Skip to content

feat(authz): subject mapping plugin support for ABAC with actions #2223

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 4 commits into from
May 19, 2025
Merged

feat(authz): subject mapping plugin support for ABAC with actions #2223

merged 4 commits into from
May 19, 2025

Conversation

jakedoublev
Copy link
Contributor

Proposed Changes

  • enhance subjectmappingplugin with actions in response to subject mapping evaluation

Checklist

  • I have added or updated unit tests
  • I have added or updated integration tests (if appropriate)
  • I have added or updated documentation

Testing Instructions

@jakedoublev jakedoublev requested a review from a team as a code owner May 16, 2025 04:04
@jakedoublev jakedoublev mentioned this pull request May 16, 2025
Merged
@jakedoublev jakedoublev requested a review from Copilot May 16, 2025 04:07
Copilot
Copilot AI reviewed May 16, 2025
View reviewed changes
Copy link
Contributor

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR enhances the subject mapping plugin to support actions as part of the subject mapping evaluation for ABAC authorization. Key changes include the introduction of EvaluateSubjectMappingMultipleEntitiesWithActions and EvaluateSubjectMappingsWithActions functions, which deduplicate actions and aggregate entitlements based on subject mapping evaluation.

@github-actions GitHub Actions
Copy link
Contributor

Benchmark results, click to expand

Benchmark Results:

Metric Value
Approved Decision Requests 5000
Denied Decision Requests 0
Total Time 459.549777ms

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 367.916762ms
Throughput 271.80 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 1m17.843375734s
Average Latency 775.828821ms
Throughput 64.23 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 4945
Failed Requests 55
Concurrent Requests 50
Total Time 1m9.077321099s
Average Latency 688.022693ms
Throughput 71.59 requests/second

Error Summary:

Error Message Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error
rpc error: code = Internal desc = could not perform access		 55 occurrences

Standard Benchmark Metrics Skipped or Failed

@jakedoublev jakedoublev enabled auto-merge May 16, 2025 04:11
@github-actions GitHub Actions
Copy link
Contributor

Benchmark results, click to expand

Benchmark Results:

Metric Value
Approved Decision Requests 5000
Denied Decision Requests 0
Total Time 454.704135ms

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 369.573174ms
Throughput 270.58 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 1m16.343297673s
Average Latency 761.352599ms
Throughput 65.49 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 4934
Failed Requests 66
Concurrent Requests 50
Total Time 1m6.709931084s
Average Latency 665.174711ms
Throughput 73.96 requests/second

Error Summary:

Error Message Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error
rpc error: code = Internal desc = could not perform access		 66 occurrences

Standard Benchmark Metrics Skipped or Failed

@jakedoublev jakedoublev requested a review from jentfoo May 16, 2025 17:09
pflynn-virtru
pflynn-virtru previously approved these changes May 16, 2025
View reviewed changes
jentfoo
jentfoo previously approved these changes May 16, 2025
View reviewed changes
Copy link
Contributor

@jentfoo jentfoo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, feel free to ignore my minor suggestions

@jakedoublev jakedoublev dismissed stale reviews from jentfoo and pflynn-virtru via 2a79467 May 17, 2025 23:31
@jakedoublev jakedoublev requested a review from jentfoo May 17, 2025 23:31
@github-actions GitHub Actions
Copy link
Contributor

Benchmark results, click to expand

Benchmark Results:

Metric Value
Approved Decision Requests 5000
Denied Decision Requests 0
Total Time 482.481082ms

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 373.119087ms
Throughput 268.01 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 1m18.53804271s
Average Latency 783.67599ms
Throughput 63.66 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 4941
Failed Requests 59
Concurrent Requests 50
Total Time 1m8.467987849s
Average Latency 682.106898ms
Throughput 72.17 requests/second

Error Summary:

Error Message Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error
rpc error: code = Internal desc = could not perform access		 59 occurrences

Standard Benchmark Metrics Skipped or Failed

@github-actions GitHub Actions
Copy link
Contributor

Benchmark results, click to expand

Benchmark Results:

Metric Value
Approved Decision Requests 5000
Denied Decision Requests 0
Total Time 460.684887ms

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 364.656535ms
Throughput 274.23 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 1m17.18549883s
Average Latency 769.356167ms
Throughput 64.78 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 4947
Failed Requests 53
Concurrent Requests 50
Total Time 1m7.663661475s
Average Latency 673.180037ms
Throughput 73.11 requests/second

Error Summary:

Error Message Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error
rpc error: code = Internal desc = could not perform access		 53 occurrences

Standard Benchmark Metrics Skipped or Failed

@ryanulit
Copy link
Contributor

👍

@jakedoublev jakedoublev added this pull request to the merge queue May 19, 2025
Merged via the queue into main with commit d08b939 May 19, 2025
28 checks passed
@jakedoublev jakedoublev deleted the feat/authz-sm-plugin branch May 19, 2025 15:40
@opentdf-automation opentdf-automation bot mentioned this pull request May 19, 2025
Merged
github-merge-queue bot pushed a commit that referenced this pull request May 22, 2025
@opentdf-automation
chore(main): release service 0.5.3 (#2046)
66550d2 
🤖 I have created a release *beep* *boop*
---


##
[0.5.3](service/v0.5.2...service/v0.5.3)
(2025-05-22)


### Features

* **authz:** authz v2 versioning implementation
([#2173](#2173))
([557fc21](557fc21))
* **authz:** authz v2, ers v2 protos and gencode for ABAC with actions &
registered resource
([#2124](#2124))
([ea7992a](ea7992a))
* **authz:** export entity id prefix constant from entity instead of
authorization service v1
([#2261](#2261))
([94079a9](94079a9))
* **authz:** subject mapping plugin support for ABAC with actions
([#2223](#2223))
([d08b939](d08b939))
* bulk keycloak provisioning
([#2205](#2205))
([59e4485](59e4485))
* **core:** add otel to opentdf services
([#1858](#1858))
([53a7aa0](53a7aa0))
* **core:** Adds EC withSalt options
([#2126](#2126))
([67b6fb8](67b6fb8))
* **core:** enhance db configuration options
([#2285](#2285))
([ed9ff59](ed9ff59))
* **core:** New Key Index and Manager Plugin SPI
([#2095](#2095))
([eb446fc](eb446fc))
* **core:** support onConfigUpdate hook when registering services
([#1992](#1992))
([366d4dc](366d4dc))
* **core:** v2 ERS with proto updates
([#2210](#2210))
([a161ef8](a161ef8))
* **policy:** actions crud service endpoints and proto validation
([#2037](#2037))
([e933fa9](e933fa9))
* **policy:** actions service RPCs should actually hit storage layer
CRUD ([#2063](#2063))
([da4faf5](da4faf5))
* **policy:** add enhanced standard/custom actions protos
([#2020](#2020))
([bbac53f](bbac53f))
* **policy:** Add platform key indexer.
([#2189](#2189))
([861ef8d](861ef8d))
* **policy:** consume lib/identifier parse function
([#2181](#2181))
([1cef22b](1cef22b))
* **policy:** DSPX-1018 NDR retrieval by FQN support
([#2131](#2131))
([0001041](0001041))
* **policy:** DSPX-1057 registered resource action attribute values (DB
+ Service implementation)
([#2191](#2191))
([6bf1b2e](6bf1b2e))
* **policy:** DSPX-1057 registered resource action attribute values
(protos only) ([#2217](#2217))
([6375596](6375596))
* **policy:** DSPX-893 NDR define crud protos
([#2056](#2056))
([55a5c27](55a5c27))
* **policy:** DSPX-898 NDR database schema
([#2055](#2055))
([2a10a6a](2a10a6a))
* **policy:** DSPX-901 NDR database crud
([#2071](#2071))
([20e0a5f](20e0a5f))
* **policy:** DSPX-902 NDR service crud implementation (2/2)
([#2066](#2066))
([030ad33](030ad33))
* **policy:** DSPX-902 NDR service crud protos only (1/2)
([#2092](#2092))
([24b6cb5](24b6cb5))
* **policy:** Finish resource mapping groups
([#2224](#2224))
([5ff754e](5ff754e))
* **policy:** GetMatchedSubjectMappings should provide value FQN
([#2151](#2151))
([ad80044](ad80044))
* **policy:** key management crud
([#2110](#2110))
([4c3d53d](4c3d53d))
* **policy:** Key management proto
([#2115](#2115))
([561f853](561f853))
* **policy:** Modify get request to search for keys by kasid with keyid.
([#2147](#2147))
([780d2e4](780d2e4))
* **policy:** Restrict KAS deletion when tied to Key
([#2144](#2144))
([4c4ab13](4c4ab13))
* **policy:** Return KAS Key structure
([#2172](#2172))
([7f97b99](7f97b99))
* **policy:** rotate keys rpc
([#2180](#2180))
([0d00743](0d00743))
* **policy:** stored enhanced actions database migration, CRUD queries,
SM updates ([#2040](#2040))
([e6b7c79](e6b7c79))
* **sdk:** Add a KAS allowlist
([#2085](#2085))
([d7cfdf3](d7cfdf3))
* **sdk:** add nanotdf plaintext policy
([#2182](#2182))
([e5c56db](e5c56db))
* **sdk:** Use ConnectRPC in the go client
([#2200](#2200))
([fc34ee6](fc34ee6))


### Bug Fixes

* **core:** access pdp cleanup before actions in ABAC decisioning
([#2123](#2123))
([9b38a3c](9b38a3c))
* **core:** Autobump service
([#2080](#2080))
([006c724](006c724))
* **core:** Autobump service
([#2104](#2104))
([1f72cc7](1f72cc7))
* **core:** Autobump service
([#2108](#2108))
([be5b7d7](be5b7d7))
* **core:** bump to go 1.24 and bump service proto module dependencies
([#2064](#2064))
([94891a0](94891a0))
* **core:** Fix DPoP with grpc-gateway
([#2044](#2044))
([4483ef2](4483ef2))
* **core:** fix service go.mod
([#2141](#2141))
([3b98f6d](3b98f6d))
* **core:** Improves errors when under heavy load
([#2132](#2132))
([4490a14](4490a14))
* **core:** Let legacy KAOs use new trust plugins
([#2218](#2218))
([5aa6916](5aa6916))
* **core:** migrate from mitchellh/mapstructure to go-viper/mapstructure
([#2087](#2087))
([0a3a82e](0a3a82e))
* **core:** update viper to 1.20.1
([#2088](#2088))
([09099e9](09099e9))
* **core:** Updates vulnerable dep go/x/net
([#2072](#2072))
([11c02cd](11c02cd))
* **deps:** bump github.com/creasty/defaults from 1.7.0 to 1.8.0 in
/service ([#2242](#2242))
([86a9b46](86a9b46))
* **deps:** bump github.com/jackc/pgx/v5 from 5.5.5 to 5.7.5 in /service
([#2249](#2249))
([d8f3b67](d8f3b67))
* **deps:** bump the internal group across 1 directory with 2 updates
([#2296](#2296))
([7f92c70](7f92c70))
* **deps:** bump toolchain in /lib/fixtures and /examples to resolve CVE
GO-2025-3563 ([#2061](#2061))
([9c16843](9c16843))
* handle empty private and public key ctx structs
([#2272](#2272))
([f3fc647](f3fc647))
* **policy:** remove predefined rules in actions protos
([#2069](#2069))
([060f059](060f059))
* **policy:** return kas uri on keys for definition, namespace and
values ([#2186](#2186))
([6c55fb8](6c55fb8))
* update key_mode to provide more context
([#2226](#2226))
([44d0805](44d0805))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

Copilot code review Copilot Copilot left review comments

@jentfoo jentfoo jentfoo approved these changes

@pflynn-virtru pflynn-virtru pflynn-virtru approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@jakedoublev @ryanulit @jentfoo @pflynn-virtru