This message was deleted Permit #opal

Join Slack

This message was deleted.

# opal

Slackbot

06/13/2023, 1:57 PM

This message was deleted.

Amy Bertken

06/13/2023, 1:57 PM

Copy code

permit(
  principal in Role::"photographer",
  action in [Action::"read", Action::"create"],
  resource in ResourceType::"photos"
);

permit(
  principal in Role::"photographer",
  action in [Action::"read",Action::"create",Action::"update"],
  resource in ResourceType::"solutions"
);

This is the code in the single

.policy

file I'm trying to get to work. If I delete the second "permit", it works fine.

Raz Co

06/13/2023, 2:02 PM

Hey Amy, We’re looking forward to seeing how you explore OPAL + Cedar permit I’m taking a look on your specific use case and i’ll get back to you ASAP.

Gabriel L. Manor

06/13/2023, 2:02 PM

Hey, @Amy Bertken, I'm the creator of this repo, happy to see people getting around with it ☺️ Unfortunately, at this point OPAL supports only in one policy per file

👍 1

Gabriel L. Manor

06/13/2023, 2:03 PM

@Shaul Kremer and @Omer Zuarets can you expand on our roadmap around it? Can we open (or we already opened) an issue to add support in multiple policies in one file?

Omer Zuarets

06/13/2023, 2:27 PM

Hey, We currently have the one policy per file limitation, This is because in cedar, each permit / forbid policy has its own ID, in cedar-agent we use the file path as the policy id for the policy, these concepts currently conflicts with each other. We’ll open an issue for that and have discussion on how to solve it, but unfortunately this is currently not supported

👍 1

Omer Zuarets

06/13/2023, 3:03 PM

We are thinking about this solution: when creating a file with multiple policies the ids will be the the offset of the policy in the file prefixed with the file path, for example, If you have a file called

my_policy.cedar

that contains the following code

Copy code

permit(
  principal in Role::"photographer",
  action in [Action::"read", Action::"create"],
  resource in ResourceType::"photos"
);

permit(
  principal in Role::"photographer",
  action in [Action::"read",Action::"create",Action::"update"],
  resource in ResourceType::"solutions"
);

The ids will be

my_policy.cedar:0

and

my_policy.cedar:1

We are still thinking about the

delimiter and any edge cases but this is our current line of thinking. What do you think about it ? @Amy Bertken

Amy Bertken

06/13/2023, 3:22 PM

That makes sense to me! I like the

as the delimiter, but haven't worked with the policies enough to know any limitations that might present. For our work right now, I can't think of any. Thanks for walking me through this.

💜 1

Open in Slack

Previous Next