RBAC（角色权限管理）介绍，以及在kong网关中的使用

RBAC（角色权限管理）介绍，以及在kong网关中的使用

原文链接：https://blog.csdn.net/weixin_44259356/article/details/99675040
最近公司网关开发有权限认证要求，偶然发现了RBAC，这个思想还不错，特此记录。注意企业级的kong才有RBAC

1RBAC介绍

这篇文章不错的介绍了RBAC，就不多做阐述了。

2RBAC在kong网关中的使用参考

官方文档链接：https://docs.konghq.com/enterprise/0.35-x/admin-api/rbac/examples/#entity-level-rbac-a-primer

创建实体级权限

管理员A为临时用户qux创建角色：

http :8001/teamA/rbac/roles name=qux-role Kong-Admin-Token:n5bhjgv0speXp4N7rSUzUj8PGnl3F5eG
{
  "name": "qux-role",
  "created_at": 1531065975000,
  "id": "ffe93269-7993-4308-965e-0286d0bc87b9"
}

我们假设存在以下实体：

服务：

http :8001/teamA/services Kong-Admin-Token:n5bhjgv0speXp4N7rSUzUj8PGnl3F5eG
{
  "next": null,
  "data": [
    {
      "host": "httpbin.org",
      "created_at": 1531066074,
      "connect_timeout": 60000,
      "id": "3ed24101-19a7-4a0b-a10f-2f47bcd4ff43",
      "protocol": "http",
      "name": "service1",
      "read_timeout": 60000,
      "port": 80,
      "path": null,
      "updated_at": 1531066074,
      "retries": 5,
      "write_timeout": 60000
    }
  ]
}

和通往该服务的途径：

http :8001/teamA/routes Kong-Admin-Token:n5bhjgv0speXp4N7rSUzUj8PGnl3F5eG
{
  "next": null,
  "data": [
    {
      "created_at": 1531066253,
      "id": "d25afc46-dc59-48b2-b04f-d3ebe19f6d4b",
      "hosts": null,
      "updated_at": 1531066253,
      "preserve_host": false,
      "regex_priority": 0,
      "service": {
        "id": "3ed24101-19a7-4a0b-a10f-2f47bcd4ff43"
      },
      "paths": [
        "/anything"
      ],
      "methods": null,
      "strip_path": false,
      "protocols": [
        "http",
        "https"
      ]
    }
  ]
}

管理员A以qux-role创建实体权限：

添加service1-其ID为3ed24101-19a7-4a0b-a10f-2f47bcd4ff43：

http :8001/teamA/rbac/roles/qux-role/entities entity_id=3ed24101-19a7-4a0b-a10f-2f47bcd4ff43 actions=read Kong-Admin-Token:n5bhjgv0speXp4N7rSUzUj8PGnl3F5eG
{
  "created_at": 1531066684000,
  "role_id": "ffe93269-7993-4308-965e-0286d0bc87b9",
  "entity_id": "3ed24101-19a7-4a0b-a10f-2f47bcd4ff43",
  "negative": false,
  "entity_type": "services",
  "actions": [
    "read"
  ]
}

添加ID为d25afc46-dc59-48b2-b04f-d3ebe19f6d4b的路由：

http :8001/teamA/rbac/roles/qux-role/entities entity_id=d25afc46-dc59-48b2-b04f-d3ebe19f6d4b actions=read Kong-Admin-Token:n5bhjgv0speXp4N7rSUzUj8PGnl3F5eG
{
  "created_at": 1531066728000,
  "role_id": "ffe93269-7993-4308-965e-0286d0bc87b9",
  "entity_id": "d25afc46-dc59-48b2-b04f-d3ebe19f6d4b",
  "negative": false,
  "entity_type": "routes",
  "actions": [
    "read"
  ]
}

管理员A为他的角色添加了qux：

http :8001/teamA/rbac/users/qux/roles roles=qux-role Kong-Admin-Token:n5bhjgv0speXp4N7rSUzUj8PGnl3F5eG
{
  "roles": [
    {
      "comment": "Default user role generated for qux",
      "created_at": 1531065373000,
      "name": "qux",
      "id": "31614171-4174-42b4-9fae-43c9ce14830f"
    },
    {
      "created_at": 1531065975000,
      "name": "qux-role",
      "id": "ffe93269-7993-4308-965e-0286d0bc87b9"
    }
  ],
  "user": {
    "created_at": 1531065373000,
    "id": "4d87bf78-5824-4756-b0d0-ceaa9bd9b2d5",
    "name": "qux",
    "enabled": true,
    "user_token": "sUnv6uBehM91amYRNWESsgX3HzqoBnR5"
  }
}

检查权限列出：

http :8001/teamA/rbac/users/qux/permissions Kong-Admin-Token:n5bhjgv0speXp4N7rSUzUj8PGnl3F5eG
{
  "entities": {
    "d25afc46-dc59-48b2-b04f-d3ebe19f6d4b": {
      "actions": [
        "read"
      ],
      "negative": false
    },
    "3ed24101-19a7-4a0b-a10f-2f47bcd4ff43": {
      "actions": [
        "read"
      ],
      "negative": false
    }
  },
  "endpoints": {}
}

也就是说，2个实体权限，没有端点权限。

管理员A完成设置qux，现在qux可以使用他的用户令牌通过Kong的管理API读取他的两个实体。

我们假设Admin A 启用了实体级强制执行。请注意，由于qux 没有端点级权限，如果启用了端点和实体级强制，他将无法读取其实体 - 端点级验证在实体级之前。

qux尝试列出所有RBAC用户

http :8001/teamA/rbac/users/ Kong-Admin-Token:sUnv6uBehM91amYRNWESsgX3HzqoBnR5
{
  "message": "qux, you do not have permissions to read this resource"
}

qux尝试列出所有工作区

http :8001/teamA/rbac/workspaces/ Kong-Admin-Token:sUnv6uBehM91amYRNWESsgX3HzqoBnR5
{
  "message": "qux, you do not have permissions to read this resource"
}

qux尝试访问service1

http :8001/teamA/services/service1 Kong-Admin-Token:sUnv6uBehM91amYRNWESsgX3HzqoBnR5
{
  "host": "httpbin.org",
  "created_at": 1531066074,
  "connect_timeout": 60000,
  "id": "3ed24101-19a7-4a0b-a10f-2f47bcd4ff43",
  "protocol": "http",
  "name": "service1",
  "read_timeout": 60000,
  "port": 80,
  "path": null,
  "updated_at": 1531066074,
  "retries": 5,
  "write_timeout": 60000
}

同样，他可以访问他的路线：

http :8001/teamA/routes/3ed24101-19a7-4a0b-a10f-2f47bcd4ff43 Kong-Admin-Token:sUnv6uBehM91amYRNWESsgX3HzqoBnR5
{
  "created_at": 1531066253,
  "strip_path": false,
  "hosts": null,
  "preserve_host": false,
  "regex_priority": 0,
  "updated_at": 1531066253,
  "paths": [
    "/anything"
  ],
  "service": {
    "id": "3ed24101-19a7-4a0b-a10f-2f47bcd4ff43"
  },
  "methods": null,
  "protocols": [
    "http",
    "https"
  ],
  "id": "d25afc46-dc59-48b2-b04f-d3ebe19f6d4b"
}