使用 WSO2IS 配置用户对实体的访问权限

Question

I'm trying to implement WSO2IS for authorization. My understanding is that in the WSO2 realm, the concept of a permission broadly restricts a user's access to an action, or a resource. So, for instance, if my app is a bookstore, I could configure whether a user has "read" access to authors at large, and toggle their access to the GetAuthors() endpoint. However, I need to configure a user's access to certain authors. Is there a way I can store a whitelist of authors on a per-user basis? What I'd like to accomplish is to have a user call a GetBooks() endpoint and return only the books written by the authors that the user can access.

It sounds like one possibility is to store this information in an external datastore, and implement a custom PIP to read from that datastore.

Another possible option would be to create a custom attribute on the User type and store the whitelist of author IDs in an array on each user.

Is there a better way to do this? I'd prefer not to implement a custom external datastore just to store relationships between users and entity ids. Is it possible to do this with XACML and policies? Is it possible to have WSO2IS stick this information on a claim that is returned to my controller so that I can limit my underlying query based on the user's whitelist of allowed entity IDs?

Answer 1

AFAIU you need to maintain a claim to track the accessibility for reading. You can easily create a custom claim to track it by following the article[1]. In this way, you can refer to the custom claim at the controller to make further decisions.

You have to update this claim value for each user. For this, you can use SCIM API[2] by following doc[3] to extend the SCIM endpoint for custom claims.

[1] https://medium.com/@inthiraj1994/lets-add-a-custom-claim-to-oidc-in-wso2-is-d871e418d6b0 [2] https://is.docs.wso2.com/en/latest/develop/scim2-rest-apis/#/scim-20-api-definition [3] https://is.docs.wso2.com/en/latest/develop/extending-scim2-user-schemas/#extending-scim-20-user-schemas