czertainly/czertainly-auth repository overview
CZERTAINLY Auth Service
This repository is part of the commercial open source project CZERTAINLY. You can find more information about the project at CZERTAINLY repository, including the contribution guide.
Auth service is designed as a central service for managing access control to different resources and related actions and objects, and identify users based on identification token.
Auth service offers the following functionality:
- identification of user
- management of roles
- management of users and their roles membership
- management of resources and related actions
- management of role permissions for specific resources and related actions
- issuing authorization tokens
User can belong to multiple roles and permissions are merged in this case from all assigned roles.
Note The authorization is performed by the OPA. The
Authservice manages users, roles, and associated permissions that can be assigned to users.
Authentication flow
Users can be identified based on identification token provided in this order:
- X.509 certificate
- JSON ID
- Username of system user
After successful identification, user details with its merged role permissions is returned. If none of the above specified data is present, user is identified as anonymous user with limited permissions.
X.509 certificate
When identifying user with certificate, its content string is decoded and parsed. Afterwards it is verified if it is valid and trusted.
Then, based on its fingerprint, it is mapped to user from database and return authentication response. The certificate can be assigned to maximum of 1 user.
JSON ID
When identifying user with JSON ID, it is decoded and must conform to the required structure. Username specified in the JSON ID is used as unique information based on which user is identified.
Auth service can be further configured to create user or role, if it does not exist.
Username of system user
Username is used only for internal identification of system users to elevate permissions and perform actions that are otherwise subject to authorization. This is not exposed for the external systems.
Authorization
This service does not evaluate permissions. The authorization is controlled by the Open Policy Agent. For more information, refer to CZERTAINLY Documentation.
Docker container
Auth service is provided as a Docker container. Use the czertainly/czertainly-auth:tagname to pull the required image from the repository. It can be configured using the following environment variables:
| Variable | Description | Required | Default value |
|---|---|---|---|
AUTH_DB_CONNECTION_STRING | Connection string for database access |  | N/A |
AUTH_CREATE_UNKNOWN_USERS | Unknown user with username specified in JSON authentication token will be created |  | false |
AUTH_CREATE_UNKNOWN_ROLES | Unknown role with name specified in JSON authentication token will be created and assigned to user | | false |
SYNC_POLICY | create-only - create users and roles based on previous variables, changes in token not reflected in already existing user.sync-data - user's properties and roles are synced with the user data present in token | | create-only |
Tag summary
Content type
Image
Digest
sha256:b387c1d66…
Size
56.3 MB
Last updated
11 months ago
docker pull czertainly/czertainly-auth