Spinnaker auth service
Clone or download
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
.github fix(docs): Update PULL_REQUEST_TEMPLATE contributing link (#178) Jun 1, 2017
fiat-api config(okhttp): kork-web-2.3.0 adds the metrics interceptor by default ( Oct 5, 2018
fiat-core feat(core): Support allowing default access to all unknown applications Jul 12, 2018
fiat-file feat(roles): Support passing additional user details to `UserRolesPro… Jun 30, 2018
fiat-github fix(roles/github): Reduce burden of github reads for teams and make r… Aug 30, 2018
fiat-google-groups feat(roles): Support passing additional user details to `UserRolesPro… Jun 30, 2018
fiat-ldap fix(ldap): Return mutable list to support "addAll" operation (#269) Oct 4, 2018
fiat-roles fix(sync): Resolve service accounts without role provider calls. (#292) Nov 17, 2018
fiat-web * feat(build): Modular builds for Fiat (#282) Oct 25, 2018
gradle chore(dependencies): spinnaker-gradle-plugin 5.2.1 (#284) Oct 25, 2018
halconfig chore(halyard): Fix redis connection (#155) Mar 15, 2017
.clog.toml chore(changelog): Extend changelog commit keywords. (#157) Mar 22, 2017
.gitignore Initial account configuration + provider (#1) Jun 22, 2016
.travis.yml chore(build): build on openjdk8 (#287) Nov 5, 2018
AUTHORS Project skeleton Jun 14, 2016
Dockerfile chore(docker): Upgrade base image (#215) Feb 8, 2018
Dockerfile.slim Fix typo in Dockerfile.slim (#222) Apr 19, 2018
LICENSE.txt Project skeleton Jun 14, 2016
README.md chore(docs): Fix Readme (#285) Oct 30, 2018
build.gradle chore(dependencies): Autobump spinnaker-dependencies (#301) Dec 14, 2018
cloudbuild-tagged.yaml chore(nightly build): Adds clouddriver-tagged.yaml for nightly builds ( Jul 10, 2017
cloudbuild.yaml chore(nightly build): Adds clouddriver-tagged.yaml for nightly builds ( Jul 10, 2017
gradle.properties * feat(build): Modular builds for Fiat (#282) Oct 25, 2018
gradlew chore(build): Gradle 4.7 Apr 23, 2018
gradlew.bat chore(build): Gradle 4.7 Apr 23, 2018
lombok.config Initial account configuration + provider (#1) Jun 22, 2016
settings.gradle * feat(build): Modular builds for Fiat (#282) Oct 25, 2018

README.md

Spinnaker Auth Service

Build Status

   ____ _         ____ __    ___               _            ______                  _    
  / __/(_)__ __  /  _// /_  / _ | ___ _ ___ _ (_)___       /_  __/____ ___ _ _  __ (_)___
 / _/ / / \ \ / _/ / / __/ / __ |/ _ `// _ `// // _ \ _     / /  / __// _ `/| |/ // /(_-<
/_/  /_/ /_\_\ /___/ \__/ /_/ |_|\_, / \_,_//_//_//_/( )   /_/  /_/   \_,_/ |___//_//___/
                                /___/                |/                                  

Fiat is the authorization server for the Spinnaker system.

It exposes a RESTful interface for querying the access permissions for a particular user. It currently supports three kinds of resources:

  • Accounts
  • Applications
  • Service Accounts

Accounts

Accounts are setup within Clouddriver and queried by Fiat for its configured requiredGroupMembership restrictions.

Applications

Applications are the combination of config metadata pulled from Front50 and server group names (e.g., application-stack-details). Application permissions sit beside application configuration in S3/Google Cloud Storage.

Service Accounts

Fiat Service Accounts are groups that act as a user during automated triggers (say, from a GitHub push or Jenkins build). Authorization is built in by making the service account a member of a group specified in requiredGroupMembership.


User Role/Authorization Providers

Currently supported user role providers are:

  • Google Groups (through a Google Apps for Work organization)
  • GitHub Teams
  • LDAP
  • File based role provider

Modular builds

By default, Fiat is built with all authorization providers included. To build only a subset of providers, use the includeProviders flag:

./gradlew -PincludeProviders=google-groups,ldap clean build

You can view the list of all providers in gradle.properties.

Debugging

To start the JVM in debug mode, set the Java system property DEBUG=true:

./gradlew -DDEBUG=true

The JVM will then listen for a debugger to be attached on port 7103. The JVM will not wait for the debugger to be attached before starting Fiat; the relevant JVM arguments can be seen and modified as needed in build.gradle.