Defines an authorization policy.
Polices are used to authorize requests to the REST API, authorize requests to internal APIs, and to give system wide capabilities to tenants.
Policies are defined per-tenant. A tenant can assign its policies to its subtenants and to its users and approles.
A user or approle is allowed to do everything that its assigned policies allow, and that the tenant it belongs to is allowed to do.
A tenant that has a parent tenant with the same role is allowed to do everything that its assigned policies allow, and that its parent tenant is allowed to do.
A tenant without a parent tenant with the same role (i.e., the top site-provider, or top application-owner), is allowed to do everything that its assigned policies allow, and that its role is allowed to do.
Hence, the top site-provider can do anything, and a top application-owner without any assigned policies is allowed to do anything an application-owner can do.
Created
Bad Request
Unauthorized
Forbidden
Not Found
Conflict (instance exists)
Service Unavailable (strongbox sealed)
name: user rest-api: rules: - path: /** description: Allow access to everything. operations: all: allow - path: /v1/*/strongbox/identity/** description: Prevent user from modifying own or others credentials. operations: all: reject - path: /v1/*/policy/policies/** description: Prevent user from modifying policy rules. operations: create: reject read: allow update: reject delete: reject execute: reject - path: /v1/*/strongbox/token/create-root description: Prevent user from creating root token operations: all: reject - path: /v1/*/strongbox/token/disable description: Prevent user from disabling others tokens. operations: all: reject - path: /v1/*/strongbox/transit-keys/infra/** description: Prevent access to infra transit keys. operations: all: reject capabilities: all: allow volga: topics: - name: "*" operations: create: reject delete: reject produce: reject consume: allow infras: - name: "*" operations: produce: reject consume: allow
| fields | string Retrieve only requested fields from the resource See section fields |
| validate | string <enumeration> Validate the request but do not actually perform the requested operation |
| keys | string <enumeration> Retrieve only the keys for the list |
| count | string <enumeration> Retrieve only the number of elements in the list |
OK
Bad Request
Unauthorized
Forbidden
Not Found
Precondition Failed
Service Unavailable (strongbox sealed)
- name: user rest-api: rules: - path: /** description: Allow access to everything. operations: all: allow - path: /v1/*/strongbox/identity/** description: Prevent user from modifying own or others credentials. operations: all: reject - path: /v1/*/policy/policies/** description: Prevent user from modifying policy rules. operations: create: reject read: allow update: reject delete: reject execute: reject - path: /v1/*/strongbox/token/create-root description: Prevent user from creating root token operations: all: reject - path: /v1/*/strongbox/token/disable description: Prevent user from disabling others tokens. operations: all: reject - path: /v1/*/strongbox/transit-keys/infra/** description: Prevent access to infra transit keys. operations: all: reject capabilities: all: allow volga: topics: - name: "*" operations: create: reject delete: reject produce: reject consume: allow infras: - name: "*" operations: produce: reject consume: allow
No Content
Bad Request
Unauthorized
Forbidden
Not Found
Precondition Failed
Service Unavailable (strongbox sealed)
name: user rest-api: rules: - path: /** description: Allow access to everything. operations: all: allow - path: /v1/*/strongbox/identity/** description: Prevent user from modifying own or others credentials. operations: all: reject - path: /v1/*/policy/policies/** description: Prevent user from modifying policy rules. operations: create: reject read: allow update: reject delete: reject execute: reject - path: /v1/*/strongbox/token/create-root description: Prevent user from creating root token operations: all: reject - path: /v1/*/strongbox/token/disable description: Prevent user from disabling others tokens. operations: all: reject - path: /v1/*/strongbox/transit-keys/infra/** description: Prevent access to infra transit keys. operations: all: reject capabilities: all: allow volga: topics: - name: "*" operations: create: reject delete: reject produce: reject consume: allow infras: - name: "*" operations: produce: reject consume: allow
Created
No Content
Bad Request
Unauthorized
Forbidden
Not Found
Precondition Failed
Service Unavailable (strongbox sealed)
name: user rest-api: rules: - path: /** description: Allow access to everything. operations: all: allow - path: /v1/*/strongbox/identity/** description: Prevent user from modifying own or others credentials. operations: all: reject - path: /v1/*/policy/policies/** description: Prevent user from modifying policy rules. operations: create: reject read: allow update: reject delete: reject execute: reject - path: /v1/*/strongbox/token/create-root description: Prevent user from creating root token operations: all: reject - path: /v1/*/strongbox/token/disable description: Prevent user from disabling others tokens. operations: all: reject - path: /v1/*/strongbox/transit-keys/infra/** description: Prevent access to infra transit keys. operations: all: reject capabilities: all: allow volga: topics: - name: "*" operations: create: reject delete: reject produce: reject consume: allow infras: - name: "*" operations: produce: reject consume: allow
| fields | string Retrieve only requested fields from the resource See section fields |
| validate | string <enumeration> Validate the request but do not actually perform the requested operation |
OK
Bad Request
Unauthorized
Forbidden
Not Found
Precondition Failed
Service Unavailable (strongbox sealed)
name: user rest-api: rules: - path: /** description: Allow access to everything. operations: all: allow - path: /v1/*/strongbox/identity/** description: Prevent user from modifying own or others credentials. operations: all: reject - path: /v1/*/policy/policies/** description: Prevent user from modifying policy rules. operations: create: reject read: allow update: reject delete: reject execute: reject - path: /v1/*/strongbox/token/create-root description: Prevent user from creating root token operations: all: reject - path: /v1/*/strongbox/token/disable description: Prevent user from disabling others tokens. operations: all: reject - path: /v1/*/strongbox/transit-keys/infra/** description: Prevent access to infra transit keys. operations: all: reject capabilities: all: allow volga: topics: - name: "*" operations: create: reject delete: reject produce: reject consume: allow infras: - name: "*" operations: produce: reject consume: allow
| fields | string Retrieve only requested fields from the resource See section fields |
| site | string Send the request to the specfifed site |
| content | string <enumeration> Filter descendant nodes in the response |
| keys | string <enumeration> Retrieve only the keys for the list |
| count | string <enumeration> Retrieve only the number of elements in the list |
OK
Bad Request
Unauthorized
Forbidden
Not Found
Service Unavailable (strongbox sealed)
- name: user rest-api: rules: - path: /** description: Allow access to everything. operations: all: allow - path: /v1/*/strongbox/identity/** description: Prevent user from modifying own or others credentials. operations: all: reject - path: /v1/*/policy/policies/** description: Prevent user from modifying policy rules. operations: create: reject read: allow update: reject delete: reject execute: reject - path: /v1/*/strongbox/token/create-root description: Prevent user from creating root token operations: all: reject - path: /v1/*/strongbox/token/disable description: Prevent user from disabling others tokens. operations: all: reject - path: /v1/*/strongbox/transit-keys/infra/** description: Prevent access to infra transit keys. operations: all: reject capabilities: all: allow volga: topics: - name: "*" operations: create: reject delete: reject produce: reject consume: allow infras: - name: "*" operations: produce: reject consume: allow
| fields | string Retrieve only requested fields from the resource See section fields |
| site | string Send the request to the specfifed site |
| content | string <enumeration> Filter descendant nodes in the response |
OK
Bad Request
Unauthorized
Forbidden
Not Found
Service Unavailable (strongbox sealed)
name: user rest-api: rules: - path: /** description: Allow access to everything. operations: all: allow - path: /v1/*/strongbox/identity/** description: Prevent user from modifying own or others credentials. operations: all: reject - path: /v1/*/policy/policies/** description: Prevent user from modifying policy rules. operations: create: reject read: allow update: reject delete: reject execute: reject - path: /v1/*/strongbox/token/create-root description: Prevent user from creating root token operations: all: reject - path: /v1/*/strongbox/token/disable description: Prevent user from disabling others tokens. operations: all: reject - path: /v1/*/strongbox/transit-keys/infra/** description: Prevent access to infra transit keys. operations: all: reject capabilities: all: allow volga: topics: - name: "*" operations: create: reject delete: reject produce: reject consume: allow infras: - name: "*" operations: produce: reject consume: allow
This action allows testing of different paths against the current set of rules in the policy. It helps answer the question 'is a given operation allowed for a given path?'
OK
Bad Request
Unauthorized
Forbidden
Not Found
Service Unavailable (strongbox sealed)
path: /v1/config/strongbox/authentication/userpass operation: update
action: allow