https://speedle.io/categories/docs/ Recent content in Docs on Speedle Hugo -- gohugo.io en-us Fri, 18 Jan 2019 21:19:44 +0800 https://speedle.io/docs/pms/policy-mgmt/ Mon, 01 Jan 0001 00:00:00 +0000 https://speedle.io/docs/pms/policy-mgmt/ What is a Speedle policy? A Speedle policy is a set of criteria that specify whether a user is granted access to a particular protected resource or assignment to a particular role. You manage Speedle policies using the Speedle Policy Management Service(PMS). Understanding the Speedle Policy Module Note: The Speedle syntax used in this document is defined in SPDL - Security Policy Definition Language. Policy store The policy store maintains all policy artifacts and can be persisted to an etcd store or a JSON file. https://speedle.io/docs/usecases/ Mon, 01 Jan 0001 00:00:00 +0000 https://speedle.io/docs/usecases/ Application specific policies Alex Chan is a developer who is implementing a simple application with golang. His application requires Authorization and he doesn’t want to re-invent the wheel. Alex can use an open source choice like Speedle for Authorization. Centalized policy enforcement and management Jin Chen is a security manager of multinational company. His team monitor dozens of internal systems. Different systems use different authorization mechanisms, different policy languages. They are eager to find a solution to manage all these systems efficiently. https://speedle.io/docs/pms/global-policy/ Fri, 18 Jan 2019 21:19:44 +0800 https://speedle.io/docs/pms/global-policy/ How global policies simplify policy management In Speedle, role policies and policies are defined and evaluated within a scope, which is called a ‘service’. For example, when creating a policy, you need to specify the service in which to create the policy. When calling the Authorization Decision Service API, you need to specify a service name so that the policies and role policies are evaluated within the scope of that service. https://speedle.io/docs/pms/diagnosis/ Fri, 18 Jan 2019 15:46:59 +0800 https://speedle.io/docs/pms/diagnosis/ What’s policy diagnosis Policy diagnosis is one of the Speedle’s advanced features, which is used to diagnose the evaluation process of authorization. When the evaluation result isn’t expected or a user isn’t allowed to operate on a resource, then this feature is useful to find out the reason, i.e., what’s the policy which denies the operation on the resource. How to use policy diagnosis The usage of policy diagnosis request is almost identical to the usage of authorization decision request. https://speedle.io/docs/decisions/ Mon, 01 Jan 0001 00:00:00 +0000 https://speedle.io/docs/decisions/ What is an authorization decision? An authorization decision determines whether a subject performing an action on a resource is allowed. An authorization decision is the result of real-time evaluation based on policies and attributes. Ways to get authorization decisions Authorization decisions can be performed by the Authorization Decision Service or an by an embedded evaluator: Authorization Decision Service (ADS) REST API Grpc API Embedded Evaluator Golang API APIs and Samples The ADS decision APIs make authorization decisions based on policies that describe the actions, permissions, and roles granted to a subject. https://speedle.io/docs/pms/discover/ Mon, 01 Jan 0001 00:00:00 +0000 https://speedle.io/docs/pms/discover/ What can discover mode do? * Help you discover existing authorization requests The is-allowed API endpoint and the discover API endpoint use the same request and response format. When you replace is-allowed with discover in the URL of the API, each authorization request that is returned shows WHO carries out WHAT action on WHICH resource. Discover mode does not evaluate the authorization decision; it simply records the authorization decision requests, along with the actions and the resources protected, and returns “is-allowed=true”. https://speedle.io/docs/spdl/ Mon, 01 Jan 0001 00:00:00 +0000 https://speedle.io/docs/spdl/ Syntax Keywords The reserved keywords in SPDL are as follows. You cannot use any of these keywords as user name, group name, action, resource, attribute name, and so on. role user group entity grant deny if in on from The keywords are all case-insensitive, which means that you cannot use one of “role”, “ROLE”, “Role”, “rOLe”, etc as user name, group name, action, resource, attribute name, and so on. https://speedle.io/docs/pms/ Fri, 18 Jan 2019 21:19:44 +0800 https://speedle.io/docs/pms/ Policy Management Global Policy Policy Discovery Policy Diagnosis https://speedle.io/docs/idd/ Thu, 17 Jan 2019 13:20:07 +0800 https://speedle.io/docs/idd/ What is an identity domain? An identity domain is a logical namespace for users and groups, typically representing a discrete set of users and groups in the physical data store. Each identity domain manages users and groups independently. User and group names must be unique in an identity domain. How Speedle handles multiple identity domains In an integrated environment, identities may come from multiple identity domains. Consider, for example, the following policy where a user with the identifier user1 is authorized to perform a rent action on the resource book. https://speedle.io/docs/assertor/ Mon, 21 Jan 2019 09:28:30 +0800 https://speedle.io/docs/assertor/ Benefits of the token asserter An evaluation request can contain an identity token issued by any identity provider as an incoming user identity, instead of specifying the user identities (user identifier and those groups user belongs to) explicitly. When you integrate Speedle into your service, your service does not need to validate and parse identity tokens. Speedle can do it for you. The Speedle evaluation engine checks whether the incoming request contains an identity token. https://speedle.io/docs/api/ Mon, 01 Jan 0001 00:00:00 +0000 https://speedle.io/docs/api/ REST APIs Policy Management Service API Authorization Decision Service API Token Assertion API GRPC APIs Policy Management Service API Authorization Decision Service API Golang APIs Policy Management Service API Authorization Decision Service API Policy Management Authorization Decision Token Assertion https://speedle.io/docs/deployment/ Mon, 01 Jan 0001 00:00:00 +0000 https://speedle.io/docs/deployment/ Deploy Speedle in embedded mode Speedle works as a Go library. To deploy Speedle in embedded mode, simply pull Speedle from the repository and import it in golang code. The Policy Management Service (PMS) golang API is called to do policy management, and the Authorization Decision Service (ADS) golang API is called to do runtime authorization checks. Deploy Speedle as a service You can deploy Speedle as a service on Kubernetes in these modes: https://speedle.io/docs/logging/ Mon, 01 Jan 0001 00:00:00 +0000 https://speedle.io/docs/logging/ Overview The following two open source projects are used to process log messages, 1. https://github.com/sirupsen/logrus 2. https://github.com/natefinch/lumberjack Logrus is a structured logger for Go (golang), and completely API compatible with the golang standard library logger. Note that logrus doesn’t support log rotation, and it is exactly the reason why we introduce the second project lumberjack, which provides a rolling logger. Logrus communicates with lumberjack using the io.Writer interface, please refer to the following diagram, https://speedle.io/docs/store/ Mon, 01 Jan 0001 00:00:00 +0000 https://speedle.io/docs/store/ Overview Speedle now supports two kinds of data store, OOTB: file store and etcd store. However, you can implement your own data store (e.g. with mongodb, etc) Please note the data store needs to support the watch function. This document walks through step-by-step instructions to implement a data store. Write store code to implement the PolicyStoreManager interface Create a “mystore” directory under store directory and navigate to it. https://speedle.io/docs/security/ Mon, 01 Jan 0001 00:00:00 +0000 https://speedle.io/docs/security/ Overview API Endpoint Security / Authentication and Authorization Authentication and authorization for client requests (other than TLS mutual auth) are not supported by Speedle. If you want to protect Speedle API endpoints, you can use any existing/stock solutions to secure these APIs (e.g. an API Gateway like Ambassador with tokens etc). Message security / TLS TLS is a cryptographic protocol that provides communications security, it offers many different ways of exchanging keys for authentication, encrypting data, and guaranteeing message integrity. https://speedle.io/docs/ Thu, 17 Jan 2019 13:20:07 +0800 https://speedle.io/docs/ https://speedle.io/docs/versions/ Mon, 01 Jan 0001 00:00:00 +0000 https://speedle.io/docs/versions/ Version 0.2.0 (planning) … Version 0.1.0 release notes: This is the first open source version. All basic functions are available in this version, including Policy Management Service Authorization Runtime Service Command line tool Integration samples https://speedle.io/docs/custom-function/ Mon, 21 Jan 2019 10:43:02 +0800 https://speedle.io/docs/custom-function/ Why use custom functions? In Speedle, policies and role policies may include conditions. You can create conditions using expressions. or use the built-in functions that are provided with Speedle. If the condition is very complicated, it may be too difficult to create using expressions and built-in functions. In that case, you can use a custom function that you define, which extends the ability of the authorization engine. Custom functions supplement the built-in functions that Speedle provides, increasing the flexibility for defining conditions. https://speedle.io/docs/api/decision_api/ Mon, 01 Jan 0001 00:00:00 +0000 https://speedle.io/docs/api/decision_api/ (function() { var url = "\/swagger\/policy-check.yaml"; const ui = SwaggerUIBundle({ url: url, dom_id: '#swagger-ui', deepLinking: true, presets: [ SwaggerUIBundle.presets.apis ], plugins: [ SwaggerUIBundle.plugins.DownloadUrl ], validatorUrl: null, layout: "BaseLayout" }) window.ui = ui })(); https://speedle.io/integrations/ Mon, 10 Apr 2017 16:41:54 +0100 https://speedle.io/integrations/ https://speedle.io/docs/api/management_api/ Mon, 01 Jan 0001 00:00:00 +0000 https://speedle.io/docs/api/management_api/ (function() { var url = "\/swagger\/policy-manage.yaml"; const ui = SwaggerUIBundle({ url: url, dom_id: '#swagger-ui', deepLinking: true, presets: [ SwaggerUIBundle.presets.apis ], plugins: [ SwaggerUIBundle.plugins.DownloadUrl ], validatorUrl: null, layout: "BaseLayout" }) window.ui = ui })(); https://speedle.io/docs/api/asserter_api/ Mon, 01 Jan 0001 00:00:00 +0000 https://speedle.io/docs/api/asserter_api/ (function() { var url = "\/swagger\/asserter.yaml"; const ui = SwaggerUIBundle({ url: url, dom_id: '#swagger-ui', deepLinking: true, presets: [ SwaggerUIBundle.presets.apis ], plugins: [ SwaggerUIBundle.plugins.DownloadUrl ], validatorUrl: null, layout: "BaseLayout" }) window.ui = ui })();