Need better understanding of principal group membership in Verified Permissions

0

I am working on a project using Verified Permissions along side AzureAD. AzureAD is connected to our enterprise Active Directory, and replicates AD group membership back to AzureAD. Our application gets the group membership list as an array.

We want to pass the group membership array and user Id to Verified Permissions IsAuthorized, and have policies that check for membership in a particular group and optionally override group permissions with a user ID. (For testing, we wish to simulate a user is in a different group.. it takes way too long to get IT to remap someone's group membership for testing purposes). I see mentions of using groups in the documentation, but not enough context to understand how it is suggested to be working or if I need a different approach: https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/policies_examples-group-entities.html

What is the best way to setup the principal in the schema and write a policy for the following? We basically want to do (in english, not cedar): Apply Policy X for Principal Where Member Of "GroupA" Or UserId = "MyUserForTesting"

질문됨 4달 전193회 조회
1개 답변
1
수락된 답변

I would suggest having two entity types:

  • User (memberOfTypes: Group)
  • Group

Then you would have two policies granting the same access:

  • permit(principal == User::"MyUserForTesting", ...)
  • permit(principal in Group::"A", ...)

You could try to consolidate it into a single policy by adding 'groups' and 'userId' attribute on user but I think it will hurt policy readability.

Maxim
답변함 4달 전
profile pictureAWS
전문가
검토됨 4달 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠