您现在的位置是：首页 > 文章详情

CoSec v1.10.0 发布，基于 RBAC 和策略的多租户响应式安全框架

日期：2023-01-08点击：251收藏

CoSec

基于 RBAC 和策略的多租户响应式安全框架。

Integration Test Status

更新内容（v1.10.0） 🎉 🎉 🎉

⭐ 更新内容

依赖：更新 io.opentelemetry:opentelemetry-bom 到 v1.22.0。
特性：新增 BoolConditionMatcher，Bool 条件匹配器，支持无限级嵌套，以增强条件匹配器语义。

  { "name": "AllowDeveloperOrIpRange", "effect": "allow", "actions": [ { "type": "all" } ], "condition": { "type": "bool", "bool": { "and": [ { "type": "authenticated" } ], "or": [ { "type": "in", "part": "context.principal.id", "in": [ "developerId" ] }, { "type": "path", "part": "request.remoteIp", "path": { "caseSensitive": false, "separator": ".", "decodeAndParseSegments": false }, "pattern": "192.168.0.*" } ] } } }

认证

Authentication-Flow

授权

Authorization-Flow

OAuth

OAuth-Flow

建模类图

Modeling

安全网关服务

Gateway

授权策略流程

Authorization Policy

内置策略匹配器

ActionMatcher

ConditionMatcher

策略 Schema

Policy Schema

策略 Demo

 { "id": "id", "name": "name", "category": "category", "description": "description", "type": "global", "tenantId": "tenantId", "statements": [ { "name": "Anonymous", "effect": "allow", "actions": [ { "type": "path", "pattern": "/auth/register" }, { "type": "path", "pattern": "/auth/login" } ] }, { "name": "UserScope", "effect": "allow", "actions": [ { "type": "path", "pattern": "/user/#{principal.id}/*" } ], "condition": { "type": "authenticated" } }, { "name": "Developer", "effect": "allow", "actions": [ { "type": "all" } ], "condition": { "type": "in", "part": "context.principal.id", "in": [ "developerId" ] } }, { "name": "RequestOriginDeny", "effect": "deny", "actions": [ { "type": "all" } ], "condition": { "type": "reg", "negate": true, "part": "request.origin", "pattern": "^(http|https)://github.com" } }, { "name": "IpBlacklist", "effect": "deny", "actions": [ { "type": "all" } ], "condition": { "type": "path", "part": "request.remoteIp", "path": { "caseSensitive": false, "separator": ".", "decodeAndParseSegments": false }, "pattern": "192.168.0.*" } }, { "name": "RegionWhitelist", "effect": "deny", "actions": [ { "type": "all" } ], "condition": { "negate": true, "type": "reg", "part": "request.attributes.ipRegion", "pattern": "^中国\\|0\\|(上海|广东省)\\|.*" } }, { "name": "AllowDeveloperOrIpRange", "effect": "allow", "actions": [ { "type": "all" } ], "condition": { "type": "bool", "bool": { "and": [ { "type": "authenticated" } ], "or": [ { "type": "in", "part": "context.principal.id", "in": [ "developerId" ] }, { "type": "path", "part": "request.remoteIp", "path": { "caseSensitive": false, "separator": ".", "decodeAndParseSegments": false }, "pattern": "192.168.0.*" } ] } } } ] }