OPA Spring Security filter Spring Boot Starter

Spring Boot Starter for OPA Spring Security filter

License	The Apache License, Version 2.0
Categories	Spring Boot Container Microservices
GroupId	com.bisnode.opa
ArtifactId	opa-filter-spring-boot-starter
Last Version	1.3.0
Release Date	Apr 13, 2021
Type	pom.sha512
Description	OPA Spring Security filter Spring Boot Starter Spring Boot Starter for OPA Spring Security filter
Project URL	https://github.com/Bisnode/opa-spring-security
Source Code Management	https://github.com/Bisnode/opa-spring-security.git

Download opa-filter-spring-boot-starter

Filename	Size
opa-filter-spring-boot-starter-1.3.0.pom
opa-filter-spring-boot-starter-1.3.0-sources.jar	261 bytes
opa-filter-spring-boot-starter-1.3.0-javadoc.jar	261 bytes

Dependencies

runtime (2)

Group / Artifact	Type	Version
com.bisnode.opa : opa-filter-core	jar	1.3.0
com.bisnode.opa : opa-filter-autoconfigure	jar	1.3.0

Project Modules

There are no modules declared in this project.

OPA Spring Security Library

OPA Spring Security is a library that enables using OPA for authorization in Spring applications.

Installation

Prerequisites

• Java 11 or higher

Using the starter

Add dependency using Maven

<dependency>
    <groupId>com.bisnode.opa</groupId>
    <artifactId>opa-filter-spring-boot-starter</artifactId>
    <version>{version}</version>
</dependency>

or Gradle

implementation 'com.bisnode.opa:opa-filter-spring-boot-starter:{version}'

Configuration

All properties are prefixed with opa.filter

Property	Default value	Description	Example
enabled	true	Whether the filter should be enabled
documentPath		Name of OPA document path to use for queries	"http/request/authz"
instance	http://localhost:8181	Address of OPA instance
endpointsWhitelist		Comma-separated list of ant patterns to use for matching whitelisted endpoints	/ping,/info,/api-docs/**

Policy requirements

Currently, the filter sends following information to OPA:

• path - path of the resource, that's being requested, e.g. /messages/2
• method - HTTP method, e.g. GET
• encodedJwt - encoded token from authorization (if found, null otherwise)

Those properties are available in your policy's input.

---

Your OPA policy response should contain following properties:

• allow - with value true if to requested resource should be allowed. false otherwise
• reason - an optional string containing reason behind given accessDecision, it will be supplied to exception message

Unknown properties are ignored.

Example OPA response would look as follows:

{
  "result": 
  {
      "allow": false,
      "reason": "You shall not pass"
  }
}

Published events

When library denies access to the resource, AuthorizationFailureEvent is published and therefore can be used in user's code.

Developing and building

Build process and dependency management is done using Gradle. Tests are written in Spock.

Contribution

Interested in contributing? Please, start by reading this document.

Bisnode

Open source @ Bisnode

Versions

Version
1.3.0 Apr 13, 2021
1.2.0 Apr 24, 2020
1.1.1 Apr 15, 2020
1.1.0 Mar 30, 2020
1.0.0 Mar 25, 2020
0.0.5 Mar 23, 2020
0.0.4 Mar 16, 2020
0.0.3 Mar 16, 2020
0.0.1 Mar 13, 2020