Issue in authScope for Encryption functions

[Vivekmauli14]

Hi there,

Thankyou so much for this amazing module, I have been using it since a while for a project, and I am stuck in adding attributes for multiple users for particular encrypted file, Like if I'm encrypting a file from one user and trying to decrypt it from another, it wont allow that, how do I get over this ? How do I add the authorization scope for users?

There is authScope defined in the Encryption function but not taken in the argument of the function, How do I take the authscope here ?
Do I need to make changes in the module and install it locally? or is there any way I can put the authscope for the Encryption function?

Looking forward to hear from you.

Thanks in advance!

[b-long]

Hi @Vivekmauli14 , thanks for the kind words 🙁 This is a nights-and-weekends project for me, so forgive me for the slow reply.

Can you provide any insight about how you're running OpenTDF? Can you show a script that starts the platform the way that you are using it?

Regarding the authScopes, you'll see that I'm hard-coding it in some areas

• Once used internally by the EncryptFilePE function :

  opentdf-python-sdk/main.go

  Line 410 in 9251e7b

  authScopes := []string{"email"}

• And once used by the DecryptFilePE function :

  opentdf-python-sdk/main.go

  Line 538 in 9251e7b

  authScopes := []string{"email"}

I've written up some example code in new issues. Does the code you find here help you?

• Improve docs about passing DataAttributes #9
• Improve docs about calling PE (Person Entity) encryption & decryption functions #10

About this question:

Do I need to make changes in the module and install it locally? or is there any way I can put the authscope for the Encryption function?

You can absolutely make changes, and I would welcome any PR you might want to submit 🙂

I've updated the README, which might help. Also, it is displaying correctly on PyPI now ( https://pypi.org/project/otdf-python/ ).

I made a section in the README about making updates to the code. It is a unique setup, but I'm sure that you can figure it out! 🧠

If you make some updates to main.go, and it is on a function that starts with an upper-case letter, that functionality is available to us in Python.

So, you probably noticed, that you can call EncryptString("Hello, world", encryptionConfig)

opentdf-python-sdk/main.go

Lines 160 to 210 in 9251e7b

	func EncryptString(inputText string, config EncryptionConfig) (string, error) {
	strReader := strings.NewReader(inputText)
	// Scopes is related to OIDC, it's about what you're requesting
	// and access control from the IdP
	authScopes := []string{"email"}
	// var authScopes []string
	sdkClient, err := newSdkClient(config, authScopes)
	if err != nil {
	return "", err
	}
	tdfFile, err := os.Create("sensitive.txt.tdf")
	if err != nil {
	return "", err
	}
	defer tdfFile.Close()
	if strings.Count(config.KasUrl, "http") != 1 {
	return "", errors.New("invalid KAS Url, should contain single protocol")
	}
	tdf, err := sdkClient.CreateTDF(
	tdfFile,
	strReader,
	// sdk.WithDataAttributes("https://example.com/attributes/1", "https://example.com/attributes/2"),
	// sdk.WithDataAttributes("https://example.com/attr/attr1/value/value1"),
	sdk.WithDataAttributes(config.DataAttributes...),
	sdk.WithKasInformation(
	sdk.KASInfo{
	// examples assume insecure http
	URL: config.KasUrl,
	PublicKey: "",
	}),
	)
	if err != nil {
	return "", err
	}
	manifestJSON, err := json.MarshalIndent(tdf.Manifest(), "", " ")
	if err != nil {
	return "", err
	}
	// Print Manifest
	fmt.Println(string(manifestJSON))
	return string(manifestJSON), nil
	}

But, you cannot call newSdkClient(config, authScopes) from Python

opentdf-python-sdk/main.go

Lines 110 to 132 in 9251e7b

	func newSdkClient(obj interface{}, authScopes []string) (*sdk.SDK, error) {
	config, err := normalizeConfig(obj)
	if err != nil {
	return nil, err
	}
	// NOTE: The 'platformEndpoint' is sometimes referenced as 'host'
	if strings.Count(config.TokenEndpoint, "http://") == 1 {
	return sdk.New(config.PlatformEndpoint,
	sdk.WithClientCredentials(config.ClientId, config.ClientSecret, authScopes),
	sdk.WithTokenEndpoint(config.TokenEndpoint),
	sdk.WithInsecurePlaintextConn(),
	)
	} else if strings.Count(config.TokenEndpoint, "https://") == 1 {
	return sdk.New(config.PlatformEndpoint,
	sdk.WithClientCredentials(config.ClientId, config.ClientSecret, authScopes),
	sdk.WithTokenEndpoint(config.TokenEndpoint),
	sdk.WithInsecureSkipVerifyConn(),
	)
	} else {
	return nil, errors.New("invalid TokenEndpoint given")
	}
	}

Does that make sense? newSdkClient isn't available, because it starts with a lower-case letter. But, like I said above, if you want to make some enhancement to the code, I would totally welcome it. I would just ask that maybe we try to keep the code clean and PRs small.

For example:

• ou could make a duplicate of the EncryptString or EncryptFile functions in Go to add some new functionality these.
• Or, you could adjust them so that they allow us to optionally take authScopes, and default to authScopes := []string{"email"} if it is not provided.

These are just two ideas, but I'm sure you'll think of something great 🙂

Hope this helps,
@b-long