Skip to content

feat(authz): Handle jwts as entity chains in decision requests - #759

Merged
elizabethhealy merged 34 commits into
mainfrom
handle-multi-entity-jwt
May 17, 2024
Merged

feat(authz): Handle jwts as entity chains in decision requests#759
elizabethhealy merged 34 commits into
mainfrom
handle-multi-entity-jwt

Conversation

@elizabethhealy

@elizabethhealy elizabethhealy commented May 7, 2024 •
edited
Loading

Copy link
Copy Markdown
Member

Resolves #749

  • add endpoint GetDecisionsByToken
  • remove jwt entity type
  • add support for uuid entity type
  • add configuration for different jwt entity selectors

@elizabethhealy elizabethhealy changed the title feat(authorization): Handle jwts as entity chains in decision requests feat(authz): Handle jwts as entity chains in decision requests May 7, 2024
elizabethhealy
elizabethhealy commented May 10, 2024
View reviewed changes
Comment thread service/kas/access/accessPdp.go Outdated
elizabethhealy
elizabethhealy commented May 13, 2024
View reviewed changes
Comment thread examples/cmd/encrypt.go Outdated
@elizabethhealy
elizabethhealy marked this pull request as ready for review May 13, 2024 14:25
@elizabethhealy
elizabethhealy requested review from a team as code owners May 13, 2024 14:25
pflynn-virtru
pflynn-virtru reviewed May 13, 2024
View reviewed changes
Comment thread service/authorization/authorization.proto
pflynn-virtru
pflynn-virtru previously approved these changes May 13, 2024
View reviewed changes
This was referenced May 13, 2024
Closed
Merged
@elizabethhealy

elizabethhealy commented May 13, 2024

Copy link
Copy Markdown
Member Author

#790 -- follow up with detailed e2e testing

jakedoublev
jakedoublev reviewed May 16, 2024
View reviewed changes
Comment thread service/entityresolution/entity_resolution.proto Outdated
jakedoublev
jakedoublev previously approved these changes May 16, 2024
View reviewed changes

@jakedoublev jakedoublev left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not a Codeowner so it both needs and should get a further review, but this LGTM per the ADR outcome.

@elizabethhealy

elizabethhealy commented May 17, 2024

Copy link
Copy Markdown
Member Author

TODO: followup with additional integration testing for token exchange flows

@elizabethhealy
elizabethhealy added this pull request to the merge queue May 17, 2024
Merged via the queue into main with commit 65612e0 May 17, 2024
@elizabethhealy
elizabethhealy deleted the handle-multi-entity-jwt branch May 17, 2024 16:52
This was referenced May 17, 2024
Merged
Merged
Merged
dmihalcik-virtru
dmihalcik-virtru reviewed May 17, 2024
View reviewed changes
Comment thread service/authorization/authorization.go
}
}
val, ok = srp.Config.ExtraProps["clientSecert"]
val, ok = srp.Config.ExtraProps["clientsecert"]

@dmihalcik-virtru dmihalcik-virtru May 17, 2024

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this be clientSecret or clientSecert?

github-merge-queue Bot pushed a commit that referenced this pull request May 20, 2024
@opentdf-automation
chore(main): release protocol/go 0.2.3 (#828)
59d9cc9 
🤖 I have created a release *beep* *boop*
---


##
[0.2.3](protocol/go/v0.2.2...protocol/go/v0.2.3)
(2024-05-17)


### Features

* **authz:** Handle jwts as entity chains in decision requests
([#759](#759))
([65612e0](65612e0))


### Bug Fixes

* **policy:** make resource-mappings update patch instead of put in
RESTful gateway ([#824](#824))
([1878bb5](1878bb5)),
closes [#313](#313)

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
github-merge-queue Bot pushed a commit that referenced this pull request May 21, 2024
@opentdf-automation
chore(main): release sdk 0.2.3 (#829)
ac8d19f 
🤖 I have created a release *beep* *boop*
---


##
[0.2.3](sdk/v0.2.2...sdk/v0.2.3)
(2024-05-21)


### Features

* **authz:** Handle jwts as entity chains in decision requests
([#759](#759))
([65612e0](65612e0))
* **sdk:** Allow setting TDF mime type
([#797](#797))
([97926a1](97926a1))


### Bug Fixes

* bump internal versions
([#840](#840))
([8f45f18](8f45f18))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
github-merge-queue Bot pushed a commit that referenced this pull request May 22, 2024
@opentdf-automation
chore(main): release service 0.4.3 (#819)
7cbe044 
🤖 I have created a release *beep* *boop*
---


##
[0.4.3](service/v0.4.2...service/v0.4.3)
(2024-05-22)


### Features

* **authz:** Allow un-scoped GetEntitlements calls
([#833](#833))
([9146947](9146947))
* **authz:** Handle jwts as entity chains in decision requests
([#759](#759))
([65612e0](65612e0))
* **ci:** Add e2e roundtrip tests for different attribute combinations
([#790](#790))
([1b0ec23](1b0ec23))
* **core:** Adds opentdf.hsm build constraint
([#830](#830))
([e13e52a](e13e52a))
* **core:** audit logging
([#774](#774))
([ea58b3c](ea58b3c))


### Bug Fixes

* **authz:** Populate fqn field in attribute values returned from
GetAttributeValuesByFqns
([#816](#816))
([0ac8390](0ac8390))
* **authz:** Typo in client secret config
([#835](#835))
([7cad1f1](7cad1f1))
* bump internal versions
([#840](#840))
([8f45f18](8f45f18))
* **core:** bump sdk deps to 0.2.3
([#848](#848))
([ca8b9f7](ca8b9f7))
* **policy:** fix policy fqn-reindex command schema suffix
([#818](#818))
([aff9850](aff9850)),
closes [#817](#817)
* **policy:** GetAttributeValuesByFqns and MatchSubjectMappings should
not return deactivated policy objects
([#813](#813))
([41ca82d](41ca82d)),
closes [#494](#494)
* **policy:** make resource-mappings update patch instead of put in
RESTful gateway ([#824](#824))
([1878bb5](1878bb5)),
closes [#313](#313)

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
tech-guru42 added a commit to tech-guru42/TDF that referenced this pull request Jun 3, 2024
@tech-guru42 @opentdf-automation
chore(main): release protocol/go 0.2.3 (#828)
fdc75a9 
🤖 I have created a release *beep* *boop*
---


##
[0.2.3](opentdf/platform@protocol/go/v0.2.2...protocol/go/v0.2.3)
(2024-05-17)


### Features

* **authz:** Handle jwts as entity chains in decision requests
([#759](opentdf/platform#759))
([65612e0](opentdf/platform@65612e0))


### Bug Fixes

* **policy:** make resource-mappings update patch instead of put in
RESTful gateway ([#824](opentdf/platform#824))
([1878bb5](opentdf/platform@1878bb5)),
closes [#313](opentdf/platform#313)

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
tech-guru42 added a commit to tech-guru42/TDF that referenced this pull request Jun 3, 2024
@tech-guru42 @opentdf-automation
chore(main): release sdk 0.2.3 (#829)
d1a728d 
🤖 I have created a release *beep* *boop*
---


##
[0.2.3](opentdf/platform@sdk/v0.2.2...sdk/v0.2.3)
(2024-05-21)


### Features

* **authz:** Handle jwts as entity chains in decision requests
([#759](opentdf/platform#759))
([65612e0](opentdf/platform@65612e0))
* **sdk:** Allow setting TDF mime type
([#797](opentdf/platform#797))
([97926a1](opentdf/platform@97926a1))


### Bug Fixes

* bump internal versions
([#840](opentdf/platform#840))
([8f45f18](opentdf/platform@8f45f18))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
tech-guru42 added a commit to tech-guru42/TDF that referenced this pull request Jun 3, 2024
@tech-guru42 @opentdf-automation
chore(main): release service 0.4.3 (#819)
6db5f0f 
🤖 I have created a release *beep* *boop*
---


##
[0.4.3](opentdf/platform@service/v0.4.2...service/v0.4.3)
(2024-05-22)


### Features

* **authz:** Allow un-scoped GetEntitlements calls
([#833](opentdf/platform#833))
([9146947](opentdf/platform@9146947))
* **authz:** Handle jwts as entity chains in decision requests
([#759](opentdf/platform#759))
([65612e0](opentdf/platform@65612e0))
* **ci:** Add e2e roundtrip tests for different attribute combinations
([#790](opentdf/platform#790))
([1b0ec23](opentdf/platform@1b0ec23))
* **core:** Adds opentdf.hsm build constraint
([#830](opentdf/platform#830))
([e13e52a](opentdf/platform@e13e52a))
* **core:** audit logging
([#774](opentdf/platform#774))
([ea58b3c](opentdf/platform@ea58b3c))


### Bug Fixes

* **authz:** Populate fqn field in attribute values returned from
GetAttributeValuesByFqns
([#816](opentdf/platform#816))
([0ac8390](opentdf/platform@0ac8390))
* **authz:** Typo in client secret config
([#835](opentdf/platform#835))
([7cad1f1](opentdf/platform@7cad1f1))
* bump internal versions
([#840](opentdf/platform#840))
([8f45f18](opentdf/platform@8f45f18))
* **core:** bump sdk deps to 0.2.3
([#848](opentdf/platform#848))
([ca8b9f7](opentdf/platform@ca8b9f7))
* **policy:** fix policy fqn-reindex command schema suffix
([#818](opentdf/platform#818))
([aff9850](opentdf/platform@aff9850)),
closes [#817](opentdf/platform#817)
* **policy:** GetAttributeValuesByFqns and MatchSubjectMappings should
not return deactivated policy objects
([#813](opentdf/platform#813))
([41ca82d](opentdf/platform@41ca82d)),
closes [#494](opentdf/platform#494)
* **policy:** make resource-mappings update patch instead of put in
RESTful gateway ([#824](opentdf/platform#824))
([1878bb5](opentdf/platform@1878bb5)),
closes [#313](opentdf/platform#313)

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
passion-127 added a commit to passion-127/TDF that referenced this pull request Jun 6, 2024
@passion-127 @opentdf-automation
chore(main): release protocol/go 0.2.3 (#828)
8a0ebf9 
🤖 I have created a release *beep* *boop*
---


##
[0.2.3](opentdf/platform@protocol/go/v0.2.2...protocol/go/v0.2.3)
(2024-05-17)


### Features

* **authz:** Handle jwts as entity chains in decision requests
([#759](opentdf/platform#759))
([65612e0](opentdf/platform@65612e0))


### Bug Fixes

* **policy:** make resource-mappings update patch instead of put in
RESTful gateway ([#824](opentdf/platform#824))
([1878bb5](opentdf/platform@1878bb5)),
closes [#313](opentdf/platform#313)

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
passion-127 added a commit to passion-127/TDF that referenced this pull request Jun 6, 2024
@passion-127 @opentdf-automation
chore(main): release sdk 0.2.3 (#829)
c261b91 
🤖 I have created a release *beep* *boop*
---


##
[0.2.3](opentdf/platform@sdk/v0.2.2...sdk/v0.2.3)
(2024-05-21)


### Features

* **authz:** Handle jwts as entity chains in decision requests
([#759](opentdf/platform#759))
([65612e0](opentdf/platform@65612e0))
* **sdk:** Allow setting TDF mime type
([#797](opentdf/platform#797))
([97926a1](opentdf/platform@97926a1))


### Bug Fixes

* bump internal versions
([#840](opentdf/platform#840))
([8f45f18](opentdf/platform@8f45f18))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
passion-127 added a commit to passion-127/TDF that referenced this pull request Jun 6, 2024
@passion-127 @opentdf-automation
chore(main): release service 0.4.3 (#819)
7fc74f1 
🤖 I have created a release *beep* *boop*
---


##
[0.4.3](opentdf/platform@service/v0.4.2...service/v0.4.3)
(2024-05-22)


### Features

* **authz:** Allow un-scoped GetEntitlements calls
([#833](opentdf/platform#833))
([9146947](opentdf/platform@9146947))
* **authz:** Handle jwts as entity chains in decision requests
([#759](opentdf/platform#759))
([65612e0](opentdf/platform@65612e0))
* **ci:** Add e2e roundtrip tests for different attribute combinations
([#790](opentdf/platform#790))
([1b0ec23](opentdf/platform@1b0ec23))
* **core:** Adds opentdf.hsm build constraint
([#830](opentdf/platform#830))
([e13e52a](opentdf/platform@e13e52a))
* **core:** audit logging
([#774](opentdf/platform#774))
([ea58b3c](opentdf/platform@ea58b3c))


### Bug Fixes

* **authz:** Populate fqn field in attribute values returned from
GetAttributeValuesByFqns
([#816](opentdf/platform#816))
([0ac8390](opentdf/platform@0ac8390))
* **authz:** Typo in client secret config
([#835](opentdf/platform#835))
([7cad1f1](opentdf/platform@7cad1f1))
* bump internal versions
([#840](opentdf/platform#840))
([8f45f18](opentdf/platform@8f45f18))
* **core:** bump sdk deps to 0.2.3
([#848](opentdf/platform#848))
([ca8b9f7](opentdf/platform@ca8b9f7))
* **policy:** fix policy fqn-reindex command schema suffix
([#818](opentdf/platform#818))
([aff9850](opentdf/platform@aff9850)),
closes [#817](opentdf/platform#817)
* **policy:** GetAttributeValuesByFqns and MatchSubjectMappings should
not return deactivated policy objects
([#813](opentdf/platform#813))
([41ca82d](opentdf/platform@41ca82d)),
closes [#494](opentdf/platform#494)
* **policy:** make resource-mappings update patch instead of put in
RESTful gateway ([#824](opentdf/platform#824))
([1878bb5](opentdf/platform@1878bb5)),
closes [#313](opentdf/platform#313)

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
alkalescent pushed a commit that referenced this pull request Mar 26, 2026
@jakedoublev
fix(core): unsafe update result output values order (#759)
baeba0f 
Ensure unsafely updating the order of attribute values on a definition
is properly reflected in the table output
alkalescent pushed a commit that referenced this pull request Apr 6, 2026
@opentdf-automation
chore(main): release 0.30.0 (#748)
e4f5f72 
🤖 I have created a release *beep* *boop*
---


##
[0.30.0](opentdf/otdfctl@v0.29.0...v0.30.0)
(2026-03-31)


### Features

* **core:** Add optional namespace flag for subject mappings and
condtion sets ([#779](opentdf/otdfctl#779))
([9e849c4](opentdf/otdfctl@9e849c4))
* **core:** add scope support for client creds
([#752](opentdf/otdfctl#752))
([9ca9e43](opentdf/otdfctl@9ca9e43))
* **core:** migrate registered resources
([#772](opentdf/otdfctl#772))
([2b49a7d](opentdf/otdfctl@2b49a7d))
* **core:** optional namespace in actions commands and re-enable
actions/RR tests ([#775](opentdf/otdfctl#775))
([29a2eb1](opentdf/otdfctl@29a2eb1))
* **core:** support namespaced registered resources
([#767](opentdf/otdfctl#767))
([4d786b5](opentdf/otdfctl@4d786b5))


### Bug Fixes

* **ci:** Temporarily skip namespaced-actions impacted BATS cases
([#773](opentdf/otdfctl#773))
([633728a](opentdf/otdfctl@633728a))
* **core:** bump toolchain to go 1.24.13
([#747](opentdf/otdfctl#747))
([6804b93](opentdf/otdfctl@6804b93))
* **core:** disable RR E2E tests
([#768](opentdf/otdfctl#768))
([0821b8c](opentdf/otdfctl@0821b8c))
* **core:** make namespacing registered resources optional
([#785](opentdf/otdfctl#785))
([8e6eb31](opentdf/otdfctl@8e6eb31))
* **core:** refactor `ListAttributesValues` to use `Get`
([#769](opentdf/otdfctl#769))
([a82f7b7](opentdf/otdfctl@a82f7b7))
* **core:** unsafe update result output values order
([#759](opentdf/otdfctl#759))
([baeba0f](opentdf/otdfctl@baeba0f))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@imdominicreed imdominicreed imdominicreed left review comments
@dmihalcik-virtru dmihalcik-virtru dmihalcik-virtru left review comments
@strantalis strantalis strantalis approved these changes
@jakedoublev jakedoublev jakedoublev left review comments
@pflynn-virtru pflynn-virtru Awaiting requested review from pflynn-virtru
+1 more reviewer
@damorris25 damorris25 damorris25 left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Add GetDecisionsByToken function to address #735

7 participants

@elizabethhealy @imdominicreed @strantalis @damorris25 @dmihalcik-virtru @pflynn-virtru @jakedoublev