Class OpaBundle<T extends io.dropwizard.Configuration>
- java.lang.Object
-
- org.sdase.commons.server.opa.OpaBundle<T>
-
- All Implemented Interfaces:
io.dropwizard.ConfiguredBundle<T>
public class OpaBundle<T extends io.dropwizard.Configuration> extends java.lang.Object implements io.dropwizard.ConfiguredBundle<T>
The OPA bundle enables support for the Open Policy Agent.Note, the OPA bundle is not an alternative for the @
AuthBundle
it is an addition for authorization. TheAuthBundle
is still required for validating the JWT *A new filter is added to the invocation chain of every endpoint invocation. This filter invokes the OPA at the configured URL. Normally, this should be a sidecar of the actual service. The response includes an authorization decision and optional constraints that must be evaluated when querying the database or filtering the result set of the request.
The constraints should be modeled as an Java pojo and documented within this pojo. The OPA policies must be designed that the predefined result structure is returned, such as
{ "result": { "allow": true, "constraint1": true, "constraint2": [ "v2.1", "v2.2" ] } }
The filter evaluates the overall allow decision and adds the constraints to the
SecurityContext
asOpaJwtPrincipal
.The endpoints for swagger are excluded from the OPA filter.
-
-
Nested Class Summary
Nested Classes Modifier and Type Class Description static class
OpaBundle.Builder<C extends io.dropwizard.Configuration>
static class
OpaBundle.DuplicatePropertyException
static class
OpaBundle.HiddenOriginalPropertyException
static interface
OpaBundle.OpaBuilder<C extends io.dropwizard.Configuration>
static interface
OpaBundle.OpaExtensionsBuilder<C extends io.dropwizard.Configuration>
static interface
OpaBundle.ProviderBuilder
-
Method Summary
All Methods Static Methods Instance Methods Concrete Methods Modifier and Type Method Description static OpaBundle.ProviderBuilder
builder()
void
initialize(io.dropwizard.setup.Bootstrap<?> bootstrap)
void
run(T configuration, io.dropwizard.setup.Environment environment)
-
-
-
Method Detail
-
builder
public static OpaBundle.ProviderBuilder builder()
-
initialize
public void initialize(io.dropwizard.setup.Bootstrap<?> bootstrap)
- Specified by:
initialize
in interfaceio.dropwizard.ConfiguredBundle<T extends io.dropwizard.Configuration>
-
-