AuthZEN Search

OpenID AuthZEN has defined an interoperability scenario for the Search APIs. This repo contains the model and data that are used to implement the scenario for the Topaz platform.

Background

This scenario was implemented entirely using a ReBAC model, which can be found in the manifest.yaml file.

The AuthZEN search scenario is implemented using a ReBAC manifest, which defines a few object types:

• user - the subject of an authorization (or search) request
• group - a group of users - for example, the "manager" group contains all managers
• department - the department that a user belongs to, and that a record belongs to
• record - the resource in an authorization (or search) request

A department has members and managers, both of whom are users.

A record has a department, an owner (user), and viewers (user or group).

Setup Instructions

Install Topaz

Install Topaz using the instructions here.

For example, on a Mac:

brew tap aserto-dev/tap && brew install topaz

Create the "authzen-search" configuration

This will create a new configuration called "authzen-search" based on the simple-rbac template:

topaz templates install simple-rbac --config-name=authzen-search

This configuration will use the policy-rebac authorization policy, which delegates authorization to the ReBAC processor.

Reset the directory

To reset the directory, delete the manifest

topaz ds delete manifest

Set a new manifest

Load the authzen-search manifest:

topaz ds set manifest ./manifest.yaml

Load the data

Load the users, groups, departments, records, and relationships between them:

topaz ds import -d ./data

Issue AuthZEN search requests

Subject search

To search for all the users that can view record:101:

curl -X POST -d '
{
  "subject": { 
    "type": "user"
  },
  "action": {
    "name": "view"
  },
  "resource": { 
    "type": "record",
    "id": "101"
  } 
}' https://localhost:9393/access/v1/search/subject

{
  "results":  [
    {
      "type":  "user",
      "id":  "alice",
      "properties":  null
    },
    {
      "type":  "user",
      "id":  "bob",
      "properties":  null
    },
    {
      "type":  "user",
      "id":  "carol",
      "properties":  null
    },
    {
      "type":  "user",
      "id":  "dan",
      "properties":  null
    }
  ],
  "page":  {
    "next_token":  ""
  }
}

Resource search

To search for the records that user:alice can delete:

curl -X POST -d '
{
  "subject": { 
    "type": "user",
    "id": "alice"
  },
  "action": {
    "name": "delete"
  },
  "resource": { 
    "type": "record"
  } 
}' https://localhost:9393/access/v1/search/resource

{
  "results":  [
    {
      "type":  "record",
      "id":  "107",
      "properties":  null
    },
    {
      "type":  "record",
      "id":  "113",
      "properties":  null
    },
    {
      "type":  "record",
      "id":  "119",
      "properties":  null
    },
    {
      "type":  "record",
      "id":  "101",
      "properties":  null
    }
  ],
  "page":  {
    "next_token":  ""
  }
}