opentdf / platform

Persistent data centric security that extends owner control wherever data travels
BSD 3-Clause Clear License
18 stars 10 forks source link

Autoconfigure granter validation regex is out of sync with valid policy FQNs #1232

Closed jakedoublev closed 2 months ago

jakedoublev commented 3 months ago

Background

The internal autoconfigure lib contains regex to validate an attribute FQN: https://github.com/opentdf/platform/blob/64798bec1107e379b1a75d2d1b9e14b0fbafb8d3/sdk/internal/autoconfigure/granter.go#L94-L96

https://github.com/opentdf/platform/blob/64798bec1107e379b1a75d2d1b9e14b0fbafb8d3/sdk/internal/autoconfigure/granter.go#L118

This is out of sync with the policy protos for valid namespaces, attributes, and values. Namespace: https://github.com/opentdf/platform/blob/main/service/policy/namespaces/namespaces.proto#L40 Attribute name: https://github.com/opentdf/platform/blob/main/service/policy/attributes/attributes.proto#L55 Value value: https://github.com/opentdf/platform/blob/main/service/policy/attributes/attributes.proto#L132

If the namespace has a hyphen (i.e. https://test-example.com), which is valid from a policy API perspective, creation/encryption of a NanoTDF succeeds, but subsequently fails with service logs:

{"time":"2024-07-31T00:36:03.161157578Z","level":"INFO","msg":"no DPoP key provided","namespace":"kas"}
{"time":"2024-07-31T00:36:03.162621086Z","level":"ERROR","msg":"FQN must specify a valid value and be of format 'https://<namespace>/attr/<attribute name>/value/<value>'","error":"ErrFqnMissingValue: FQN must include a value","fqns":"[]"}
{"time":"2024-07-31T00:36:03.162714112Z","level":"ERROR","msg":"resource not found","error":"ErrNotFound: value not found"}
{"time":"2024-07-31T00:36:03.162753282Z","level":"ERROR","msg":"rpc error: code = InvalidArgument desc = FQN must specify a valid value and be of format 'https://<namespace>/attr/<attribute name>/value/<value>'","error":"rpc error: code = InvalidArgument desc = FQN must specify a valid value and be of format 'https://<namespace>/attr/<attribute name>/value/<value>'","fqns":""}
{"time":"2024-07-31T00:36:03.162831516Z","level":"ERROR","msg":"Error received from GetDecisionsByToken","namespace":"kas","err":"rpc error: code = Internal desc = resource retrieval failed"}
{"time":"2024-07-31T00:36:03.162858144Z","level":"WARN","msg":"Could not perform access decision!","namespace":"kas","err":"authorization decision unexpected\nrpc error: code = Internal desc = resource retrieval failed"}
{"time":"2024-07-31T00:36:03.162923374Z","level":"AUDIT","msg":"{\"object\":{\"type\":\"key_object\",\"id\":\"d9e233de-4ecf-11ef-8bdd-42010a04322f\",\"attributes\":{\"assertions\":[],\"attrs\":[]}},\"action\":{\"type\":\"rewrap\",\"result\":\"error\"},\"owner\":{\"id\":\"00000000-0000-0000-0000-000000000000\",\"orgId\":\"00000000-0000-0000-0000-000000000000\"},\"actor\":{\"id\":\"b41bab1c-48c3-4573-99a3-a86ea6f21a11\",\"attributes\":[]},\"eventMetaData\":{\"algorithm\":\"ec:secp256r1\",\"keyID\":\"\",\"policyBinding\":\"\",\"tdfFormat\":\"nano\"},\"clientInfo\":{\"userAgent\":\"grpc-go/1.65.0\",\"platform\":\"kas\",\"requestIp\":\"10.42.0.8\"},\"requestId\":\"00000000-0000-0000-0000-000000000000\",\"timestamp\":\"2024-07-31T00:36:03Z\"}","namespace":"kas"}
{"time":"2024-07-31T00:36:03.162943315Z","level":"ERROR","msg":"rewrap nano","namespace":"kas","err":"request error\nrpc error: code = PermissionDenied desc = forbidden"}

Given the same namespace, creation/encryption of a ZTDF fails with NewTDFConfig failed: invalid type: attribute regex fail for [https://dsp-demo.com/attr/role/value/guest].

strantalis commented 3 months ago

https://github.com/opentdf/platform/issues/1214

jakedoublev commented 2 months ago

Duplicate of #1214 which has been resolved.