Customizing the authorization rules

You can customize the rules that allow or deny a request to the Stormshield KMaaS, using Open Policy Agent (OPA). The policy evaluates the request inputs. If the request is forbidden, the access is denied and the "403 Forbidden" error is returned.

In the config.json file, the policy_enforcement.enable parameter is mandatory. It allows you to specify whether you want to enable OPA rules or not.

The inputs relating to all API routes are described in section Inputs relating to all API routes.

The tables below describe the inputs specific to the DKE module.

Inputs specific to the DKE get and decrypt API routes

You can use the following inputs to create custom rules to access the DKE module, for example to filter the application of policies.

Input	Description	Source of the input
kid	URI identifying the exact key version.	URL of the request.
versionId	Identifier of the version of the key used for the request.	URL of the request.
userAgent	Identifier of the application issuing the HTTP request.	Header of the HTTP request.

Inputs specific to the DKE decrypt API route

You can use the following inputs to create custom rules to access the DKE module on the decrypt route.

Input	Description	Source of the input
authentication.iss	Entity which has created and signed the token.	JWT authentication token provided by the IDP.
authentication.aud	Corresponds to the audience for which the token was issued. Example: https://cse.mysds.io	JWT authentication token provided by the IDP.
authentication.iat	Date when the token was issued. In timestamp format (integer) Example: 1677679386	JWT authentication token provided by the IDP.
authentication.exp	Date when the token expires. In timestamp format (integer) Example: 1677679386	JWT authentication token provided by the IDP.
authentication.customClaims	Custom claims provided par the IDP. See the List of claims provided by Microsoft Azure services. All payload claims, expect iss, aud, iat and exp may be present in custom claims.	JWT authentication token provided by the IDP.