mirror of
https://github.com/0rangebananaspy/authelia.git
synced 2024-09-14 22:47:21 +07:00
4dce8f9496
* adjust session refresh to always occur (for disabled users) * feat: adds filtering option for Request Method in ACL's * simplify flow of internal/authorization/authorizer.go's methods * implement query string checking * utilize authorizer.Object fully * make matchers uniform * add tests * add missing request methods * add frontend enhancements to handle request method * add request method to 1FA Handler Suite * add internal ACL representations (preparsing) * expand on access_control next * add docs * remove unnecessary slice for network names and instead just use a plain string * add warning for ineffectual bypass policy (due to subjects) * add user/group wildcard support * fix(authorization): allow subject rules to match anonymous users * feat(api): add new params * docs(api): wording adjustments * test: add request method into testing and proxy docs * test: add several checks and refactor schema validation for ACL * test: add integration test for methods acl * refactor: apply suggestions from code review * docs(authorization): update description
53 lines
1.5 KiB
Go
53 lines
1.5 KiB
Go
package schema
|
|
|
|
// AccessControlConfiguration represents the configuration related to ACLs.
|
|
type AccessControlConfiguration struct {
|
|
DefaultPolicy string `mapstructure:"default_policy"`
|
|
Networks []ACLNetwork `mapstructure:"networks"`
|
|
Rules []ACLRule `mapstructure:"rules"`
|
|
}
|
|
|
|
// ACLNetwork represents one ACL network group entry; "weak" coerces a single value into slice.
|
|
type ACLNetwork struct {
|
|
Name string `mapstructure:"name"`
|
|
Networks []string `mapstructure:"networks"`
|
|
}
|
|
|
|
// ACLRule represents one ACL rule entry; "weak" coerces a single value into slice.
|
|
type ACLRule struct {
|
|
Domains []string `mapstructure:"domain,weak"`
|
|
Policy string `mapstructure:"policy"`
|
|
Subjects [][]string `mapstructure:"subject,weak"`
|
|
Networks []string `mapstructure:"networks"`
|
|
Resources []string `mapstructure:"resources"`
|
|
Methods []string `mapstructure:"methods"`
|
|
}
|
|
|
|
// DefaultACLNetwork represents the default configuration related to access control network group configuration.
|
|
var DefaultACLNetwork = []ACLNetwork{
|
|
{
|
|
Name: "localhost",
|
|
Networks: []string{"127.0.0.1"},
|
|
},
|
|
{
|
|
Name: "internal",
|
|
Networks: []string{"10.0.0.0/8"},
|
|
},
|
|
}
|
|
|
|
// DefaultACLRule represents the default configuration related to access control rule configuration.
|
|
var DefaultACLRule = []ACLRule{
|
|
{
|
|
Domains: []string{"public.example.com"},
|
|
Policy: "bypass",
|
|
},
|
|
{
|
|
Domains: []string{"singlefactor.example.com"},
|
|
Policy: "one_factor",
|
|
},
|
|
{
|
|
Domains: []string{"secure.example.com"},
|
|
Policy: "two_factor",
|
|
},
|
|
}
|