Skip to content
This repository has been archived by the owner on Jul 12, 2023. It is now read-only.

Introduce RBAC #1335

Merged
merged 11 commits into from
Dec 14, 2020
Merged

Introduce RBAC #1335

merged 11 commits into from
Dec 14, 2020

Commits on Dec 13, 2020

  1. Introduce RBAC 

    This introduces Role-Based Access Controls (RBAC) into the system. Common operations in the system are split into Read (view-only) and Write (create, update, delete). Users have 0 or more permissions on a realm through Memberships. Memberships replace the existing `user_realms` table (and obviates the `admin_realms` table). Since realm roles are no longer binary (previously user or admin), many of our existing UI elements no longer made sense. For example, we frequently displayed a "Realm Admin" pill in lists, but those have been removed since permissions are now multi-dimensional. There are two meta-permissions - LegacyRealmUser and LegacyRealmAdmin - which closely correspond to the existing primitive roles. The RBAC system also improves the event log, since individual permissions are now diffed.

The RBAC system has security properties that prevent privilege escalation. The system forbids creating users with permissions greater than your own, and it forbids changing your own permissions entirely. The only exception is system administrators, who are granted full realm permissions when joining a realm and have all permissions revoked when leaving a realm (via the system admin console). The UI and templates can conditionally assert a membership's priviledges and updates accordingly.

One of the biggest changes is conceptual - "Membership" is a first-class entity that must be handled and inspected in the system. The "current membership" defines the currently logged-in user and currently selected realm (if one exists). Additionally, RBAC assertion is now at the controller-level instead of the routing layer. I don't love it, but injecting it into the routing layer proved quite challenging and brittle.

Finally, the system was designed to support more than just "users". If we ever wanted more granular permissions on, say API keys, we could easily add that.

Other miscellaneous changes include:

- Removing some totally dead code
- Changing the response code on controller.NotFound to be 404 instead of 401
- Rendering a real 401 page instead of always forcing a sign-out
- Better redirects after editing some resources

List of future enhancements (I'll file issues after we reach consensus on this PR):

- Display human descriptions of each permission in the UI
    @sethvargo
    sethvargo committed Dec 13, 2020
    Configuration menu
    Copy the full SHA
    6f46ede View commit details
    Browse the repository at this point in the history

  2. Fix migration logic

    @sethvargo
    sethvargo committed Dec 13, 2020
    Configuration menu
    Copy the full SHA
    3bfaac1 View commit details
    Browse the repository at this point in the history

  3. Make it clearer that admin includes user

    @sethvargo
    sethvargo committed Dec 13, 2020
    Configuration menu
    Copy the full SHA
    45b5d3b View commit details
    Browse the repository at this point in the history

  4. Simplify CanWrite

    @sethvargo
    sethvargo committed Dec 13, 2020
    Configuration menu
    Copy the full SHA
    1beca94 View commit details
    Browse the repository at this point in the history

  5. Return HTMLAttr instead of HTML for attributes

    @sethvargo
    sethvargo committed Dec 13, 2020
    Configuration menu
    Copy the full SHA
    ca29b85 View commit details
    Browse the repository at this point in the history

  6. Do not include Legacy permissions in map

    @sethvargo
    sethvargo committed Dec 13, 2020
    Configuration menu
    Copy the full SHA
    c254675 View commit details
    Browse the repository at this point in the history

  7. Add test for removing permissions

    @sethvargo
    sethvargo committed Dec 13, 2020
    Configuration menu
    Copy the full SHA
    1800006 View commit details
    Browse the repository at this point in the history

  8. Add test for adding permissions back

    @sethvargo
    sethvargo committed Dec 13, 2020
    Configuration menu
    Copy the full SHA
    54a75ee View commit details
    Browse the repository at this point in the history

  9. Check correct permission

    @sethvargo
    sethvargo committed Dec 13, 2020
    Configuration menu
    Copy the full SHA
    3ddb082 View commit details
    Browse the repository at this point in the history

  10. Satisfy sql.Value

    @sethvargo
    sethvargo committed Dec 13, 2020
    Configuration menu
    Copy the full SHA
    181cac0 View commit details
    Browse the repository at this point in the history

  11. Fix realms_test

    @sethvargo
    sethvargo committed Dec 13, 2020
    Configuration menu
    Copy the full SHA
    f7db0fe View commit details
    Browse the repository at this point in the history