absolutejam
Any chance you could point out an example that allows assigning a group to users via. a wildcard (keyMatch, globMatch)?
That's the part I'm struggling with as that part is done via. the whole g graph side and I'm unsure that'd work
But the former could be an issue if the user has access to lots of resources, and if the pagination is performed here, it essentially moves sorting out of the DB 🙈
Anyone got any suggestions for performing RBAC checks on an api 'list' endpoint?
Currently, I'm thinking of using GetImplicitPermissionsForUser, then building a DB query filter from that.
The other option is to filter after querying, but that seems less efficient, especially with pagination as it might mean over-querying and filtering (and potentially re-querying to 'fill' the page)
I have a sneaky feeling it must involve a g2 declaration though 🤔
I can't see anything that matches what I'm looking for, ie. glob matching users to groups
but maybe I'm just not well versed in reading the syntax yet
Hey, is it possible to match a subject name with wildcards like keyMatch2 does?
I would like to define a policy that applies to everyone.
# sub dom obj act
p, role/chronicle.creator, chronicle/*, chronicle/*, create
# r.sub p.sub dom
g, user/*, role/chronicle.creator, chronicle/*
[request_definition]
r = sub, dom, obj, act
[policy_definition]
p = sub, dom, obj, act
[policy_effect]
e = some(where (p.eft == allow))
[role_definition]
g = _, _, _
# User to role mapping, with domain support
[matchers]
m = g(r.sub, p.sub, r.dom) && \
keyMatch2(r.dom, p.dom) && \
keyMatch2(r.obj, p.obj) && \
(r.act == p.act || p.act == "*")
But obviously I can't just stick in keyMatch2 like I use for the other fields as I need the graph/grouping (g) to resolve for groups/roles
