Commit Graph

30 Commits

Author SHA1 Message Date
Thales Macedo Garitezi
42cb17360e Merge branch 'release-57' into sync-r57-m-20240430 2024-04-30 14:42:22 -03:00
Ilya Averyanov
aaf57ecfbc chore(authz): improve and clarify types 2024-04-26 12:09:18 +03:00
zmstone
01923147a2 fix(variform and authz): do not initialize empty client_attrs field
when client_attrs_init expression renders to empty string,
do not initialize the attribute.

also fixed an ACL error: a template render failure for a topic
would stop the ACL checks for the following topics if more
than one topic is configured.
2024-04-25 17:32:07 +02:00
zmstone
22838f027a fix: mountpoint template render should not replace unknown as undefined
For backward compatibility, the unknown vars used in mountpoint
is kept unchanged.
e.g. '${unknown}/foo/bar' should be rendered as '${unknown}/foo/bar'
but not 'undefined/foo/bar'
2024-03-23 10:16:05 +01:00
zmstone
0cf61932b6 feat: allow using client_attrs in authentication templates 2024-03-23 10:16:05 +01:00
zmstone
9ec99fef4a feat: allow client_attr used in authz rules 2024-03-23 10:16:02 +01:00
Zaiming (Stone) Shi
5af01c041b
Merge pull request #12559 from zmstone/0221-refactor-use-atom-fileds
refactor: use atoms for root config fields
2024-02-23 14:38:19 +01:00
Zaiming (Stone) Shi
46877e979b chore: update copyright-year 2024-02-23 08:21:06 +01:00
Zaiming (Stone) Shi
88b1d9ba88 refactor: use atoms for root config fields and types 2024-02-22 16:51:40 +01:00
JimMoen
ba1d24d054
test(prom_api): '/prometheus/auth' and '/prometheus/data_integration' 2024-02-18 02:32:25 +08:00
Zaiming (Stone) Shi
f57f617ba3 refactor(schema): ensure roots/0 and namespace/0 for all schema modules 2024-02-16 11:35:32 +01:00
Serge Tupchii
7272ef25d4 feat(emqx_auth): implement API to re-order all authenticators/authz sources
Fixes: EMQX-11770
2024-02-14 14:35:46 +02:00
Zaiming (Stone) Shi
2be898ca4d refactor(auth/jwt): support raw rules from jwt acl claim 2023-12-19 08:10:38 +01:00
Zaiming (Stone) Shi
a9963e043b refactor(authz): improve logging
Move authz result logging to common place.

Prior to this change, the final result is not logged when
fallback to the default authorization.no_match config value.

Aso, if the result is provided by a hook callback,
it's also not logged.

After this change, only the final result is logged.
The authz chain resutls can be traced (or logged at debug level).
2023-12-17 22:32:26 +01:00
Zaiming (Stone) Shi
ddbb8560fa fix(dialyzer): batch 2 2023-12-08 17:59:55 +01:00
Zaiming (Stone) Shi
1b2c052646 docs: add type namespaces 2023-11-22 13:12:35 +01:00
Zaiming (Stone) Shi
86110824eb feat: upgrade hocon to 0.40.0 which supports union type display name 2023-11-10 13:41:51 +01:00
Andrew Mayorov
8e4585d64f
chore: move template modules to emqx_utils
Even though most of the time these modules will be used by
connectors, there are exceptions (namely, `emqx_rule_engine`).
Besides, they are general enough to land there, more so given
that `emqx_placeholder` is already there.
2023-11-02 17:11:12 +07:00
Andrew Mayorov
343b679741
feat(tpl): make escaping mechanism more foolproof
Treat "${$}" as literal "$". This allows to template express
strings, for example, of the form "${some_var_value}" where
`some_var_value` is interpolated from bindings.
2023-11-02 17:11:11 +07:00
Andrew Mayorov
a9693eada7
fix(tpl): rename trivial -> is_const
This is clearer. Former naming was a bit misleading.
2023-11-02 17:11:11 +07:00
Andrew Mayorov
49fba40ee7
fix(tpl): ensure backward compat with authz / authn templates
This commit leans heavy into discouraging the former approach where
only part of placeholders were interpolated, depending on `placeholders`
option.
2023-11-02 17:11:10 +07:00
Andrew Mayorov
49f5325c67
feat(tpl): unify validations / errors var representations 2023-11-02 17:11:10 +07:00
Andrew Mayorov
0538a77700
feat(tpl): use emqx_connector_template in emqx_authn, emqx_authz
This slightly changes semantics: now the attempt to create authenticator
with illegal bindings in templates will fail, instead of treating them
as literals. The runtime behaviour on the other hand should be the same.
2023-11-02 17:11:10 +07:00
Stefan Strigler
4e0e755b28 fix: return 404 if built_in_database not configured as auth source 2023-10-23 16:26:41 +02:00
Zaiming (Stone) Shi
6eb3bb7cff Merge remote-tracking branch 'origin/release-53' into 1114-sync-release-53 2023-10-14 10:16:38 +02:00
Ilya Averyanov
4ecd5e17a2 chore(authz): trace non-resultative authz calls to backend modules 2023-10-12 12:29:39 +03:00
Ilya Averyanov
03ae5bf3c8 chore(auth): cleanup code 2023-10-11 13:13:50 +03:00
Ilya Averyanov
5dff36474d chore(auth): get rid of hardcoded schema modules in auth 2023-10-05 13:41:50 +03:00
Ilya Averyanov
c2c56ba481 chore(auth): update tests 2023-10-05 13:41:50 +03:00
Ilya Averyanov
1eb75b43c4 chore(auth): split emqx_authn and emqx_authz apps 2023-10-05 13:41:50 +03:00