Integration with Authzed

[guicassolato]

Adds built-in integration with Authzed.

Authorino will send check permission requests to Authzed/SpiceDB via GRPC.
Subject, resource and permission parameters can be set to static values or read from the Authorization JSON.

Closes #372.

Verification steps

Setup locally:

make local-setup
kubectl port-forward service/envoy 8000:8000 2>&1 >/dev/null &

Deploy a SpiceDB instance:

kubectl apply -f -<<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: spicedb
  labels:
    app: spicedb
spec:
  selector:
    matchLabels:
      app: spicedb
  template:
    metadata:
      labels:
        app: spicedb
    spec:
      containers:
      - name: spicedb
        image: authzed/spicedb
        args:
        - serve
        - "--grpc-preshared-key"
        - secret
        - "--http-enabled"
        ports:
        - containerPort: 50051
        - containerPort: 8443
  replicas: 1
---
apiVersion: v1
kind: Service
metadata:
  name: spicedb
spec:
  selector:
    app: spicedb
  ports:
    - name: grpc
      port: 50051
      protocol: TCP
    - name: http
      port: 8443
      protocol: TCP
EOF

kubectl port-forward service/spicedb 8443:8443 2>&1 >/dev/null &

Create the permission schema:

curl -X POST http://localhost:8443/v1/schema/write \
  -H 'Authorization: Bearer secret' \
  -H 'Content-Type: application/json' \
  -d @- << EOF
{
  "schema": "definition blog/user {}\ndefinition blog/post {\n\trelation reader: blog/user\n\trelation writer: blog/user\n\n\tpermission read = reader + writer\n\tpermission write = writer\n}"
}
EOF

Store relationships:

curl -X POST http://localhost:8443/v1/relationships/write \
  -H 'Authorization: Bearer secret' \
  -H 'Content-Type: application/json' \
  -d @- << EOF
{
  "updates": [
    {
      "operation": "OPERATION_CREATE",
      "relationship": {
        "resource": {
          "objectType": "blog/post",
          "objectId": "1"
        },
        "relation": "writer",
        "subject": {
          "object": {
            "objectType": "blog/user",
            "objectId": "emilia"
          }
        }
      }
    },
    {
      "operation": "OPERATION_CREATE",
      "relationship": {
        "resource": {
          "objectType": "blog/post",
          "objectId": "1"
        },
        "relation": "reader",
        "subject": {
          "object": {
            "objectType": "blog/user",
            "objectId": "beatrice"
          }
        }
      }
    }
  ]
}
EOF

Create the AuthConfig and Secrets:

kubectl apply -f -<<EOF
apiVersion: authorino.kuadrant.io/v1beta1
kind: AuthConfig
metadata:
  name: talker-api-protection
spec:
  hosts:
  - talker-api-authorino.127.0.0.1.nip.io
  identity:
  - name: friends
    apiKey:
      selector:
        matchLabels:
          app: talker-api
    credentials:
      in: authorization_header
      keySelector: APIKEY
  authorization:
  - name: authzed
    authzed:
      endpoint: spicedb:50051
      insecure: true
      sharedSecretRef:
        name: spicedb
        key: grpc-preshared-key
      subject:
        kind:
          value: blog/user
        name:
          valueFrom:
            authJSON: auth.identity.metadata.annotations.username
      resource:
        kind:
          value: blog/post
        name:
          valueFrom:
            authJSON: context.request.http.path.@extract:{"sep":"/","pos":2}
      permission:
        valueFrom:
          authJSON: context.request.http.method.@replace:{"old":"GET","new":"read"}.@replace:{"old":"POST","new":"write"}
---
apiVersion: v1
kind: Secret
metadata:
  name: spicedb
  labels:
    app: spicedb
stringData:
  grpc-preshared-key: secret
---
apiVersion: v1
kind: Secret
metadata:
  name: api-key-writer
  labels:
    authorino.kuadrant.io/managed-by: authorino
    app: talker-api
  annotations:
    username: emilia
stringData:
  api_key: IAMEMILIA
---
apiVersion: v1
kind: Secret
metadata:
  name: api-key-reader
  labels:
    authorino.kuadrant.io/managed-by: authorino
    app: talker-api
  annotations:
    username: beatrice
stringData:
  api_key: IAMBEATRICE
EOF

Send requests:

curl -H 'Authorization: APIKEY IAMEMILIA' -X GET  http://talker-api-authorino.127.0.0.1.nip.io:8000/posts/1 -i
# HTTP/1.1 200 OK

curl -H 'Authorization: APIKEY IAMEMILIA' -X POST http://talker-api-authorino.127.0.0.1.nip.io:8000/posts/1 -i
# HTTP/1.1 200 OK

curl -H 'Authorization: APIKEY IAMBEATRICE' -X GET  http://talker-api-authorino.127.0.0.1.nip.io:8000/posts/1 -i
# HTTP/1.1 200 OK

curl -H 'Authorization: APIKEY IAMBEATRICE' -X POST http://talker-api-authorino.127.0.0.1.nip.io:8000/posts/1 -i
# HTTP/1.1 403 Forbidden
# x-ext-auth-reason: PERMISSIONSHIP_NO_PERMISSION | token: GhUKEzE2NzU3MDE3MjAwMDAwMDAwMDA=

[eguzki]

verification steps working 👍