Implement admin logic #308
Labels
multitenancy
Getting Parsec to provide isolated key stores for multiple clients based on an identity mechanism
security
Issues related to the security and privacy of the service
In the config file
We add under the
[authenticator]
section theadmins
field:The type of
name
is authenticator-dependant but would map to application names that are considered as admin for that authenticator: a SPIFFE ID, a UID, a string (for direct auth).In the service builder
When building the authenticator structure (implementing
Authenticate
), we store the information of the admins application name in the authenticator structure.In the front-end handler
The front-end handler calls the
authenticate
method on the authenticator to then dispatch the request with the good application name (or none). Things here stay the same but theApplicationName
structure would be enhanced with a boolean field indicating if it is anadmin
application name or not (is_admin
). It's the authenticator during theauthenticate
call that would set that boolean or not if the application name is in the list of the admin ones.In the back-end handler
Before calling the appropriate
Provide
method, for those that require admin privilege,is_admin
is called to check if the application has privilege or not. If not aAdminOperation
error should be returned (see parallaxsecond/parsec-interface-rs#93).Testing
Will be done in another issue, in #309
The text was updated successfully, but these errors were encountered: