search

hashicorp / vault

A tool for secrets management, encryption as a service, and privileged access management
https://www.vaultproject.io/
Other
30.88k stars 4.17k forks source link

Open Policy Agent / Rego Authentication #10840

Open andyinabox opened 3 years ago

andyinabox commented 3 years ago

Is your feature request related to a problem? Please describe. I'm working on an updated cloud architecture for my org, and would like to utilize Open Policy Agent (OPA) and its Rego policy DSL throughout our infrastructure to define RBAC policies so they can remain centralized, platform-independent, and utilize an open standard.

Describe the solution you'd like Allow delegating authorization to an external authorizer, which could be OPA or any other authorization method. The external authorizer would be provded a JSON object that includes the path, token, and any other relevant information, and respond with either a :+1: or :-1:. I would imagine this could be implemented in a similar fashion to the authentication plugins.

Describe alternatives you've considered Maintain a separate set of policies specifically for Vault written in HCL (yuck)

HridoyRoy commented 3 years ago

Hi @andyinabox , Thanks for filing this issue. As far as I'm aware this feature is currently not on the roadmap. However, we'll raise this with Product and circle back. Thanks!

hixichen commented 2 years ago

very interesting feature. looking forward to different suggestions and feedback.