add authz group
This commit is contained in:
+47
-28
@@ -2,53 +2,72 @@
|
||||
# =============================================================================
|
||||
# eBdesk SiCABE — sicabe-authz
|
||||
# -----------------------------------------------------------------------------
|
||||
# CLI pengelolaan AUTHORIZATION (OPA/Trino) berbasis model config/opa/authz.yml.
|
||||
# CLI pengelolaan AUTHORIZATION: model OPA/Trino (config/opa/authz.yml) dan
|
||||
# GRUP/USER OpenLDAP (sumber grup Trino & StarRocks). Logika: lib/authz.py +
|
||||
# lib/authz_ldap.py (Python + PyYAML; ldap-utils).
|
||||
#
|
||||
# Model authz.yml = SUMBER KEBENARAN. Perintah di sini mengedit model, lalu
|
||||
# merender data ACL OPA (config/opa/data.json) dan (opsional) memuat ulang OPA.
|
||||
# Logika model ada di lib/authz.py (Python + PyYAML).
|
||||
#
|
||||
# Pemakaian:
|
||||
# ./scripts/sicabe-authz list roles
|
||||
# ./scripts/sicabe-authz matrix [--schema bronze]
|
||||
# ./scripts/sicabe-authz show role data-engineer
|
||||
# ./scripts/sicabe-authz grant set data-analyst gold.orders_gold --caps select --columns id
|
||||
# ./scripts/sicabe-authz role add data-scientist
|
||||
# ./scripts/sicabe-authz user assign svc_dbt data-engineer
|
||||
# ./scripts/sicabe-authz catalog rename iceberg lakehouse
|
||||
# ./scripts/sicabe-authz render # authz.yml -> data.json
|
||||
# ./scripts/sicabe-authz check # pastikan data.json sinkron
|
||||
# ./scripts/sicabe-authz apply [--no-reload] # render + reload OPA
|
||||
# ./scripts/sicabe-authz reload # recreate container OPA
|
||||
#
|
||||
# --dry-run (posisi mana pun) -> jangan tulis apa pun, hanya cetak rencana.
|
||||
# Pemakaian: ./scripts/sicabe-authz <perintah> [opsi] [--dry-run] [--env-file <f>]
|
||||
# --dry-run (posisi mana pun) -> jangan tulis apa pun, cetak rencana.
|
||||
# =============================================================================
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
# shellcheck source=../lib/common.sh
|
||||
source "${SCRIPT_DIR}/lib/common.sh" 2>/dev/null || true
|
||||
# shellcheck source=../config/environment.defaults.sh
|
||||
source "${SCRIPT_DIR}/config/environment.defaults.sh" 2>/dev/null || true
|
||||
|
||||
OPA_CONTAINER="${OPA_CONTAINER_NAME:-sicabe-opa}"
|
||||
PY="${SCRIPT_DIR}/lib/authz.py"
|
||||
|
||||
usage() {
|
||||
sed -n '3,27p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
|
||||
cat <<'EOF'
|
||||
sicabe-authz — kelola authorization (OPA/Trino) + grup/user OpenLDAP
|
||||
|
||||
MODEL OPA (authz.yml -> data.json):
|
||||
list catalogs|roles|users|tables daftar isi model
|
||||
matrix [--schema <s>] matriks role x tabel (s=select w=write d=ddl)
|
||||
show role|user|table <nama> detail satu objek
|
||||
grant add|set|remove <role> <schema.table> [--caps a,b] [--columns x,y|*]
|
||||
role add|remove <nama> [--superuser] [--force]
|
||||
user assign|unassign <svc> <role> service account -> role (model)
|
||||
catalog list|add|rename <baru> kelola catalog (rename ikut berkas Trino)
|
||||
fmt | render | check rapikan / render / cek sinkron
|
||||
apply [--no-reload] | reload render (+ reload OPA)
|
||||
|
||||
GRUP & USER LDAP (sumber grup Trino & StarRocks):
|
||||
group list [--members] daftar grup (+ anggota)
|
||||
group add <cn> --member <uid> buat grup (butuh >=1 member)
|
||||
group remove <cn> hapus grup
|
||||
group rename <lama> <baru> rename LDAP + role OPA + permitted_groups StarRocks
|
||||
group add-member|remove-member <cn> <uid>
|
||||
group check cek roles == grup LDAP == permitted_groups
|
||||
group sync [--apply] selaraskan permitted_groups (+ saran grup hilang)
|
||||
user list [--service] daftar user LDAP (atau service account)
|
||||
user add <uid> [--cn <n>] [--mail <m>] [--password <p>] [--in <group>]
|
||||
user remove <uid> hapus user (ikut keluar dari semua grup)
|
||||
|
||||
Umum: --dry-run (di posisi mana pun) · --env-file <path> · -h/--help
|
||||
EOF
|
||||
}
|
||||
|
||||
# ── Ambil --dry-run dari posisi mana pun ─────────────────────────────────────
|
||||
ARGS=()
|
||||
# ── Ekstrak --dry-run dan --env-file dari posisi mana pun ────────────────────
|
||||
ARGS=(); ENVFILE=""; prev=""
|
||||
for a in "$@"; do
|
||||
if [[ "${a}" == "--dry-run" ]]; then
|
||||
export SICABE_AUTHZ_DRY_RUN=1
|
||||
else
|
||||
ARGS+=("${a}")
|
||||
fi
|
||||
if [[ "${prev}" == "--env-file" ]]; then ENVFILE="${a}"; prev=""; continue; fi
|
||||
case "${a}" in
|
||||
--dry-run) export SICABE_AUTHZ_DRY_RUN=1 ;;
|
||||
--env-file) prev="--env-file" ;;
|
||||
*) ARGS+=("${a}") ;;
|
||||
esac
|
||||
done
|
||||
[[ -n "${ENVFILE}" ]] && export SICABE_ENV_FILE="${ENVFILE}"
|
||||
set -- ${ARGS[@]+"${ARGS[@]}"}
|
||||
|
||||
[[ $# -eq 0 || "${1}" == "-h" || "${1}" == "--help" || "${1}" == "help" ]] && { usage; exit 0; }
|
||||
|
||||
PY="${SCRIPT_DIR}/lib/authz.py"
|
||||
# Muat .env (LDAP_* dsb). --env-file sudah diteruskan via SICABE_ENV_FILE.
|
||||
sicabe_load_env "${SCRIPT_DIR}"
|
||||
|
||||
# ── reload: recreate container OPA agar memuat policy+data terbaru ───────────
|
||||
reload_opa() {
|
||||
|
||||
@@ -103,8 +103,27 @@ fi
|
||||
"${CLI}" --dry-run --model "${M}" role add data-ghost >/dev/null 2>&1
|
||||
grep -q 'data-ghost' "${M}" && bad "--dry-run MENULIS berkas" || ok "--dry-run tidak menulis"
|
||||
|
||||
# ─── D. Policy OPA (OPA asli via docker) ────────────────────────────────────
|
||||
echo; echo -e "${BLD}D. Evaluasi policy OPA (docker)${NC}"
|
||||
# ─── D. Grup/user LDAP (read-only; dilewati bila LDAP tak terjangkau) ────────
|
||||
echo; echo -e "${BLD}D. Grup & user LDAP${NC}"
|
||||
if python3 - "${DEPLOY_DIR}/lib/authz_ldap.py" <<'PY'
|
||||
import importlib.util, sys
|
||||
spec = importlib.util.spec_from_file_location("authz_ldap", sys.argv[1])
|
||||
m = importlib.util.module_from_spec(spec); spec.loader.exec_module(m)
|
||||
e = m.parse_ldif("dn: cn=x,dc=a\ncn: x\nmember: uid=1\nmember: uid=2\n\ndn: cn=y,dc=a\ncn: y\n")
|
||||
assert e[0]["cn"] == "x" and e[0]["member"] == ["uid=1", "uid=2"] and e[1]["cn"] == "y", e
|
||||
PY
|
||||
then ok "parser LDIF benar (parse_ldif)"; else bad "parser LDIF salah"; fi
|
||||
svc_out="$("${CLI}" user list --service 2>/dev/null)"
|
||||
case "${svc_out}" in *svc_dbt*) ok "user list --service (model) bekerja" ;; *) bad "user list --service keliru" ;; esac
|
||||
grp_out="$("${CLI}" group list 2>/dev/null)"
|
||||
if [[ -n "${grp_out}" ]]; then
|
||||
ok "group list mengembalikan grup dari LDAP (${grp_out//$'\n'/,})"
|
||||
else
|
||||
skip "LDAP tak terjangkau — lewati uji grup live"
|
||||
fi
|
||||
|
||||
# ─── E. Policy OPA (OPA asli via docker) ────────────────────────────────────
|
||||
echo; echo -e "${BLD}E. Evaluasi policy OPA (docker)${NC}"
|
||||
if docker info >/dev/null 2>&1; then
|
||||
if python3 - "${DEPLOY_DIR}" <<'PY'
|
||||
import json, os, shutil, subprocess, sys, tempfile
|
||||
|
||||
Reference in New Issue
Block a user