Customizing the authorization rules
You can customize the rules that allow or deny a request to the Stormshield KMaaS, using Open Policy Agent (OPA). The policy evaluates the request inputs. If the request is forbidden, the access is denied and the "403 Forbidden" error is returned.
In the config.json file, the policy_enforcement.enable parameter is mandatory. It allows you to specify whether you want to enable OPA rules or not.
The inputs relating to all API routes are described in section Inputs relating to all API routes.
The tables below describe the inputs specific to the Admin module.
Inputs specific to alI Admin routes
You can use the following inputs to create custom rules to access the Admin module, for example to filter the application of policies.
|
Input |
Description |
Source of the input |
|---|---|---|
| operation |
API routes called: "create_key", "update_key", "get_keys", "update_key" This input replaces the endpoint input for the Admin routes. |
URL of the request |
| tenantId |
Unique identifier of a tenant in UUID format. Example: 2363615f-5b08-4119-a5bd-fad3f5f3f420 |
URL of the request |
| administratedModule |
Name of the module. Possible values:
|
URL of the request |
| authentication.authType |
Type of authentication used for the request. Possible values:
|
"authorization" header used. |
| authentication.keyName | Name of the API key used to authenticate the request. Only present when using "apiKey" authentication. | Name corresponding to the key in configuration |
| authentication.iss |
Entity which has created and signed the token. Only present when using "token" authentication. |
JWT authentication token provided by the IDP. |
| authentication.aud |
Corresponds to the audience for which the token was issued. Only present when using "token" authentication. Example: [ 'admin-authorization', 'admin-authorization1' ] |
JWT authentication token provided by the IDP. |
| authentication.iat |
Date when the token was issued. In timestamp format (integer) Only present when using "token" authentication. Example: 1677679386 |
JWT authentication token provided by the IDP. |
| authentication.exp |
Date when the token expires. In timestamp format (integer) Only present when using "token" authentication. Example: 1677679386 |
JWT authentication token provided by the IDP. |
| authentication.customClaims |
Optional. Custom claims provided par the IDP. Only present when using "token" authentication. |
JWT authentication token provided by the IDP. |
Inputs specific to the Admin get_key route
|
Input |
Description |
Source of the input |
|---|---|---|
| keyId | Identifier of the requested key. | URL of the request. |
Inputs specific to the Admin create_key route
|
Input |
Description |
Source of the input |
|---|---|---|
| displayName | Name of the key to create. | Body of the request. |
| algorithm |
Algorithm used to create the key. Possible values:
|
Body of the request. |
| algorithmParameters.modulusLength |
Length of the asymmetric key algorithm. Only present if algorithm is "RSA-OAEP". Possible values:
|
Body of the request. |
| algorithmParameters.hash |
Hash of the asymmetric key. Only present if algorithm is "RSA-OAEP". Prescribed value:
|
Body of the request. |
| algorithmParameters.length | Length of the symmetric key algorithm. Only present if algorithm is "AES-GCM". Prescribed value:
|
Body of the request. |
Inputs specific to the Admin update_key route
|
Input |
Description |
Source of the input |
|---|---|---|
| keyId | Identifier of the key to update. | URL of the request. |
| displayName | Optional. Updated name of the key. | URL of the request. |
| status |
Optional. Updated status. Prescribed value:
|
URL of the request. |