casbin / caddy-authz Goto Github PK

View Code? Open in Web Editor NEW

240.0 4.0 15.0 131 KB

Caddy-authz is a middleware for Caddy that blocks or allows requests based on access control policies.

Home Page: https://caddyserver.com/docs/modules/http.handlers.authz

License: Apache License 2.0

Go 100.00%

caddy middleware plugin filter casbin authorization acl rbac abac access-control

caddy-authz's Introduction

Caddy-authz

Caddy-authz is an authorization middleware for Caddy, it's based on https://github.com/casbin/casbin.

Installation

go get github.com/casbin/caddy-authz

Caddyfile syntax

localhost {
    route { 
        authz "/folder/to/caddy_binary/authz_model.conf" "/folder/to/caddy_binary/authz_policy.csv"
    }
    respond "Hello, world!"
    ...
}

{
    order authz before respond
}

localhost {
	authz "/folder/to/caddy_binary/authz_model.conf" "/folder/to/caddy_binary/authz_policy.csv"
	respond "Hello, world!"
    ...
}

The authz directive specifies the path to Casbin model file (.conf) and Casbin policy file (.csv). The Casbin model file describes access control models like ACL, RBAC, ABAC, etc. The Casbin policy file describes the authorization policy rules. For how to write these files, please refer to: https://github.com/casbin/casbin#get-started

A working example

cd into the folder of caddy binary.
Put your Casbin model file authz_model.conf and Casbin policy file authz_policy.csv into this folder.
Add authz directive to your Caddyfile like:

localhost:666 {
    route { 
        authz "authz_model.conf" "authz_policy.csv"
    }
    respond "Hello, world!"
    ...
}

Run caddy and enjoy.

Note: This plugin only supports HTTP basic authentication to get the logged-in user name, if you use other kinds of authentication like OAuth, LDAP, etc, you may need to customize this plugin.

How to control the access

The authorization determines a request based on {subject, object, action}, which means what subject can perform what action on what object. In this plugin, the meanings are:

subject: the logged-on user name
object: the URL path for the web resource like "dataset1/item1"
action: HTTP method like GET, POST, PUT, DELETE, or the high-level actions you defined like "read-file", "write-blog"

For how to write authorization policy and other details, please refer to the Casbin's documentation.

Getting Help

Casbin

License

This project is under Apache 2.0 License. See the LICENSE file for the full license text.

caddy-authz's People

Contributors

Stargazers

Watchers

Forkers

cluo jonathanlogan kadel frimik leondevlifelog wahello magikstm hartzell rodriguesdossantosvincent internetofwater 00lt00 lemonsn bandirsen selflocking

caddy-authz's Issues

Cant get route to be recognised in Caddyfile. Can someone have a look ?

caddy run:


caddy run
2021/05/31 09:38:16.341 INFO    using adjacent Caddyfile
run: adapting config using caddyfile: parsing caddyfile tokens for 'route': Caddyfile:4 - Error during parsing: unrecognized directive: authz
make: *** [ex-run] Error 1

CaddyFile:

localhost {
    route {
        authz "authz_model.conf" "authz_policy.csv"
    }
    respond "Hello, world!"
}

ls -al:


Caddyfile
authz_model.conf
authz_policy.csv
caddy
index.html
xcaddy

Setup

I presume that I need https://github.com/caddyserver/xcaddy to build this plugin into caddy like below.


# build plugin into caddy
xcaddy build \
        --with github.com/casbin/caddy-authz
2021/05/31 11:49:42 [INFO] Temporary folder: /Users/apple/workspace/go/src/github.com/gedw99/notes/sec/casbin__caddy-authz/_bin/buildenv_2021-05-31-1149.937129880
2021/05/31 11:49:42 [INFO] Writing main module: /Users/apple/workspace/go/src/github.com/gedw99/notes/sec/casbin__caddy-authz/_bin/buildenv_2021-05-31-1149.937129880/main.go
2021/05/31 11:49:42 [INFO] Initializing Go module
2021/05/31 11:49:42 [INFO] exec (timeout=10s): /usr/local/opt/go/libexec/bin/go mod init caddy 
go: creating new go.mod: module caddy
go: to add module requirements and sums:
        go mod tidy
2021/05/31 11:49:43 [INFO] Pinning versions
2021/05/31 11:49:43 [INFO] exec (timeout=0s): /usr/local/opt/go/libexec/bin/go get -d -v github.com/caddyserver/caddy/v2 
go get: added github.com/caddyserver/caddy/v2 v2.4.1
2021/05/31 11:49:47 [INFO] exec (timeout=0s): /usr/local/opt/go/libexec/bin/go get -d -v github.com/casbin/caddy-authz 
go get: added github.com/caddyserver/caddy v1.0.5
go get: added github.com/casbin/caddy-authz v1.0.2
go get: added github.com/casbin/casbin v1.9.1
2021/05/31 11:49:48 [INFO] Build environment ready
2021/05/31 11:49:48 [INFO] Building Caddy
2021/05/31 11:49:48 [INFO] exec (timeout=0s): /usr/local/opt/go/libexec/bin/go mod tidy 
2021/05/31 11:49:50 [INFO] exec (timeout=0s): /usr/local/opt/go/libexec/bin/go build -o /Users/apple/workspace/go/src/github.com/gedw99/notes/sec/casbin__caddy-authz/_bin/caddy -ldflags -w -s -trimpath 
2021/05/31 11:49:52 [INFO] Build complete: ./caddy
2021/05/31 11:49:52 [INFO] Cleaning up temporary folder: /Users/apple/workspace/go/src/github.com/gedw99/notes/sec/casbin__caddy-authz/_bin/buildenv_2021-05-31-1149.937129880

Build issues on caddyserver.com

I believe the issue could be corrected by using a valid release version tag in the form v0.1.0 or v1.0.0.

Ref: https://caddy.community/t/plugins-having-build-issues-as-of-05-06-2019/5817

Revisit a merged PR which broke our Travis CI and the support for Caddy v2

See details at: #7 (comment)

caddy v2 support

I wonder if caddy v2 support is something someone's working on

Add caddy-authz to the official Caddy v2 code & Caddy v2 docs's module list

For Caddy v1, I used to make such a PR: caddyserver/caddy#1693 which registered caddy-authz as "authz" plugin in the Caddy v1 ecosystem.

But Caddy comes to v2 now and all v1 code is gone. We need to follow a similar path to integrate caddy-authz into Caddy v2 code-base again.

Meanwhile, the v1 docs is also gone. The current v2 docs's module list has no our middleware any more: https://caddyserver.com/docs/modules/

We also need to make PR to that website's source code: https://github.com/caddyserver/website to add our middleware.

Add the unit test for this middleware (authz_test.go)

See details at: #8 (comment)

Caddy's import path has changed

Caddy's import path (and Go module name) has changed from

github.com/mholt/caddy

github.com/caddyserver/caddy

Unfortunately, Go modules are not yet mature enough to handle a change like this (see https://golang.org/issue/26904 - "haven't implemented that part yet" but high on priority list for Go 1.14) which caught me off-guard. Using Go module's replace feature didn't act the way I expected, either. Caddy now fails to build with plugins until they update their import paths.

I've hacked a fix into the build server, so downloading Caddy with your plugin from our website should continue working without any changes on your part, for now. However, please take a moment and update your import paths, and do a new deploy on the website, because the workaround involves ignoring module checksums and performing a delicate recursive search-and-replace.

I'm terribly sorry about this. I did a number of tests and dry-runs to ensure the change would be smooth, but apparently some unknown combination of GOPATH, Go modules' lack of maturity, and other hidden variables in the system or environment must have covered up something I missed.

This bash script should make it easy (run it from your project's top-level directory):

find . -name '*.go' | while read -r f; do
	sed -i.bak 's/\/mholt\/caddy/\/caddyserver\/caddy/g' $f && rm $f.bak
done

We use this script in the build server as part of the temporary workaround.

Let me know if you have any questions! Sorry again for the inconvenience.