Improvement/arsn 362 implicit deny #2181

benzekrimaha · 2023-10-30T14:52:39Z

Opened after closed PR here

Adds ImplicitDeny logic to policy checks, where an ImplicitDeny will be sent back in case no policy validates an action, but does not explicitly Deny it either, allowing for bucket policies and other authorization mechanisms to grant permission.

Part of the bucket policy redo epic: https://scality.atlassian.net/jira/software/c/projects/OS/boards/214?selectedIssue=S3C-7756

Green build in Vault and CS:
https://github.com/scality/Vault/actions/runs/6694175632/job/18186886853?pr=2135
https://github.com/scality/cloudserver/actions/runs/6693681174/job/18185346914?pr=5322

Would appreciate reviews on Integration branches as well
Arsenal version has been bumped lastly

As the evaluateAllPolicies function is using the result of the standardEvaluateAllPolicies , the redundant tests are removed. The test that was kept is only to show that we use the result.verdict in old flow evaluation.

bert-e · 2023-10-30T14:52:42Z

Hello benzekrimaha,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Status report is not available.

bert-e · 2023-10-30T14:52:52Z

Incorrect fix version

The Fix Version/s in issue ARSN-362 contains:

7.10.49
7.70.13
8.1.113

Considering where you are trying to merge, I ignored possible hotfix versions and I expected to find:

7.10.49
7.70.13
8.1.114

Please check the Fix Version/s of ARSN-362, or the target
branch of this pull request.

benzekrimaha · 2023-10-30T14:58:51Z

ping

bert-e · 2023-10-30T15:00:48Z

Request integration branches

Waiting for integration branch creation to be requested by the user.

To request integration branches, please comment on this pull request with the following command:

/create_integration_branches

Alternatively, the /approve and /create_pull_requests commands will automatically
create the integration branches.

benzekrimaha · 2023-10-30T15:00:57Z

/create_integration_branches

bert-e · 2023-10-30T15:01:08Z

Integration data created

I have created the integration data for the additional destination branches.

this pull request will merge improvement/ARSN-362-implicitDeny into
development/7.10
w/7.70/improvement/ARSN-362-implicitDeny will be merged into development/7.70
w/8.1/improvement/ARSN-362-implicitDeny will be merged into development/8.1

The following branches will NOT be impacted:

development/6.4
development/7.4

You can set option create_pull_requests if you need me to create
integration pull requests in addition to integration branches, with:

@bert-e create_pull_requests

The following options are set: create_integration_branches

bert-e · 2023-10-30T15:01:11Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

The following options are set: create_integration_branches

benzekrimaha · 2023-10-30T15:06:18Z

@bert-e create_pull_requests

bert-e · 2023-10-30T15:06:31Z

Integration data created

I have created the integration data for the additional destination branches.

this pull request will merge improvement/ARSN-362-implicitDeny into
development/7.10
w/7.70/improvement/ARSN-362-implicitDeny will be merged into development/7.70 (pull request INTEGRATION [PR#2181 > development/7.70] Improvement/arsn 362 implicit deny #2182)
w/8.1/improvement/ARSN-362-implicitDeny will be merged into development/8.1 (pull request INTEGRATION [PR#2181 > development/8.1] Improvement/arsn 362 implicit deny #2183)

The following branches will NOT be impacted:

development/6.4
development/7.4

Follow integration pull requests if you would like to be notified of
build statuses by email.

The following options are set: create_pull_requests, create_integration_branches

bert-e · 2023-10-30T15:06:32Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

The following options are set: create_pull_requests, create_integration_branches

benzekrimaha · 2023-10-30T15:58:46Z

ping

jonathan-gramain · 2023-10-30T20:01:28Z

lib/policyEvaluator/evaluator.ts

+    allPolicies: any[],
+    log: Logger,
+): {
+    verdict: string;


After a discussion about this some time ago with William maybe in a PR (I can't find the ref) it was about returning a single state string like ImplicitDeny or ExplicitDeny rather than an object with a boolean, to make it simpler and more visual, forcing to handle all states explicitly. There could have been reasons to stick to using a boolean maybe for backward-compatibility, since I'm not aware of this just want to make sure it was a conscious decision.

I indeed found the comment you are refering to here : https://github.com/scality/citadel/pull/165#discussion_r1276904304
I'm looping @williamlardier in for more insight on this

Yes, this is for backward compatibility, that we use the boolean, given that we want to keep both flows. With a boolean, we can minimize the changes applied to our code base.

But our last discussion was about the request contexts responses (i.e., in Vault), not the internal logic. The request context API must be updated as stated in the design, but the evaluation logic can stay like that, unless we see benefits of having a uniform authz result starting at Arsenal level (maybe by creating a new typescript type or enum). Then in cloudserver we can check the authz result using string comparisons, and update the functions here (and associated tests).

As discussed with Maha already, if we want to deviate from the design (with good reasons), we must update the design. Here, the current code looks compatible with it, but I think having a unified implementation would be better indeed. It will require creating the new authz types in arsenal, update the functions, and then reuse them in Vault/Cloudserver.

benzekrimaha · 2023-11-03T09:30:26Z

@bert-e approve

bert-e · 2023-11-03T09:30:44Z

In the queue

The changeset has received all authorizations and has been added to the
relevant queue(s). The queue(s) will be merged in the target development
branch(es) as soon as builds have passed.

The changeset will be merged in:

✔️ development/7.10
✔️ development/7.70
✔️ development/8.1

The following branches will NOT be impacted:

development/6.4
development/7.4

There is no action required on your side. You will be notified here once
the changeset has been merged. In the unlikely event that the changeset
fails permanently on the queue, a member of the admin team will
contact you to help resolve the matter.

IMPORTANT

Please do not attempt to modify this pull request.

Any commit you add on the source branch will trigger a new cycle after the
current queue is merged.
Any commit you add on one of the integration branches will be lost.

If you need this pull request to be removed from the queue, please contact a
member of the admin team now.

The following options are set: approve, create_pull_requests, create_integration_branches

bert-e · 2023-11-03T09:30:57Z

I have successfully merged the changeset of this pull request
into targetted development branches:

✔️ development/7.10
✔️ development/7.70
✔️ development/8.1

The following branches have NOT changed:

development/6.4
development/7.4

Please check the status of the associated issue ARSN-362.

Goodbye benzekrimaha.

Will Toozs and others added 4 commits October 27, 2023 17:22

ARSN-362: add implicit deny logic to policy evaluation

79c82a4

ARSN-362: add implicit deny logic to policy eval tests

39988e5

ARSN-362: change new function name for clarity

7777831

ARSN-362:fixups on impl deny policy tests

df5ff0f

As the evaluateAllPolicies function is using the result of the standardEvaluateAllPolicies , the redundant tests are removed. The test that was kept is only to show that we use the result.verdict in old flow evaluation.

benzekrimaha marked this pull request as ready for review October 30, 2023 14:53

scality deleted a comment from bert-e Oct 30, 2023

KillianG approved these changes Oct 30, 2023

View reviewed changes

This was referenced Oct 30, 2023

INTEGRATION [PR#2181 > development/7.70] Improvement/arsn 362 implicit deny #2182

Merged

INTEGRATION [PR#2181 > development/8.1] Improvement/arsn 362 implicit deny #2183

Merged

bump arsenal version

fbf5562

Kerkesni approved these changes Oct 30, 2023

View reviewed changes

scality deleted a comment from bert-e Oct 30, 2023

jonathan-gramain reviewed Oct 30, 2023

View reviewed changes

anurag4DSB self-requested a review October 31, 2023 08:58

jonathan-gramain approved these changes Nov 2, 2023

View reviewed changes

anurag4DSB approved these changes Nov 3, 2023

View reviewed changes

williamlardier approved these changes Nov 3, 2023

View reviewed changes

bert-e merged commit fbf5562 into development/7.10 Nov 3, 2023
8 checks passed

bert-e deleted the improvement/ARSN-362-implicitDeny branch November 3, 2023 09:31

This was referenced Nov 13, 2023

Improvement/cldsrv 427 permissions checks scality/cloudserver#5432

Merged

Improvement/cldsrv 428 put apis implicit deny scality/cloudserver#5449

Closed

This was referenced Nov 21, 2023

Improvement/cldsrv 428 put apis implicit deny scality/cloudserver#5450

Closed

CLDSRV-428: put apis updated for implicit deny scality/cloudserver#5456

Merged

This was referenced Nov 29, 2023

CLDSRV-429: update get apis with impDeny logic scality/cloudserver#5461

Closed

CLDSRV-429: update get apis with impDeny logic scality/cloudserver#5462

Merged

Improvement/cldsrv 430 delete api implicit deny scality/cloudserver#5470

Merged

This was referenced Dec 14, 2023

Improvement/cldsrv 431 misc api implicit deny scality/cloudserver#5479

Merged

improvement/CLDSRV-451-specific-7.70-apis-update scality/cloudserver#5495

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Improvement/arsn 362 implicit deny #2181

Improvement/arsn 362 implicit deny #2181

benzekrimaha commented Oct 30, 2023 •

edited

Loading

bert-e commented Oct 30, 2023

bert-e commented Oct 30, 2023

benzekrimaha commented Oct 30, 2023

bert-e commented Oct 30, 2023

benzekrimaha commented Oct 30, 2023

bert-e commented Oct 30, 2023

bert-e commented Oct 30, 2023

benzekrimaha commented Oct 30, 2023

bert-e commented Oct 30, 2023

bert-e commented Oct 30, 2023

benzekrimaha commented Oct 30, 2023

jonathan-gramain Oct 30, 2023

benzekrimaha Oct 31, 2023 •

edited

Loading

williamlardier Nov 2, 2023

benzekrimaha commented Nov 3, 2023 •

edited

Loading

bert-e commented Nov 3, 2023

bert-e commented Nov 3, 2023

Improvement/arsn 362 implicit deny #2181

Improvement/arsn 362 implicit deny #2181

Conversation

benzekrimaha commented Oct 30, 2023 • edited Loading

bert-e commented Oct 30, 2023

Hello benzekrimaha,

bert-e commented Oct 30, 2023

Incorrect fix version

benzekrimaha commented Oct 30, 2023

bert-e commented Oct 30, 2023

Request integration branches

benzekrimaha commented Oct 30, 2023

bert-e commented Oct 30, 2023

Integration data created

bert-e commented Oct 30, 2023

Waiting for approval

benzekrimaha commented Oct 30, 2023

bert-e commented Oct 30, 2023

Integration data created

bert-e commented Oct 30, 2023

Waiting for approval

benzekrimaha commented Oct 30, 2023

jonathan-gramain Oct 30, 2023

Choose a reason for hiding this comment

benzekrimaha Oct 31, 2023 • edited Loading

Choose a reason for hiding this comment

williamlardier Nov 2, 2023

Choose a reason for hiding this comment

benzekrimaha commented Nov 3, 2023 • edited Loading

bert-e commented Nov 3, 2023

In the queue

bert-e commented Nov 3, 2023

benzekrimaha commented Oct 30, 2023 •

edited

Loading

benzekrimaha Oct 31, 2023 •

edited

Loading

benzekrimaha commented Nov 3, 2023 •

edited

Loading