Always do group expansion for CheckAccess subjects #3710
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
nwnt
requested review from
jewzaam,
bennerv,
hawkowl,
rogbas,
petrkotas,
jharrington22,
cblecker,
cadenmarchese,
UlrichSchlueter,
SudoBrendan,
yjst2012,
jaitaiwan,
anshulvermapatel,
hlipsig,
tiguelu,
SrinivasAtmakuri,
mociarain,
AldoFusterTurpin,
kimorris27 and
tsatam
as code owners
|
/azp run e2e,ci |
|
Azure Pipelines successfully started running 2 pipeline(s). |
nwnt
added
ready-for-review
next-up
next-release
weinong
reviewed
Jul 20, 2024
|
/azp run ci |
|
Azure Pipelines successfully started running 1 pipeline(s). |
mociarain
previously approved these changes
Jul 22, 2024
weinong
requested changes
Jul 22, 2024
nwnt
force-pushed
the
nwnt/add-checkaccess-group-expansion
branch
from
96f6be1
to
e20b612
Compare
|
/azp run ci,e2e |
|
Azure Pipelines successfully started running 2 pipeline(s). |
Comment on lines
+20
to
+26
|
|
||
| // GroupExpansion is the value to be used with ClaimName in SubjectAttributes | ||
| // This value gives CheckAccess a hint that it needs to retrieve all the groups the principal belongs to | ||
| // and then give the response based on all group entitlements. | ||
| // | ||
| // https://eng.ms/docs/microsoft-security/identity/auth/access-control-managed-identityacmi/azure-authz-data-plane/authz-dataplane-partner-wiki/remotepdp/checkaccess/samples/requestresponse | ||
| GroupExpansion = `{"groups":"src1"}` |
There was a problem hiding this comment.
@nwnt Also, thanks a lot for the pointers to the docs as sometimes that kind of info is not easy to find. 🙂
AldoFusterTurpin
approved these changes
Jul 22, 2024
mociarain
approved these changes
Jul 23, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Which issue this PR addresses:
Fixes: ARO-9261
What this PR does / why we need it:
Refer to the IcM in JIRA, CheckAccess team informed that we need to send an additional field to give hints to CheckAccess that "group expansion" is needed.
Without group expansion, CheckAccess will not take into account what groups the principal belongs to. That is, if a service principal A is a member of group B, and group B allows writing to a VNet, calling CheckAccess without the group expansion field will return a response that A is not allowed to write to a VNet. With the group expansion hint, CheckAccess will return an allowed response, which is the behavior we want.
Test plan for issue:
I reproduced this by creating a Deny Assignment on a VNet resource from Azure Blueprint and made a group excluded from it. The testing app principal is then added to the group. After that I verified the following 2 scenarios:
Request (notice the lack of the new _Claim_Name field in Subject)
{ "Subject": { "Attributes": { "ObjectId": "69f8005a-36fe-4aa7-b161-c435d34133ad" } }, "Actions": [ { "Id": "Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write", "Attributes": null }, { "Id": "Microsoft.Network/virtualNetworks/join/action", "Attributes": {} }, { "Id": "Microsoft.Network/virtualNetworks/read", "Attributes": {} }, { "Id": "Microsoft.Network/virtualNetworks/write", "Attributes": {} }, { "Id": "Microsoft.Network/virtualNetworks/subnets/join/action", "Attributes": {} }, { "Id": "Microsoft.Network/virtualNetworks/subnets/read", "Attributes": {} }, { "Id": "Microsoft.Network/virtualNetworks/subnets/write", "Attributes": {} } ], "Resource": { "Id": "/subscriptions/60bf318d-6914-4105-a3b5-d0d2c10388c8/resourceGroups/nont-test-assignment/providers/Microsoft.Network/virtualNetworks/net-wgssmdvlnix4m", "Attributes": {} }, "Environment": { "Attributes": null } }Response (Notice that some actions were reported as denied)
{ "value": [ { "accessDecision": "Denied", "actionId": "Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write", "isDataAction": false, "roleAssignment": null, "denyAssignment": { "isSystemProtected": true, "id": "d778a6b1157f2abbbe280825f36196f1", "name": "", "description": "", "permissions": [ { "actions": [ "*" ], "notActions": [ "Microsoft.Authorization/locks/delete", "*/read", "Microsoft.Network/virtualNetworks/subnets/join/action" ], "dataActions": [], "notDataActions": [], "condition": "", "conditionVersion": "" } ], "scope": "/subscriptions/60bf318d-6914-4105-a3b5-d0d2c10388c8/resourceGroups/nont-test-assignment/providers/Microsoft.Network/virtualNetworks/net-wgssmdvlnix4m", "doNotApplyToChildScopes": false, "principals": [ { "id": "00000000000000000000000000000000", "type": "SystemDefined" } ], "excludePrincipals": [ { "id": "864512b599134a29b4c9ea8d1117f181", "type": "ServicePrincipal" }, { "id": "1cae329ebf0b4456b8d4d74b1c5e7077", "type": "Group" } ], "condition": "", "conditionVersion": "", "effect": null }, "timeToLiveInMs": 60000 }, { "accessDecision": "Denied", "actionId": "Microsoft.Network/virtualNetworks/join/action", "isDataAction": false, "roleAssignment": null, "denyAssignment": { "isSystemProtected": true, "id": "d778a6b1157f2abbbe280825f36196f1", "name": "", "description": "", "permissions": [ { "actions": [ "*" ], "notActions": [ "Microsoft.Authorization/locks/delete", "*/read", "Microsoft.Network/virtualNetworks/subnets/join/action" ], "dataActions": [], "notDataActions": [], "condition": "", "conditionVersion": "" } ], "scope": "/subscriptions/60bf318d-6914-4105-a3b5-d0d2c10388c8/resourceGroups/nont-test-assignment/providers/Microsoft.Network/virtualNetworks/net-wgssmdvlnix4m", "doNotApplyToChildScopes": false, "principals": [ { "id": "00000000000000000000000000000000", "type": "SystemDefined" } ], "excludePrincipals": [ { "id": "864512b599134a29b4c9ea8d1117f181", "type": "ServicePrincipal" }, { "id": "1cae329ebf0b4456b8d4d74b1c5e7077", "type": "Group" } ], "condition": "", "conditionVersion": "", "effect": null }, "timeToLiveInMs": 60000 }, { "accessDecision": "Allowed", "actionId": "Microsoft.Network/virtualNetworks/read", "isDataAction": false, "roleAssignment": { "delegatedManagedIdentityResourceId": "", "id": "f7268f5c440747728341363f5446d35f", "roleDefinitionId": "b24988ac618042a0ab8820f7382dd24c", "principalId": "69f8005a36fe4aa7b161c435d34133ad", "principalType": "ServicePrincipal", "scope": "/subscriptions/60bf318d-6914-4105-a3b5-d0d2c10388c8", "condition": "", "conditionVersion": "", "canDelegate": false, "description": "" }, "denyAssignment": null, "timeToLiveInMs": 60000 }, { "accessDecision": "Denied", "actionId": "Microsoft.Network/virtualNetworks/write", "isDataAction": false, "roleAssignment": null, "denyAssignment": { "isSystemProtected": true, "id": "d778a6b1157f2abbbe280825f36196f1", "name": "", "description": "", "permissions": [ { "actions": [ "*" ], "notActions": [ "Microsoft.Authorization/locks/delete", "*/read", "Microsoft.Network/virtualNetworks/subnets/join/action" ], "dataActions": [], "notDataActions": [], "condition": "", "conditionVersion": "" } ], "scope": "/subscriptions/60bf318d-6914-4105-a3b5-d0d2c10388c8/resourceGroups/nont-test-assignment/providers/Microsoft.Network/virtualNetworks/net-wgssmdvlnix4m", "doNotApplyToChildScopes": false, "principals": [ { "id": "00000000000000000000000000000000", "type": "SystemDefined" } ], "excludePrincipals": [ { "id": "864512b599134a29b4c9ea8d1117f181", "type": "ServicePrincipal" }, { "id": "1cae329ebf0b4456b8d4d74b1c5e7077", "type": "Group" } ], "condition": "", "conditionVersion": "", "effect": null }, "timeToLiveInMs": 60000 }, { "accessDecision": "Allowed", "actionId": "Microsoft.Network/virtualNetworks/subnets/join/action", "isDataAction": false, "roleAssignment": { "delegatedManagedIdentityResourceId": "", "id": "f7268f5c440747728341363f5446d35f", "roleDefinitionId": "b24988ac618042a0ab8820f7382dd24c", "principalId": "69f8005a36fe4aa7b161c435d34133ad", "principalType": "ServicePrincipal", "scope": "/subscriptions/60bf318d-6914-4105-a3b5-d0d2c10388c8", "condition": "", "conditionVersion": "", "canDelegate": false, "description": "" }, "denyAssignment": null, "timeToLiveInMs": 60000 }, { "accessDecision": "Allowed", "actionId": "Microsoft.Network/virtualNetworks/subnets/read", "isDataAction": false, "roleAssignment": { "delegatedManagedIdentityResourceId": "", "id": "f7268f5c440747728341363f5446d35f", "roleDefinitionId": "b24988ac618042a0ab8820f7382dd24c", "principalId": "69f8005a36fe4aa7b161c435d34133ad", "principalType": "ServicePrincipal", "scope": "/subscriptions/60bf318d-6914-4105-a3b5-d0d2c10388c8", "condition": "", "conditionVersion": "", "canDelegate": false, "description": "" }, "denyAssignment": null, "timeToLiveInMs": 60000 }, { "accessDecision": "Denied", "actionId": "Microsoft.Network/virtualNetworks/subnets/write", "isDataAction": false, "roleAssignment": null, "denyAssignment": { "isSystemProtected": true, "id": "d778a6b1157f2abbbe280825f36196f1", "name": "", "description": "", "permissions": [ { "actions": [ "*" ], "notActions": [ "Microsoft.Authorization/locks/delete", "*/read", "Microsoft.Network/virtualNetworks/subnets/join/action" ], "dataActions": [], "notDataActions": [], "condition": "", "conditionVersion": "" } ], "scope": "/subscriptions/60bf318d-6914-4105-a3b5-d0d2c10388c8/resourceGroups/nont-test-assignment/providers/Microsoft.Network/virtualNetworks/net-wgssmdvlnix4m", "doNotApplyToChildScopes": false, "principals": [ { "id": "00000000000000000000000000000000", "type": "SystemDefined" } ], "excludePrincipals": [ { "id": "864512b599134a29b4c9ea8d1117f181", "type": "ServicePrincipal" }, { "id": "1cae329ebf0b4456b8d4d74b1c5e7077", "type": "Group" } ], "condition": "", "conditionVersion": "", "effect": null }, "timeToLiveInMs": 60000 } ], "nextLink": null }Request (Notice the additional field in Subject)
{ "Subject": { "Attributes": { "ObjectId": "69f8005a-36fe-4aa7-b161-c435d34133ad", "_claim_names": "{\"groups\":\"ENGORGIO~!\"}" } }, "Actions": [ { "Id": "Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write", "Attributes": null }, { "Id": "Microsoft.Network/virtualNetworks/join/action", "Attributes": {} }, { "Id": "Microsoft.Network/virtualNetworks/read", "Attributes": {} }, { "Id": "Microsoft.Network/virtualNetworks/write", "Attributes": {} }, { "Id": "Microsoft.Network/virtualNetworks/subnets/join/action", "Attributes": {} }, { "Id": "Microsoft.Network/virtualNetworks/subnets/read", "Attributes": {} }, { "Id": "Microsoft.Network/virtualNetworks/subnets/write", "Attributes": {} } ], "Resource": { "Id": "/subscriptions/60bf318d-6914-4105-a3b5-d0d2c10388c8/resourceGroups/nont-test-assignment/providers/Microsoft.Network/virtualNetworks/net-wgssmdvlnix4m", "Attributes": {} }, "Environment": { "Attributes": null } }Response (all actions are allowed)
{ "value": [ { "accessDecision": "Allowed", "actionId": "Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write", "isDataAction": false, "roleAssignment": { "delegatedManagedIdentityResourceId": "", "id": "f7268f5c440747728341363f5446d35f", "roleDefinitionId": "b24988ac618042a0ab8820f7382dd24c", "principalId": "69f8005a36fe4aa7b161c435d34133ad", "principalType": "ServicePrincipal", "scope": "/subscriptions/60bf318d-6914-4105-a3b5-d0d2c10388c8", "condition": "", "conditionVersion": "", "canDelegate": false, "description": "" }, "denyAssignment": null, "timeToLiveInMs": 60000 }, { "accessDecision": "Allowed", "actionId": "Microsoft.Network/virtualNetworks/join/action", "isDataAction": false, "roleAssignment": { "delegatedManagedIdentityResourceId": "", "id": "f7268f5c440747728341363f5446d35f", "roleDefinitionId": "b24988ac618042a0ab8820f7382dd24c", "principalId": "69f8005a36fe4aa7b161c435d34133ad", "principalType": "ServicePrincipal", "scope": "/subscriptions/60bf318d-6914-4105-a3b5-d0d2c10388c8", "condition": "", "conditionVersion": "", "canDelegate": false, "description": "" }, "denyAssignment": null, "timeToLiveInMs": 60000 }, { "accessDecision": "Allowed", "actionId": "Microsoft.Network/virtualNetworks/read", "isDataAction": false, "roleAssignment": { "delegatedManagedIdentityResourceId": "", "id": "f7268f5c440747728341363f5446d35f", "roleDefinitionId": "b24988ac618042a0ab8820f7382dd24c", "principalId": "69f8005a36fe4aa7b161c435d34133ad", "principalType": "ServicePrincipal", "scope": "/subscriptions/60bf318d-6914-4105-a3b5-d0d2c10388c8", "condition": "", "conditionVersion": "", "canDelegate": false, "description": "" }, "denyAssignment": null, "timeToLiveInMs": 60000 }, { "accessDecision": "Allowed", "actionId": "Microsoft.Network/virtualNetworks/write", "isDataAction": false, "roleAssignment": { "delegatedManagedIdentityResourceId": "", "id": "f7268f5c440747728341363f5446d35f", "roleDefinitionId": "b24988ac618042a0ab8820f7382dd24c", "principalId": "69f8005a36fe4aa7b161c435d34133ad", "principalType": "ServicePrincipal", "scope": "/subscriptions/60bf318d-6914-4105-a3b5-d0d2c10388c8", "condition": "", "conditionVersion": "", "canDelegate": false, "description": "" }, "denyAssignment": null, "timeToLiveInMs": 60000 }, { "accessDecision": "Allowed", "actionId": "Microsoft.Network/virtualNetworks/subnets/join/action", "isDataAction": false, "roleAssignment": { "delegatedManagedIdentityResourceId": "", "id": "f7268f5c440747728341363f5446d35f", "roleDefinitionId": "b24988ac618042a0ab8820f7382dd24c", "principalId": "69f8005a36fe4aa7b161c435d34133ad", "principalType": "ServicePrincipal", "scope": "/subscriptions/60bf318d-6914-4105-a3b5-d0d2c10388c8", "condition": "", "conditionVersion": "", "canDelegate": false, "description": "" }, "denyAssignment": null, "timeToLiveInMs": 60000 }, { "accessDecision": "Allowed", "actionId": "Microsoft.Network/virtualNetworks/subnets/read", "isDataAction": false, "roleAssignment": { "delegatedManagedIdentityResourceId": "", "id": "f7268f5c440747728341363f5446d35f", "roleDefinitionId": "b24988ac618042a0ab8820f7382dd24c", "principalId": "69f8005a36fe4aa7b161c435d34133ad", "principalType": "ServicePrincipal", "scope": "/subscriptions/60bf318d-6914-4105-a3b5-d0d2c10388c8", "condition": "", "conditionVersion": "", "canDelegate": false, "description": "" }, "denyAssignment": null, "timeToLiveInMs": 60000 }, { "accessDecision": "Allowed", "actionId": "Microsoft.Network/virtualNetworks/subnets/write", "isDataAction": false, "roleAssignment": { "delegatedManagedIdentityResourceId": "", "id": "f7268f5c440747728341363f5446d35f", "roleDefinitionId": "b24988ac618042a0ab8820f7382dd24c", "principalId": "69f8005a36fe4aa7b161c435d34133ad", "principalType": "ServicePrincipal", "scope": "/subscriptions/60bf318d-6914-4105-a3b5-d0d2c10388c8", "condition": "", "conditionVersion": "", "canDelegate": false, "description": "" }, "denyAssignment": null, "timeToLiveInMs": 60000 } ], "nextLink": null }Is there any documentation that needs to be updated for this PR?
N/A - the code should be clear enough.
How do you know this will function as expected in production?
E2E tests should be enough.