opa-authzen-plugin

README

opa-authzen-plugin

This repository contains an extended version of OPA (OPA-AuthZEN) that implements the OpenID AuthZEN Authorization API 1.0.

Issue Management

Use GitHub Issues to request features or file bugs.

Overview

OPA-AuthZEN extends OPA with an HTTP server that implements the AuthZEN Access Evaluation API. You can use this version of OPA as a standard AuthZEN-compatible PDP (Policy Decision Point) without a separate proxy process.

The plugin follows the same architecture as opa-envoy-plugin -- a single binary that embeds OPA and registers an additional plugin.

Quick Start

1. Build the plugin.

   make build
   

2. Create a policy file policy.rego:

   package authzen
   
   default allow = false
   
   allow if input.subject.properties.role == "admin"
   
   allow if {
       input.action.name == "read"
       input.subject.id != ""
   }
   

3. Create a config file config.yaml:

   plugins:
     authzen:
       addr: ":9292"
       path: "authzen"
       decision: "allow"
   

4. Run the plugin.

   ./opa-authzen-plugin run --server --config-file config.yaml policy.rego
   

   This starts OPA on :8181 (default) and the AuthZEN server on :9292.

5. Send an AuthZEN evaluation request.

   curl -s -X POST http://localhost:9292/access/v1/evaluation \
     -H "Content-Type: application/json" \
     -d '{
       "subject": {"type": "user", "id": "alice", "properties": {"role": "admin"}},
       "resource": {"type": "document", "id": "doc-123"},
       "action": {"name": "delete"}
     }'
   

   The response should be:

   {"decision":true}
   

6. Check the well-known metadata endpoint.

   curl -s http://localhost:9292/.well-known/authzen-configuration | jq .
   

Docker

make docker-build
make docker-run

Configuration

The plugin is configured under the plugins.authzen key in the OPA config file:

Key	Type	Default	Description
addr	string	:9292	Address for the AuthZEN HTTP server
path	string	authzen	OPA package path to query
decision	string	allow	Rule name within the package that produces the boolean decision

License

Apache License 2.0. See LICENSE.