Alibaba Cloud Service Mesh:Implement fine-grained access control with OPA policies

Scenario 1: Authenticate requests by JWT

OPA can validate the JWT in the Authorization header and authorize requests based on JWT claims. The request is allowed only if the JWT passes signature verification and contains the required claims.

The following policy allows GET requests to /productpage only when the JWT contains Role: guest and userGroup: visitor:

apiVersion: istio.alibabacloud.com/v1beta1
kind: ASMOPAPolicy
metadata:
  name: policy-jwt
  namespace: default
spec:
  policy: |
    package istio.authz

    allow {
      input.attributes.request.http.method == "GET"
      input.parsed_path[0] == "productpage"
      # Verify the JWT signature with the shared secret
      io.jwt.verify_hs256(bearer_token, "B41BD5F462719C6D6118E673A2389")
      claims.Role == "guest"
      claims.userGroup == "visitor"
    }
    claims := payload {
       [_, payload, _] := io.jwt.decode(bearer_token)
    }
    bearer_token := t {
      v := input.attributes.request.http.headers.authorization
      startswith(v, "Bearer ")
      t := substring(v, count("Bearer "), -1)
    }

The following table describes the key fields in the policy.

Encode the Role and userGroup fields into a JWT string using a tool such as jwt.io.

Test the policy:

curl --location --request GET 'http://<ingress-gateway-ip>/productpage' \
--header 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiZ3Vlc3QxIiwiUm9sZSI6Imd1ZXN0IiwidXNlckdyb3VwIjoidmlzaXRvciJ9.44OnUFZwOzSWzC7hyVfcle-uYk8byv7q_BBxS10AEWc'

Expected output:

200

A 200 status code confirms that the GET request with a valid JWT (Role: guest, userGroup: visitor) is allowed. An invalid or missing JWT returns 403.

Scenario 2: Authenticate requests by HTTP body and JWT

OPA can cross-reference JWT claims with the request body. The following policy allows a request only when the username parameter in the request body matches the Role field in the JWT, and the userGroup field is manager:

apiVersion: istio.alibabacloud.com/v1beta1
kind: ASMOPAPolicy
metadata:
  name: policy-body
  namespace: default
spec:
  policy: |
    package istio.authz

    allow {
      input.attributes.request.http.method == "GET"
      input.parsed_path[0] == "productpage"
      io.jwt.verify_hs256(bearer_token, "B41BD5F462719C6D6118E673A2389")
      claims.Role == input.parsed_body.username
      claims.userGroup == "manager"
    }
    claims := payload {
       [_, payload, _] := io.jwt.decode(bearer_token)
    }
    bearer_token := t {
      v := input.attributes.request.http.headers.authorization
      startswith(v, "Bearer ")
      t := substring(v, count("Bearer "), -1)
    }

The following table describes the key fields in the policy.

Encode the Role and userGroup fields into a JWT string using jwt.io.

Test the policy:

curl --location --request GET 'http://<ingress-gateway-ip>/productpage' \
--header 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiZ3Vlc3QxIiwiUm9sZSI6ImFkbWluIiwidXNlckdyb3VwIjoibWFuYWdlciJ9.pAUvTeONHF-i5Ps-EUYYXk-hnaz-j-ZgP_wXJZMBiR0' \
--header 'Content-Type: application/json' \
--header 'Cookie: session=eyJ1c2VyIjoiYWRtaW4ifQ.YRz90g.GT34_5BqlFTwGqabZk_qGZzxYQ0' \
--data-raw '{
    "username":"admin",
    "password":"12****"
}'

Expected output:

200

A 200 status code confirms that the JWT Role field (admin) matches the request body username (admin), and userGroup is manager. An invalid or missing JWT returns 403.

Scenario 3: Authenticate requests with a user whitelist

Build on Scenario 2 by adding a whitelist check: the username field in the JWT must match an entry in the bookinfo_managers list.

The following policy adds the condition claims.username == bookinfo_managers[_].name, which restricts access to a predefined set of users (user1, user2, user3):

apiVersion: istio.alibabacloud.com/v1beta1
kind: ASMOPAPolicy
metadata:
  name: policy-range
  namespace: default
spec:
  policy: |
    package istio.authz
    bookinfo_managers = [{"name": "user1"}, {"name": "user2"}, {"name": "user3"}]

    allow {
      input.attributes.request.http.method == "GET"
      input.parsed_path[0] == "productpage"
      io.jwt.verify_hs256(bearer_token, "B41BD5F462719C6D6118E673A2389")
      claims.Role == input.parsed_body.username
      claims.userGroup == "manager"
      claims.username == bookinfo_managers[_].name
    }
    claims := payload {
       [_, payload, _] := io.jwt.decode(bearer_token)
    }
    bearer_token := t {
      v := input.attributes.request.http.headers.authorization
      startswith(v, "Bearer ")
      t := substring(v, count("Bearer "), -1)
    }

The following table describes the key fields in the policy.

Encode the request information into a JWT string using jwt.io.

Test the policy:

curl --location --request GET 'http://<ingress-gateway-ip>/productpage' \
--header 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6InVzZXIxIiwiUm9sZSI6ImFkbWluIiwidXNlckdyb3VwIjoibWFuYWdlciJ9.2X0Fmb96jBexLcVm_55t8ZY6XveSxUAsQ1j3ar5dI_g' \
--header 'Content-Type: application/json' \
--header 'Cookie: session=eyJ1c2VyIjoiYWRtaW4ifQ.YRz90g.GT34_5BqlFTwGqabZk_qGZzxYQ0' \
--data-raw '{
    "username":"admin",
    "password":"12****"
}'

Expected output:

200

A 200 status code confirms that all conditions are met: the JWT Role matches the body username, userGroup is manager, and the JWT username (user1) is in the bookinfo_managers list. An invalid or missing JWT returns 403.

How do I check whether a pod uses OPA policies?

OPA runs as a sidecar in the same pod as your application. Connect to the pod and run:

curl 127.0.0.1:15081/v1/policies

This returns the Rego policies loaded by OPA in that pod.

How do I validate Rego policies before deploying them?

Use the OPA Playground to test and debug Rego policies in a browser before applying them to your ASM instance.