https://linen.dev logo
Join Slack
Powered by
Hi, I have a requirement whereby the access grante...
# permit-saas
s
Hi, I have a requirement whereby the access granted, to a user, by a ReBAC resource role takes precedence over the access granted by an ABAC condition set. Can this be remedied by a custom policy and how?
a
Hi @Shyamalan Chemmery, I'm an AI assistant for Permit.io. I'll analyze available sources and get back to you shortly.
Yes, you can use custom policies to control the precedence of ReBAC resource roles over ABAC conditions. Permit.io's default configuration evaluates all policy types (RBAC, ABAC, ReBAC, and custom) with an 
or
operator, meaning access is granted if any one policy returns true (1) (2) . To make ReBAC take precedence, you'll need to modify the evaluation logic in the 
root.rego
file. The default configuration has separate allow blocks (1) :
Copy code
allow {
   policies.allow
}
allow {
   custom.allow
}
You can change this to enforce custom logic by combining them with an 
and
operator :
Copy code
allow {
    policies.allow
    custom.allow
}
In your 
custom.rego
file, you can then implement logic that checks which policy sources are allowing access. Here's how you can access the allowing sources :
Copy code
package permit.custom

import <http://future.keywords.in|future.keywords.in>
import data.permit.policies
import data.permit.rbac

default allow := false

allow {
 not "rbac" in policies.__allow_sources
}
The 
policies.__allow_sources
contains information about which policy configurations (RBAC, ABAC, ReBAC) are granting access . You can use this to create custom logic that prioritizes ReBAC decisions over ABAC. For debugging your custom policy, you can use the print function to see the allowing policies in PDP logs :
Copy code
print(policies.__allow_sources)
This approach allows you to override Permit's default "any policy allows" behavior and implement your specific precedence requirement where ReBAC resource roles take priority over ABAC conditions.
To learn more, see the sources I considered: [[1] Write Custom Policies](https://docs.permit.io/integrations/gitops/custom_policy) [[2] Beyond RBAC: When standard models just aren’t enough](https://www.permit.io/blog/custom-policies)
a
Hey @Shyamalan Chemmery , does the AI’s answer make sense?
s
Thanks for reaching out @Alon Boshi . It makes sense, but the evaluation context that I can access in custom policies, does not help. The audit log for "reply" access granted via ABAC is given below { "__data_use_debugger": true, "__input_use_debugger": true, "allow": true, "allowing_sources": [ "abac" ], "debug": { "abac": { "allow": true, "allowing_rules": [ { "resourceset": "resourceset_Company_5fdistributed_5fMO", "userset": "userset_Trade_5fuser" } ], "code": "allow", "reason": "user 'michal@shell.com' matched 'userset_Trade_5fuser' userset conditions, the given resource matched the 'resourceset_Company_5fdistributed_5fMO' resourceset conditions, users matching 'userset_Trade_5fuser' userset conditions has the 'reply' permission on resources of type 'market_order' matching 'resourceset_Company_5fdistributed_5fMO' resourceset conditions" }, "custom": { "allow": true, "code": "custom_policy" }, "request": { "action": "reply", "resource": { "attributes": { "DistributedCompanies": [ "Shell" ], "Quantity": 10000, "ViewOnlyUsers": [ "michal@shell.com" ], "type": "market_order" }, "type": "market_order" }, "tenant": "default", "user": { "attributes": { "company": "Shell", "email": "michal@shell.com", "key": "michal@shell.com", "roles": [ "Trade" ], "tenants": [ "default" ] }, "email": "", "first_name": "", "key": "michal@shell.com", "last_name": "", "synced": true } } }, "debugger_activated": true, "bulk_decision_id": "f54ab435-f9a1-48b3-a350-6e26071ec306" } And the log for "readonly" access granted via ABAC & ReBAC is given below... { "__data_use_debugger": true, "__input_use_debugger": true, "allow": true, "allowing_sources": [ "abac", "rebac" ], "debug": { "abac": { "allow": true, "allowing_rules": [ { "resourceset": "resourceset_Company_5fdistributed_5fMO", "userset": "userset_Trade_5fuser" } ], "code": "allow", "reason": "user 'michal@shell.com' matched 'userset_Trade_5fuser' userset conditions, the given resource matched the 'resourceset_Company_5fdistributed_5fMO' resourceset conditions, users matching 'userset_Trade_5fuser' userset conditions has the 'readonly' permission on resources of type 'market_order' matching 'resourceset_Company_5fdistributed_5fMO' resourceset conditions" }, "custom": { "allow": true, "code": "custom_policy" }, "rebac": { "allow": true, "allowing_roles": [ { "reason": "granted by 'market_order:antoin01#viewer'", "resource": "market_order:antoin01", "role": "market_order#viewer", "sources": [ { "type": "role_assignment" } ] } ], "code": "allow", "reason": "user 'michal@shell.com' has the 'readonly' permission on resource 'market_order:antoin01' in tenant 'default', granted by 'market_order:antoin01#viewer'" }, "request": { "action": "readonly", "resource": { "attributes": { "DistributedCompanies": [ "Shell" ], "Quantity": 10000, "ViewOnlyUsers": [ "michal@shell.com" ], "type": "market_order" }, "type": "market_order" }, "tenant": "default", "user": { "attributes": { "company": "Shell", "email": "michal@shell.com", "key": "michal@shell.com", "roles": [ "Trade" ], "tenants": [ "default" ] }, "email": "", "first_name": "", "key": "michal@shell.com", "last_name": "", "synced": true } } }, "debugger_activated": true, "bulk_decision_id": "f54ab435-f9a1-48b3-a350-6e26071ec306" } The ask is to deny the "reply" access, on account of user belonging to a company, and grant the "readonly" access given to the user directly.
The problem is that in the evaluation context of decision granting the "reply" access (via the company) I am not able to determine whether the user has any direct access granted (i.e. "readonly" in this case)
a
@Shyamalan Chemmery, will circle back to you soon
👍 1
"reason": "user 'michal@shell.com' has the 'readonly' permission on resource 'market_order:antoin01' in tenant 'default', granted by 'market_order:antoin01#viewer'"
See this, and you added 
"custom": {
"allow": true,
"code": "custom_policy"
So you can manage your custom policy to handle your needs
Open in Slack
PreviousNext
Powered by