ccdb366aa5
Each plug-in operates as a separate service, and registers with Docker through general (plug-ins API) [https://blog.docker.com/2015/06/extending-docker-with-plugins/]. No Docker daemon recompilation is required in order to add / remove an authentication plug-in. Each plug-in is notified twice for each operation: 1) before the operation is performed and, 2) before the response is returned to the client. The plug-ins can modify the response that is returned to the client. The authorization depends on the authorization effort that takes place in parallel [https://github.com/docker/docker/issues/13697]. This is the official issue of the authorization effort: https://github.com/docker/docker/issues/14674 (Here)[https://github.com/rhatdan/docker-rbac] you can find an open document that discusses a default RBAC plug-in for Docker. Signed-off-by: Liron Levin <liron@twistlock.com> Added container create flow test and extended the verification for ps
52 lines
1.8 KiB
Go
52 lines
1.8 KiB
Go
package authorization
|
|
|
|
const (
|
|
// AuthZApiRequest is the url for daemon request authorization
|
|
AuthZApiRequest = "AuthZPlugin.AuthZReq"
|
|
|
|
// AuthZApiResponse is the url for daemon response authorization
|
|
AuthZApiResponse = "AuthZPlugin.AuthZRes"
|
|
|
|
// AuthZApiImplements is the name of the interface all AuthZ plugins implement
|
|
AuthZApiImplements = "authz"
|
|
)
|
|
|
|
// Request holds data required for authZ plugins
|
|
type Request struct {
|
|
// User holds the user extracted by AuthN mechanism
|
|
User string `json:"User,omitempty"`
|
|
|
|
// UserAuthNMethod holds the mechanism used to extract user details (e.g., krb)
|
|
UserAuthNMethod string `json:"UserAuthNMethod,omitempty"`
|
|
|
|
// RequestMethod holds the HTTP method (GET/POST/PUT)
|
|
RequestMethod string `json:"RequestMethod,omitempty"`
|
|
|
|
// RequestUri holds the full HTTP uri (e.g., /v1.21/version)
|
|
RequestURI string `json:"RequestUri,omitempty"`
|
|
|
|
// RequestBody stores the raw request body sent to the docker daemon
|
|
RequestBody []byte `json:"RequestBody,omitempty"`
|
|
|
|
// RequestHeaders stores the raw request headers sent to the docker daemon
|
|
RequestHeaders map[string]string `json:"RequestHeaders,omitempty"`
|
|
|
|
// ResponseStatusCode stores the status code returned from docker daemon
|
|
ResponseStatusCode int `json:"ResponseStatusCode,omitempty"`
|
|
|
|
// ResponseBody stores the raw response body sent from docker daemon
|
|
ResponseBody []byte `json:"ResponseBody,omitempty"`
|
|
|
|
// ResponseHeaders stores the response headers sent to the docker daemon
|
|
ResponseHeaders map[string]string `json:"ResponseHeaders,omitempty"`
|
|
}
|
|
|
|
// Response represents authZ plugin response
|
|
type Response struct {
|
|
|
|
// Allow indicating whether the user is allowed or not
|
|
Allow bool `json:"Allow"`
|
|
|
|
// Msg stores the authorization message
|
|
Msg string `json:"Msg,omitempty"`
|
|
}
|