authorization","schema":"https://schema.getpostman.com/json/collection/v2.0.0/collection.json"},"item":[{"name":"JWT","item":[{"name":"View roles in JWT","id":"d28de3b0-f439-454e-9e3c-4e1ccfc7e71d","request":{"auth":{"type":"bearer","bearer":{"token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJuZ2lueCIsInN1YiI6ImFsaWNlIiwiZm9vIjoxMjMsImJhciI6InFxIiwienl4IjpmYWxzZSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbInZpZXdlciIsInRlc3QiXX0sImV4cCI6MTYzNzMxOTUxNX0.mZu9cbUccknBduyFXa10URmdm1RmgoGCbiPT654RBMI"}},"method":"GET","header":[],"url":"http://localhost:8080/jwt/roles"},"response":[]},{"name":"Create JWT without roles","id":"31654055-bf71-49b9-9caa-4fd0a1015a10","request":{"method":"GET","header":[],"url":"http://localhost:8080/jwt/create"},"response":[]},{"name":"Create JWT Viewer","id":"25276dc6-a618-4695-8d9f-32f701037b56","request":{"method":"GET","header":[],"url":"http://localhost:8080/jwt/create/viewer"},"response":[]},{"name":"Create JWT Editor","id":"9a6fdfbc-f4d0-4f3d-8628-50135bcca9b4","request":{"method":"GET","header":[],"url":"http://localhost:8080/jwt/create/editor"},"response":[]},{"name":"Create JWT Admin","id":"c8c1934d-fb23-414e-bb89-c6adc1f2dcc1","request":{"method":"GET","header":[],"url":"http://localhost:8080/jwt/create/admin"},"response":[]}],"id":"c7c6e2b1-e62a-4819-8697-0a64224be510"},{"name":"API","item":[{"name":"security","id":"ade4a701-c101-43d9-bc86-895063df7d8a","request":{"auth":{"type":"bearer","bearer":{"token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJuZ2lueCIsInN1YiI6ImFsaWNlIiwiZm9vIjoxMjMsImJhciI6InFxIiwienl4IjpmYWxzZSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImFkbWluIl19LCJleHAiOjE2MzczMTk3NzV9.eVfk0rMf1XprEsuOlCwdKIcPxKRYigUIs5wAu1aEpC8"}},"method":"GET","header":[],"url":"http://localhost:8080/security/someid"},"response":[]},{"name":"security","id":"89462dd5-ae88-48cc-9f39-cccc51f95bcc","request":{"auth":{"type":"bearer","bearer":{"token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJuZ2lueCIsInN1YiI6ImFsaWNlIiwiZm9vIjoxMjMsImJhciI6InFxIiwienl4IjpmYWxzZSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImFkbWluIl19LCJleHAiOjE2MzczMTk3NzV9.eVfk0rMf1XprEsuOlCwdKIcPxKRYigUIs5wAu1aEpC8"}},"method":"POST","header":[],"url":"http://localhost:8080/security/someid"},"response":[]},{"name":"security","id":"df04e356-ac6c-405f-ba98-57052545575d","request":{"auth":{"type":"bearer","bearer":{"token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJuZ2lueCIsInN1YiI6ImFsaWNlIiwiZm9vIjoxMjMsImJhciI6InFxIiwienl4IjpmYWxzZSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImFkbWluIl19LCJleHAiOjE2MzczMTk3NzV9.eVfk0rMf1XprEsuOlCwdKIcPxKRYigUIs5wAu1aEpC8"}},"method":"PUT","header":[],"url":"http://localhost:8080/security/someid"},"response":[]},{"name":"security","id":"3f0dbb2a-d31a-4380-ae71-d890904dfdb3","request":{"auth":{"type":"bearer","bearer":{"token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJuZ2lueCIsInN1YiI6ImFsaWNlIiwiZm9vIjoxMjMsImJhciI6InFxIiwienl4IjpmYWxzZSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbImFkbWluIl19LCJleHAiOjE2MzczMTk3NzV9.eVfk0rMf1XprEsuOlCwdKIcPxKRYigUIs5wAu1aEpC8"}

У нас два типа ресурсов: запрашиваемый и возвращаемый

Объект, который запрашивается в момент запроса, можно выделить и отправить в запрос авторизации. В правилах соответственно учитывать еще и параметры объекта.

Для возвращаемого ресурса ответ симметричен, только сформировать запрос доступа придется после обработки запроса приложением.

Выделив из тела запроса функцию Graphql получится более точно определить права доступа.