CoSec
基于 RBAC 和策略的多租户响应式安全框架。
更新内容（v1.10.1） 🎉 🎉 🎉
-
特性：新增
ContainsConditionMatcher。 -
{ "name": "TestContains", "effect": "allow", "actions": [ { "type": "all" } ], "condition": { "type": "contains", "part": "request.attributes.ipRegion", "pattern": "上海" } }
认证
授权
OAuth
建模类图
安全网关服务
授权策略流程
内置策略匹配器
ActionMatcher
如何自定义 ActionMatcher (SPI)
参考 RegularActionMatcher
class CustomActionMatcherFactory : ActionMatcherFactory {
companion object {
const val TYPE = "[CustomActionType]"
}
override val type: String
get() = TYPE
override fun create(onfiguration: Configuration): ActionMatcher {
return CustomActionMatcher(onfiguration)
}
}
class CustomActionMatcher(configuration: Configuration) :
AbstractActionMatcher(CustomActionMatcherFactory.TYPE, configuration) {
override val type: String
get() = CustomActionMatcherFactory.TYPE
override fun internalMatch(request: Request, securityContext: SecurityContext): Boolean {
//Custom matching logic
}
}
META-INF/services/me.ahoo.cosec.policy.action.ActionMatcherFactory
# CustomActionMatcherFactory fully qualified name
ConditionMatcher
如何自定义 ConditionMatcher (SPI)
参考 ContainsConditionMatcher
class CustomConditionMatcherFactory : ConditionMatcherFactory {
companion object {
const val TYPE = "[CustomConditionType]"
}
override val type: String
get() = TYPE
override fun create(configuration: Configuration): ConditionMatcher {
return CustomConditionMatcher(configuration)
}
}
class CustomConditionMatcher(configuration: Configuration) :
AbstractActionMatcher(CustomActionMatcherFactory.TYPE, configuration) {
override val type: String
get() = CustomConditionMatcherFactory.TYPE
override fun internalMatch(request: Request, securityContext: SecurityContext): Boolean {
//Custom matching logic
}
}
META-INF/services/me.ahoo.cosec.policy.condition.ConditionMatcherFactory
# CustomConditionMatcherFactory fully qualified name
策略 Schema
Policy Schema
策略 Demo
{
"id": "id",
"name": "name",
"category": "category",
"description": "description",
"type": "global",
"tenantId": "tenantId",
"statements": [
{
"name": "Anonymous",
"effect": "allow",
"actions": [
{
"type": "path",
"pattern": "/auth/register"
},
{
"type": "path",
"pattern": "/auth/login"
}
]
},
{
"name": "UserScope",
"effect": "allow",
"actions": [
{
"type": "path",
"pattern": "/user/#{principal.id}/*"
}
],
"condition": {
"type": "authenticated"
}
},
{
"name": "Developer",
"effect": "allow",
"actions": [
{
"type": "all"
}
],
"condition": {
"type": "in",
"part": "context.principal.id",
"in": [
"developerId"
]
}
},
{
"name": "RequestOriginDeny",
"effect": "deny",
"actions": [
{
"type": "all"
}
],
"condition": {
"type": "reg",
"negate": true,
"part": "request.origin",
"pattern": "^(http|https)://github.com"
}
},
{
"name": "IpBlacklist",
"effect": "deny",
"actions": [
{
"type": "all"
}
],
"condition": {
"type": "path",
"part": "request.remoteIp",
"path": {
"caseSensitive": false,
"separator": ".",
"decodeAndParseSegments": false
},
"pattern": "192.168.0.*"
}
},
{
"name": "RegionWhitelist",
"effect": "deny",
"actions": [
{
"type": "all"
}
],
"condition": {
"negate": true,
"type": "reg",
"part": "request.attributes.ipRegion",
"pattern": "^中国\\|0\\|(上海|广东省)\\|.*"
}
},
{
"name": "AllowDeveloperOrIpRange",
"effect": "allow",
"actions": [
{
"type": "all"
}
],
"condition": {
"type": "bool",
"bool": {
"and": [
{
"type": "authenticated"
}
],
"or": [
{
"type": "in",
"part": "context.principal.id",
"in": [
"developerId"
]
},
{
"type": "path",
"part": "request.remoteIp",
"path": {
"caseSensitive": false,
"separator": ".",
"decodeAndParseSegments": false
},
"pattern": "192.168.0.*"
}
]
}
}
}
]
}
感谢
CoSec 权限策略设计参考 AWS IAM 。