Skip to content

Commit

Permalink
chore: document flipt is_auth_method helper for authz
Browse files Browse the repository at this point in the history
Signed-off-by: Mark Phelps <209477+markphelps@users.noreply.github.com>
  • Loading branch information
markphelps committed Aug 31, 2024
1 parent 0efbace commit 6930ad7
Showing 1 changed file with 26 additions and 1 deletion.
27 changes: 26 additions & 1 deletion authorization/overview.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -97,8 +97,33 @@ The following fields are available in the `input.authentication` field:
- `io.flipt.auth.email`: The user's email address.
- `io.flipt.auth.name`: The user's name.
- `io.flipt.auth.claims`: A map of **all** claims provided by the authentication method. This can include the user's roles, groups, etc. These claims are marshaled into a JSON string before being passed to OPA for evaluation.
- `method`: The authentication method used to authenticate the request.

#### Mapping Identity
### Helper Functions

Check warning on line 102 in authorization/overview.mdx

View workflow job for this annotation

GitHub Actions / Vale

[vale] reported by reviewdog 🐶 [Openly.Titles] 'Helper Functions' should be in sentence case Raw Output: {"message": "[Openly.Titles] 'Helper Functions' should be in sentence case", "location": {"path": "authorization/overview.mdx", "range": {"start": {"line": 102, "column": 5}}}, "severity": "WARNING"}

To make it easier to write policies, Flipt provides a set of helper functions that are available to be used for the `input` field.

`flipt.is_auth_method(input, method)`

The helper function `flipt.is_auth_method(input, method)` can be used to check if the request was authenticated using the specified method.

The `method` parameter is the authentication method name as it is registered in Flipt, e.g. `oidc`, `token`, `kubernetes`, `github`, `jwt`.

Check warning on line 110 in authorization/overview.mdx

View workflow job for this annotation

GitHub Actions / Vale

[vale] reported by reviewdog 🐶 [Microsoft.Contractions] Use 'it's' instead of 'it is'. Raw Output: {"message": "[Microsoft.Contractions] Use 'it's' instead of 'it is'.", "location": {"path": "authorization/overview.mdx", "range": {"start": {"line": 110, "column": 61}}}, "severity": "WARNING"}

Check warning on line 110 in authorization/overview.mdx

View workflow job for this annotation

GitHub Actions / Vale

[vale] reported by reviewdog 🐶 [Microsoft.Foreign] Use 'for example' instead of 'e.g.'. Raw Output: {"message": "[Microsoft.Foreign] Use 'for example' instead of 'e.g.'.", "location": {"path": "authorization/overview.mdx", "range": {"start": {"line": 110, "column": 88}}}, "severity": "WARNING"}

Check warning on line 110 in authorization/overview.mdx

View workflow job for this annotation

GitHub Actions / Vale

[vale] reported by reviewdog 🐶 [Openly.Punctuation] Use 'eg' instead of 'e.g.' Raw Output: {"message": "[Openly.Punctuation] Use 'eg' instead of 'e.g.'", "location": {"path": "authorization/overview.mdx", "range": {"start": {"line": 110, "column": 88}}}, "severity": "WARNING"}

Example:

```rego policy.rego
package flipt.authz.v1

import rego.v1

default allow := false

allow if {
flipt.is_auth_method(input, "jwt")
}

Check failure on line 123 in authorization/overview.mdx

View workflow job for this annotation

GitHub Actions / lint

Delete `·`
```

### Mapping Identity

Check warning on line 126 in authorization/overview.mdx

View workflow job for this annotation

GitHub Actions / Vale

[vale] reported by reviewdog 🐶 [Openly.Titles] 'Mapping Identity' should be in sentence case Raw Output: {"message": "[Openly.Titles] 'Mapping Identity' should be in sentence case", "location": {"path": "authorization/overview.mdx", "range": {"start": {"line": 126, "column": 5}}}, "severity": "WARNING"}

Each authentication method configurable within Flipt will provide different information depending on the identity. It's up to you to combine identity information (`authentication`) with the requested resource (`request`) to make an authorization decision whether or not the request should be allowed (`allow`).

Expand Down

0 comments on commit 6930ad7

Please sign in to comment.