Introduce "bypass", "one_factor", "two_factor" and "deny" ACL rules #289
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
clems4ever
force-pushed
the
remove-auth-methods
branch
7 times, most recently
from
a48aed1
to
51359eb
Compare
|
cc @nightah |
The possible values for ACL policies are now: bypass, one_factor, two_factor, deny. This change also deprecate auth_methods because the method is now associated directly to a resource in the ACLs instead of a domain.
With previous configuration format rules were not ordered between groups and thus not predictable. Also in some cases `any` must have been a higher precedence than `groups`. Flattening the rules let the user apply whatever policy he can think of. When several rules match the (subject, domain, resource), the first one is applied. NOTE: This commit changed the format for declaring ACLs. Be sure to update your configuration file before upgrading.
clems4ever
force-pushed
the
remove-auth-methods
branch
from
68c631d
to
e226e6f
Compare
clems4ever
force-pushed
the
remove-auth-methods
branch
from
e226e6f
to
b53d16d
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
In this PR we deprecate the
auth_methodsand allow ACL rules to be more granular. That way a user could be granted access with one or two factor depending on the resource he wants to access and not only the domain.[DEPRECATION]
auth_methodsis deprecated after this PR.[BREAKING] The format of ACLs is changing to handle more use cases.
The new format allows to specify the subject of the ACL that can be either anybody, a group or a specific user instead of putting ACLs into categories as before. Adding this attribute and replacing categories (any, groups, users) by a list of ACLs allows Authelia to treat ACLs as iptables does with rules which enables more expressiveness.
With this new formalism, the first matching rules is applied so make sure your rules are properly sorted.