Show HN: RBAC for your REST API in 2 minutes(aserto.com)
aserto.com
Show HN: RBAC for your REST API in 2 minutes
https://www.aserto.com/playground
12 comments
Dupe: https://news.ycombinator.com/item?id=30361262 (13 days ago)
Authorization is a must-have for every application, but most teams have to build it from scratch. The Open Policy Agent [0] is a good place to start for creating an OSS-based solution, but you still need to build a lot of stuff yourself.
The Aserto playground [1] lets you import your REST service’s openapi.json spec and automatically generates a permissions for each operation. You can assign these permissions to one or more roles (viewer, editor, admin, or create your own). Export the project to get your OPA policy for your REST service.
You can also try it out with the Petstore API [2]. Click the “Start Tour” button for a guided tour.
Would love feedback on how to make this better!
[0] https://openpolicyagent.org
[1] https://aserto.com/playground
[2] https://petstore3.swagger.io/api/v3/openapi.json
The Aserto playground [1] lets you import your REST service’s openapi.json spec and automatically generates a permissions for each operation. You can assign these permissions to one or more roles (viewer, editor, admin, or create your own). Export the project to get your OPA policy for your REST service.
You can also try it out with the Petstore API [2]. Click the “Start Tour” button for a guided tour.
Would love feedback on how to make this better!
[0] https://openpolicyagent.org
[1] https://aserto.com/playground
[2] https://petstore3.swagger.io/api/v3/openapi.json
Do package names have to match API routes? Can I create a policy that is shared by multiple endpoints?
Technically names do not have to match, but it certainly makes it easier if you have a pattern to rely on when injecting authorization into a middleware layer.
By convention, we generate a package for every API definition in the OpenAPI spec. But the calling application can decide which package to use when authorizing an operation, so you can use a single policy for multiple endpoints.
So this is basically a tool for generating and testing Rego policies from an OpenAPI spec. Very cool!
Endpoint wise you can have N.
Does your k8s sidecar approach work with https://dapr.io sidecars?
What can I do with policies I create in this playground?
You can use the OPA CLI [0] or the policy CLI [1] to build and run the policies.
[0] https://www.openpolicyagent.org/docs/edge/cli/#opa-build
[1] https://github.com/opcr-io/policy
[0] https://www.openpolicyagent.org/docs/edge/cli/#opa-build
[1] https://github.com/opcr-io/policy