Authorization Api

This section specifies the Cedar Authorization API Model override.

If no specific override is provided, the generic Authorization API Model specification applies.

Entities#

The Entities object is a set of attributes that represent policy’s entities.

{
  "authorization_model": {
    "entities": {
      "schema": "cedar",
      "items": [
        {
          "uid": {
            "type": "MagicFarmacia::Platform::Subscription",
            "id": "e3a786fd07e24bfa95ba4341d3695ae8"
          },
          "attrs": {
            "active": true
          },
          "parents": []
        }
      ]
    }
  }
}

authorization_model/entities/schema: the schema type (default CEDAR, options CEDAR).

authorization_model/entities/items: items has to match the CEDAR entities structure.

Subject#

The Subject is mapped to the internal Permguard subject structure for the Cedar policy.

The CEDAR TYPE must be used in the Cedar policy.

@id("platform-auditor")
permit(
  principal == Permguard::IAM::RoleActor::"platform-auditor"
);

Resource#

The Resource has to satisfy the Cedar resource structure.

@id("platform-auditor")
permit(
  resource is MagicFarmacia::Platform::Subscription
);

Action#

The Action has to satisfy the Cedar action structure.

@id("platform-auditor")
permit(
  action == MagicFarmacia::Platform::Action::"view",
);