shreemaan-abhishek opened a new pull request, #14098:
URL: https://github.com/apache/apisix/pull/14098
### Description
`authz-keycloak` sends all permissions for a route in one token endpoint
request with `response_mode=decision`. Keycloak answers `{"result": true}` when
at least one requested permission is granted, and the plugin forwards the
request on any status below 400. As a result, a route that lists several
permissions, or a permission with several scopes, is forwarded when only part
of them is granted.
The same applies to `http_method_as_scope`. When a static permission already
has a scope, for example `res#view`, the plugin requests `res#view, DELETE`. A
user granted only `view` gets a positive decision, so the method scope is never
enforced.
This PR:
- requests `response_mode=permissions` and checks that every requested
resource and scope is in the granted list before forwarding. Resources match on
name or id, so both static permissions and `lazy_load_paths` work.
- returns the existing 403 (or the `access_denied_redirect_uri` redirect)
when any permission or scope is missing, and 503 when the response can't be
decoded.
- adds tests with a user granted `view` but not `delete`/`DELETE`: multiple
permissions in both orders, multiple scopes in one permission, and
`http_method_as_scope` on a scoped static permission.
- updates the `authz-keycloak5.t` mock token endpoint to return a
permissions list.
- documents that every permission and scope must be granted.
#### Breaking changes
Routes that list several permissions and relied on the request being
forwarded when any one of them is granted will now return 403 unless the user
holds all of them. The same applies to `http_method_as_scope` on a static
permission that already has a scope: the method scope must now be granted too.
#### Which issue(s) this PR fixes:
N/A
### Checklist
- [x] I have explained the need for this PR and the problem it solves
- [x] I have explained the changes or the new features added to this PR
- [x] I have added tests corresponding to this change
- [x] I have updated the documentation to reflect this change
- [ ] I have verified that this change is backward compatible (If not,
please discuss on the [APISIX mailing
list](https://github.com/apache/apisix/tree/master#community) first)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
