mirror of
https://github.com/mailscope/kumomta.git
synced 2026-09-07 11:08:56 +00:00
Wez Furlong
4055c50522
This commit is a step towards some general improvements around our handling of authentication and authorization. This commit is focused primarily on authorization, but there are some adjustments to how we track authentication as part of enabling that. We now have a separate AuthInfo type that holds the overall authentication information/context associated with an inbound SMTP or HTTP session. It is populated with the peer_address as a fact rather than a statement of trust. If authentication via the appropriate lua auth callback is successful, then the AuthInfo has additional identities added. There are some types and events for loading access control lists and matching their rules against an AuthInfo. There is now a system default ACL that is equivalent to the prior hard-coded access policy that was encoded into each HTTP endpoint. This change makes it possible to replace the ACL with a user-defined ACL. Later will be some work on authentication to allow more options for HTTP auth.
51 lines
1.6 KiB
Lua
51 lines
1.6 KiB
Lua
local kumo = require 'kumo'
|
|
local utils = require 'policy-extras.policy_utils'
|
|
|
|
kumo.on('get_acl_definition', function(resource)
|
|
-- This is more specific than the general `/api/admin` rule that is
|
|
-- present in the default ACL. We will assert that this is the matching
|
|
-- resource in the test below
|
|
if resource == 'http_listener/*/api/admin/baz' then
|
|
return kumo.aaa.make_access_control_list {
|
|
{
|
|
criteria = {
|
|
Identity = { Group = 'kumomta:http-listener-trusted-ip' },
|
|
},
|
|
privilege = 'GET',
|
|
access = 'Allow',
|
|
},
|
|
}
|
|
end
|
|
return nil
|
|
end)
|
|
|
|
kumo.on('main', function()
|
|
local test_url = kumo.aaa.make_http_url_resource(
|
|
'127.0.0.1:8080',
|
|
'https://localhost/api/admin/baz'
|
|
)
|
|
|
|
local unauthenticated_auth_info = {}
|
|
local trusted_auth_info = {
|
|
groups = { 'kumomta:http-listener-trusted-ip' },
|
|
}
|
|
|
|
local query_result =
|
|
kumo.aaa.query_resource_access(test_url, unauthenticated_auth_info, 'GET')
|
|
utils.assert_eq(query_result.allow, false)
|
|
utils.assert_eq(query_result.rule, nil)
|
|
utils.assert_eq(query_result.resource, nil)
|
|
|
|
local query_result =
|
|
kumo.aaa.query_resource_access(test_url, trusted_auth_info, 'GET')
|
|
utils.assert_eq(query_result.allow, true)
|
|
utils.assert_eq(query_result.rule, {
|
|
criteria = { Identity = { Group = 'kumomta:http-listener-trusted-ip' } },
|
|
access = 'Allow',
|
|
privilege = 'GET',
|
|
})
|
|
-- Verify that this is the more specific ACL that we provide in the
|
|
-- get_acl_definition event above
|
|
utils.assert_eq(query_result.resource, 'http_listener/*/api/admin/baz')
|
|
end)
|