Authorization Service

The Authorization service hosts the Access Control Resources (ACR) for every ESS Pod resource and is responsible for managing/enforcing the Access Control Policies (ACP).

Authorization Service Endpoint

By default, the ESS Authorization Service runs from the following root URL:

https://authorization.<ESS Domain>

To change the root Authorization service URL, see INRUPT_AUTHORIZATION_BASE_URL

Authorization Service and Initial ACP Policies

When a Pod is created, like any other Pod resource, an ACR is also created for the Pod Root. The ACR is initialized with the default ACP policies for the Pod Owner and for Access Grant enablement:

Initial Pod Owner policies give the Pod Owner read and write access to the Pod. These policies also specify a client matcher as well if the Authorization Service’s configuration for the initial client allow list is set:
- INRUPT_AUTHORIZATION_DEFAULT_ACR_CLIENT_ID_ALLOW_LIST or if that is unset,
- INRUPT_AUTHORIZATION_CLIENT_ID_ALLOW_LIST

Note

ESS uses the values in its Authorization Service’s INRUPT_AUTHORIZATION_DEFAULT_ACR_CLIENT_ID_ALLOW_LIST (at the time of Pod creation) to create the client matcher for the initial ACP policies. If the configuration is unset, ESS uses the values in its Authorization service’s INRUPT_AUTHORIZATION_CLIENT_ID_ALLOW_LIST (at the time of Pod creation).

Using the value of the Pod owner’s WebID and an initial client allow list, ESS creates the initial policies of the form:

If allOf(AgentMatcher and ClientMatcher) evaluates to true, Then allow (Read and Write).

Specifically, ESS creates:

Policy 1 for the Pod Root: If the agent matches the Pod owner’s WebID, and if the client application’s Client ID has a match in the initial client allow list, allow Read and Write access.

Policy 2 for the Pod Root’s Initial Member Policies: If the agent matches the Pod owner’s WebID, and if the client application’s Client ID has a match in the initial client allow list, allow Read and Write access.

For more information on a Container’s Member Policies, see Member Policies

Note

ESS uses the values in Authorization Service’s INRUPT_AUTHORIZATION_DEFAULT_ACR_CLIENT_ID_ALLOW_LIST (at the time of Pod creation) to create the client matcher for the initial policies. If the configuration is unset, ESS uses the values in its Authorization Service’s INRUPT_AUTHORIZATION_CLIENT_ID_ALLOW_LIST (at the time of Pod creation).

If the initial client allow list is empty (when creating the policy), ESS uses the value of the Pod owner’s WebID to create initial policies of the form:

If allOf(AgentMatcher) evaluates to true, Then allow (Read and Write).

Specifically, ESS creates:

Policy 1 for the Pod Root: If the agent matches the Pod owner’s WebID, allow Read and Write access.

Policy 2 for the Pod Root’s Initial Member Policies: If the agent matches the Pod owner’s WebID, allow Read and Write access.

For more information on a Container’s Member Policies, see Member Policies

Disambiguation

Both Authorization Service and Pod Storage Service have a INRUPT_AUTHORIZATION_CLIENT_ID_ALLOW_LIST setting.

Only the Authorization Service setting affects which clients are allowed. The Pod Storage Service is for Discovery purposes only.

Initial Access Grant Enablement policies allow the use of Access Grants that grant read/write/append access to the Pod resources. If allOf(VC Matcher) evaluates to true, Then allow (Read and Write and Append). Specifically, ESS creates: Policy 3 for the Pod Root:
If a presented VC matches the specified type, allow its use for Read, Write, and Append access. Policy 4 for the Pod Root’s Initial Member Policies: If a presented VC matches the specified type, allow its use for Read, Write, and Append access. See also INRUPT_AUTHORIZATION_DEFAULT_ACR_ACCESS_GRANTS_ALLOWED_MODES.

Important

The policies only enable the use of Access Grants for the allowed access modes. To determine the access for an agent using an access grant, ESS uses the intersection of:

The allowed access specified by the policy, and
The granted access specified in the Access Grant (for the resource specified in the Access Grant).

Note A Pod’s initial Policies are set when the Pod is provisioned. As such, updates to the various INRUPT_AUTHORIZATION_DEFAULT_ACR_* options do not affect existing Pods.

That is, once a Pod’s initial policies have been created, changes to the various INRUPT_AUTHORIZATION_DEFAULT_ACR_* options are not reflected in that Pod’s policies.

Configuration

As part of the installation process, Inrupt provides base Kustomize overlays and associated files that require deployment-specific configuration inputs.

The following configuration options are available for the service and may be set as part of updating the inputs for your deployment . The Inrupt-provided base Kustomize overlays may be using updated configuration values that differ from the default values.

Note Whitespaces are preserved when parsing comma-delimited lists (i.e., the parsed string values are not trimmed). For example, when parsed, "value1, value2,value3 " results in "value1" , " value2" , "value3 " .

Required

INRUPT_AUTHORIZATION_BASE_URL

The URI of the Authorization service.

INRUPT_AUTHORIZATION_CLIENT_ID_ALLOW_LIST

Default: https://inrupt.com

Comma-delimited list of Client IDs that determine which applications are allowed to perform read and write operations on the Access Control Resources.

In addition, the authorization server uses INRUPT_AUTHORIZATION_CLIENT_ID_ALLOW_LIST to initialize the default access policies for a new Pod if INRUPT_AUTHORIZATION_DEFAULT_ACR_CLIENT_ID_ALLOW_LIST is unset.

Important The Authorization Service’s INRUPT_AUTHORIZATION_CLIENT_ID_ALLOW_LIST value must be managed with care. Only those applications with a high level of trust should be listed. This value should never be set to an empty list so the default value has been set to https://inrupt.com to prevent this happening by mistake. It must be replaced during deployment.

Kafka Configuration

Tip See also ESS’ Kafka Configuration

INRUPT_KAFKA_AUDITV1EVENTSENCRYPTED_CIPHER_PASSWORD

The strong cipher key to use when running auditing with encrypted messages over the auditv1eventsencrypted topic.

INRUPT_KAFKA_AUDITV1EVENTSPRODUCERENCRYPTED_CIPHER_PASSWORD

The strong cipher key to use when running auditing with encrypted messages over the auditv1eventsproducerencrypted topic.

INRUPT_KAFKA_SOLIDACCESSCONTROLRESOURCE_CIPHER_PASSWORD

The symmetric key to use when encrypting messages (see MP_MESSAGING_OUTGOING_SOLIDACCESSCONTROLRESOURCE_VALUE_SERIALIZER).

Warning Set to a strong password.

KAFKA_BOOTSTRAP_SERVERS

Default : localhost:9092

Comma-delimited list of Kafka broker servers for use by ESS services, including this service.

Setting KAFKA_BOOTSTRAP_SERVERS configures ESS to use the same Kafka instances for all its Kafka message channels (e.g., solidresource and auditv1out message channels). This service uses the solidaccesscontrolresource and auditv1out message channels.

Note Inrupt-provided overlays default to using KAFKA_BOOTSTRAP_SERVERS .

To use different Kafka instances for the solidaccesscontrolresource and auditv1out message channels, use specific message channel configuration.

MP_MESSAGING_OUTGOING_SOLIDACCESSCONTROLRESOURCE_VALUE_SERIALIZER

Default : org.apache.kafka.common.serialization.StringSerializer The serializer used for the notification messages the service sends to Kafka.

Supported values are:

org.apache.kafka.common.serialization.StringSerializer When set to this value, notification messages sent to Kafka are unencrypted. Services that consume these messages will need to set their MP_MESSAGING_INCOMING_SOLIDACCESSCONTROLRESOURCE_VALUE_DESERIALIZER to the corresponding deserializer value org.apache.kafka.common.serialization.StringDeserializer.
com.inrupt.components.kafka.encryption.EncryptMessageSerializer When set to this value, notification messages sent to Kafka are encrypted. Services that consume these encrypted messages will need to set their MP_MESSAGING_INCOMING_SOLIDACCESSCONTROLRESOURCE_VALUE_DESERIALIZER configuration to the corresponding deserializer value com.inrupt.components.kafka.encryption.DecryptMessageDeserializer.

Optional

Configuration Logging

ESS services log their startup configuration.

INRUPT_LOGGING_CONFIGURATION_PREFIX_ALLOW

Default : inrupt,mp.messaging

A comma-separated list of configuration property prefixes (case-sensitive) that determine which configurations are logged:

If the list is empty, NO configuration property is logged.
If a configuration property starts with a listed prefix ( case-sensitive ), the configuration property and its value are logged unless the configuration also matches a prefix in INRUPT_LOGGING_CONFIGURATION_PREFIX_DENY (which acts as a filter on INRUPT_LOGGING_CONFIGURATION_PREFIX_ALLOW list). As such, if the configuration matches prefix in both INRUPT_LOGGING_CONFIGURATION_PREFIX_ALLOW and INRUPT_LOGGING_CONFIGURATION_PREFIX_DENY , the INRUPT_LOGGING_CONFIGURATION_PREFIX_DENY takes precedence and the configuration is not logged. For example, if inrupt. is an allow prefix, but inrupt.kafka. is a deny prefix, all configurations that start with inrupt.kafka. are excluded from the logs.

When specifying the prefixes, you can specify the prefixes using one of two formats:

using dot notation (e.g., inrupt.foobar. ), or
using the MicroProfile Config environmental variables conversion value (e.g., INRUPT_FOOBAR_ ).

Warning Use the same format for both INRUPT_LOGGING_CONFIGURATION_PREFIX_ALLOW and INRUPT_LOGGING_CONFIGURATION_PREFIX_DENY .

For example, if you change the format of INRUPT_LOGGING_CONFIGURATION_PREFIX_ALLOW , change the format of INRUPT_LOGGING_CONFIGURATION_PREFIX_DENY as well.

Tip To avoid allowing more than desired configurations, specify as much of the prefix as possible. If the prefix specifies the complete prefix term, include the term delineator. For example:

If using dot-notation, if you want to match configuration properties of the form foobar.<xxxx>... , specify foobar. (including the dot . ) instead of, for example, foo or foobar .
If using converted form, if you want to match configuration properties of the form FOOBAR_<XXXX>... , specify FOOBAR_ (including the underscore _ ) instead of, for example, FOO or FOOBAR .

INRUPT_LOGGING_CONFIGURATION_PREFIX_DENY

Default : inrupt.kafka

A comma-separated list of configuration name prefixes (case-sensitive) that determines which configurations (that would otherwise match the INRUPT_LOGGING_CONFIGURATION_PREFIX_ALLOW) are not logged. That is, INRUPT_LOGGING_CONFIGURATION_PREFIX_DENY acts as a filter on INRUPT_LOGGING_CONFIGURATION_PREFIX_ALLOW . For example:

If foobar. is an allowed prefix, to suppress foobar.private.<anything> , you can specify foobar.private. to the deny list.
If foobar. is not an allowed prefix, no property starting with foobar. is logged. As such, you do not need to specify foobar.private to the deny list.
When specifying the prefixes, you can specify the prefixes using one of two formats:
using dot notation (e.g., inrupt.foobar. ), or
using the MicroProfile Config environmental variables conversion value (e.g., INRUPT_FOOBAR_ ).

Warning Use the same format for both INRUPT_LOGGING_CONFIGURATION_PREFIX_ALLOW and INRUPT_LOGGING_CONFIGURATION_PREFIX_DENY .

For example, if you change the format of INRUPT_LOGGING_CONFIGURATION_PREFIX_ALLOW , change the format of INRUPT_LOGGING_CONFIGURATION_PREFIX_DENY as well.

INRUPT_LOGGING_REDACTION_NAME_ACTION

Default : REPLACE

Type of the redaction to perform. Supported values are:

Action

Description

REPLACE

Default. Replaces the matching text with a specified replacement.

PLAIN

Leaves the matching field unprocessed. Only available if the redaction target is a field (i.e.,INRUPT_LOGGING_REDACTION_{NAME}_FIELD).

DROP

Suppresses the matching field. Only available if the redaction target is a field (i.e.,INRUPT_LOGGING_REDACTION_{NAME}_FIELD).

PRIORITIZE

Changes the log level of the matching message.

SHA256

Replaces the matching text with its hash.

If the action is REPLACE ( default ), see also INRUPT_LOGGING_REDACTION_{NAME}_REPLACEMENT .
If the action is to PRIORITIZE , see also INRUPT_LOGGING_REDACTION_{NAME}_LEVEL .