opa 8ad8b824d4d26e388f4f7a18647ca46a FOLDER 2022-03-15T11:46:36.712Z opa OPA Validation 8ad8b824d4d26e388f4f7a18647ca4e3 POLICY 2022-03-15T11:46:36.726Z OPA Validation Include true 11 false <?xml version="1.0" encoding="UTF-8"?> <wsp:Policy xmlns:L7p="http://www.layer7tech.com/ws/policy" xmlns:wsp="http://schemas.xmlsoap.org/ws/2002/12/policy"> <wsp:All wsp:Usage="Required"> <L7p:CommentAssertion> <L7p:Comment stringValue="Policy Fragment: OPA Validation"/> </L7p:CommentAssertion> <L7p:HttpRoutingAssertion> <L7p:FailOnErrorStatus booleanValue="false"/> <L7p:HttpMethod httpMethod="POST"/> <L7p:ProtectedServiceUrl stringValue="${opaUrl}${opaPackage}"/> <L7p:ProxyPassword stringValueNull="null"/> <L7p:ProxyUsername stringValueNull="null"/> <L7p:RequestHeaderRules httpPassthroughRuleSet="included"> <L7p:ForwardAll booleanValue="true"/> <L7p:Rules httpPassthroughRules="included"> <L7p:item httpPassthroughRule="included"> <L7p:Name stringValue="Cookie"/> </L7p:item> <L7p:item httpPassthroughRule="included"> <L7p:Name stringValue="SOAPAction"/> </L7p:item> </L7p:Rules> </L7p:RequestHeaderRules> <L7p:RequestMsgSrc stringValue="opainputmessage"/> <L7p:RequestParamRules httpPassthroughRuleSet="included"> <L7p:ForwardAll booleanValue="true"/> <L7p:Rules httpPassthroughRules="included"/> </L7p:RequestParamRules> <L7p:ResponseHeaderRules httpPassthroughRuleSet="included"> <L7p:ForwardAll booleanValue="true"/> <L7p:Rules httpPassthroughRules="included"> <L7p:item httpPassthroughRule="included"> <L7p:Name stringValue="Set-Cookie"/> </L7p:item> </L7p:Rules> </L7p:ResponseHeaderRules> <L7p:SamlAssertionVersion intValue="2"/> </L7p:HttpRoutingAssertion> <L7p:EvaluateJsonPathExpressionV2> <L7p:Expression stringValue=".result.allow"/> <L7p:Target target="RESPONSE"/> <L7p:VariablePrefix stringValue="opaResult"/> </L7p:EvaluateJsonPathExpressionV2> <wsp:OneOrMore wsp:Usage="Required"> <L7p:ComparisonAssertion> <L7p:CaseSensitive booleanValue="false"/> <L7p:Expression1 stringValue="${opaResult.result}"/> <L7p:Expression2 stringValue="true"/> <L7p:Predicates predicates="included"> <L7p:item binary="included"> <L7p:CaseSensitive booleanValue="false"/> <L7p:RightValue stringValue="true"/> </L7p:item> </L7p:Predicates> </L7p:ComparisonAssertion> <wsp:All wsp:Usage="Required"> <L7p:CustomizeErrorResponse> <L7p:Content stringValueReference="inline"><![CDATA[{ "message": "forbidden" }]]></L7p:Content> <L7p:ContentType stringValue="application/json; charset=UTF-8"/> <L7p:ExtraHeaders nameValuePairArray="included"/> <L7p:HttpStatus stringValue="403"/> </L7p:CustomizeErrorResponse> <L7p:FalseAssertion/> </wsp:All> </wsp:OneOrMore> </wsp:All> </wsp:Policy> Validate JWT a349ecb6d7d2ac409cb020e8aaef2752 POLICY 2022-03-15T11:46:36.729Z Validate JWT Include false 8 false <?xml version="1.0" encoding="UTF-8"?> <wsp:Policy xmlns:L7p="http://www.layer7tech.com/ws/policy" xmlns:wsp="http://schemas.xmlsoap.org/ws/2002/12/policy"> <wsp:All wsp:Usage="Required"> <L7p:CommentAssertion> <L7p:Comment stringValue="Policy Fragment: Validate JWT"/> </L7p:CommentAssertion> <L7p:Split> <L7p:InputVariable stringValue="jwt"/> <L7p:OutputVariable stringValue="jwt"/> <L7p:SplitPattern stringValue=" "/> </L7p:Split> <L7p:DecodeJsonWebToken> <L7p:FailUnverifiedSignature booleanValue="true"/> <L7p:SignatureSecret stringValue="${sharedSecret}"/> <L7p:SourcePayload stringValue="${jwt[1]}"/> <L7p:TargetVariablePrefix stringValue="jwt"/> <L7p:ValidationType stringValue="Using Secret"/> </L7p:DecodeJsonWebToken> <L7p:SetVariable> <L7p:Base64Expression stringValue="JHtqd3QucGF5bG9hZH0="/> <L7p:ContentType stringValue="application/json; charset=utf-8"/> <L7p:DataType variableDataType="message"/> <L7p:VariableToSet stringValue="jwt.payload"/> </L7p:SetVariable> <L7p:EvaluateJsonPathExpressionV2> <L7p:Expression stringValue=".user"/> <L7p:OtherTargetMessageVariable stringValue="jwt.payload"/> <L7p:Target target="OTHER"/> <L7p:VariablePrefix stringValue="user"/> </L7p:EvaluateJsonPathExpressionV2> </wsp:All> </wsp:Policy> Validate JWT a349ecb6d7d2ac409cb020e8aaef2762 ENCAPSULATED_ASSERTION 2022-03-15T11:46:36.729Z Validate JWT 7dc4d634-c2b1-4e6d-811c-70db8a9fa433 1 jwt string JWT true 2 sharedSecret string Shared Secret true user.result string false Validate a HS256 JWT with shared secret policyLogic false 3d6b7e2d-d594-497e-bf6a-f96429b695dc OPA Validation 8ad8b824d4d26e388f4f7a18647ca4f3 ENCAPSULATED_ASSERTION 2022-03-15T11:46:36.729Z OPA Validation d54aa78b-7b25-4024-a327-10f93f71077c 1 opaUrl string OPA URL true 2 opaPackage string OPA Package true 3 opaInputMessage message Input Message true 4 failOnRejection boolean Fail on Rejection true false This assertion validates requests against Open Policy Agent. accessControl false 7700ab29-3be4-4453-b9a2-73d2870f658b Gateway Validated JWT 8ad8b824d4d26e388f4f7a18647ca4a7 SERVICE 2022-03-15T11:46:36.754Z Gateway Validated JWT true /v1/account/* GET POST PUT DELETE true false 23 false false false <?xml version="1.0" encoding="UTF-8"?> <wsp:Policy xmlns:L7p="http://www.layer7tech.com/ws/policy" xmlns:wsp="http://schemas.xmlsoap.org/ws/2002/12/policy"> <wsp:All wsp:Usage="Required"> <L7p:Encapsulated> <L7p:EncapsulatedAssertionConfigGuid stringValue="7dc4d634-c2b1-4e6d-811c-70db8a9fa433"/> <L7p:EncapsulatedAssertionConfigName stringValue="Validate JWT"/> <L7p:Parameters mapValue="included"> <L7p:entry> <L7p:key stringValue="jwt"/> <L7p:value stringValue="${request.http.header.Authorization}"/> </L7p:entry> <L7p:entry> <L7p:key stringValue="sharedSecret"/> <L7p:value stringValue="cONSCerytArcHisOmBRopHelieTRailiStr"/> </L7p:entry> </L7p:Parameters> </L7p:Encapsulated> <L7p:Split> <L7p:InputVariable stringValue="request.http.uri"/> <L7p:OutputVariable stringValue="uriParams"/> <L7p:SplitPattern stringValue="/"/> </L7p:Split> <L7p:SetVariable> <L7p:Base64Expression stringValue="eyAgDQogICAgImlucHV0Ijogew0KICAgICAgICAicGF0aCI6IFsiJHt1cmlQYXJhbXNbMV19IiwgIiR7dXJpUGFyYW1zWzJdfSIsICIke3VyaVBhcmFtc1szXX0iXSwNCiAgICAgICAgIm1ldGhvZCI6ICIke3JlcXVlc3QuaHR0cC5tZXRob2R9IiwNCiAgICAgICAgInN1YmplY3QiOiAiJHt1c2VyLnJlc3VsdH0iLA0KICAgICAgICAicmVzb3VyY2UiOiAiYWNjb3VudHMiLA0KICAgICAgICAiYWN0aW9uIjogIiR7cmVxdWVzdC5odHRwLmhlYWRlci5hY3Rpb259Ig0KICAgIH0NCn0="/> <L7p:ContentType stringValue="application/json; charset=utf-8"/> <L7p:DataType variableDataType="message"/> <L7p:VariableToSet stringValue="opa"/> </L7p:SetVariable> <L7p:Encapsulated> <L7p:EncapsulatedAssertionConfigGuid stringValue="d54aa78b-7b25-4024-a327-10f93f71077c"/> <L7p:EncapsulatedAssertionConfigName stringValue="OPA Validation"/> <L7p:Parameters mapValue="included"> <L7p:entry> <L7p:key stringValue="failOnRejection"/> <L7p:value stringValue="true"/> </L7p:entry> <L7p:entry> <L7p:key stringValue="opaInputMessage"/> <L7p:value stringValue="opa"/> </L7p:entry> <L7p:entry> <L7p:key stringValue="opaPackage"/> <L7p:value stringValue="layer7/rbac"/> </L7p:entry> <L7p:entry> <L7p:key stringValue="opaUrl"/> <L7p:value stringValue="http://opa.opa.svc.cluster.local:8181/v1/data/"/> </L7p:entry> </L7p:Parameters> </L7p:Encapsulated> <L7p:HardcodedResponse> <L7p:Base64ResponseBody stringValue="ewogICJtZXNzYWdlIjogInN1Y2Nlc3MiCn0="/> <L7p:ResponseContentType stringValue="application/json; charset=UTF-8"/> </L7p:HardcodedResponse> </wsp:All> </wsp:Policy> Generate Simple JWT a349ecb6d7d2ac409cb020e8aaef26da SERVICE 2022-03-15T11:46:36.758Z Generate Simple JWT true /jwt GET POST PUT DELETE true false 7 false false false <?xml version="1.0" encoding="UTF-8"?> <wsp:Policy xmlns:L7p="http://www.layer7tech.com/ws/policy" xmlns:wsp="http://schemas.xmlsoap.org/ws/2002/12/policy"> <wsp:All wsp:Usage="Required"> <L7p:SetVariable> <L7p:Base64Expression stringValue="ew0KICAidXNlciI6ICIke3JlcXVlc3QuaHR0cC5wYXJhbWV0ZXJzLnVzZXJ9IiwNCiAgImF6cCI6ICIke3JlcXVlc3QuaHR0cC5wYXJhbWV0ZXJzLnVzZXJ9Ig0KfQ=="/> <L7p:VariableToSet stringValue="body"/> </L7p:SetVariable> <L7p:EncodeJsonWebToken> <L7p:SignPayload booleanValue="true"/> <L7p:SignatureAlgorithm stringValue="HS256"/> <L7p:SignatureSecretKey stringValue="cONSCerytArcHisOmBRopHelieTRailiStr"/> <L7p:SourceVariable stringValue="${body}"/> <L7p:TargetVariable stringValue="jwt"/> </L7p:EncodeJsonWebToken> <L7p:HardcodedResponse> <L7p:Base64ResponseBody stringValue="ewogICJ0b2tlbiI6ICIke2p3dC5jb21wYWN0fSIKfQ=="/> <L7p:ResponseContentType stringValue="application/json; charset=UTF-8"/> </L7p:HardcodedResponse> </wsp:All> </wsp:Policy> OPA Validated JWT a349ecb6d7d2ac409cb020e8aaef2717 SERVICE 2022-03-15T11:46:36.764Z OPA Validated JWT true /v2/account/* GET POST PUT DELETE true false 11 false false false <?xml version="1.0" encoding="UTF-8"?> <wsp:Policy xmlns:L7p="http://www.layer7tech.com/ws/policy" xmlns:wsp="http://schemas.xmlsoap.org/ws/2002/12/policy"> <wsp:All wsp:Usage="Required"> <L7p:Split> <L7p:InputVariable stringValue="request.http.uri"/> <L7p:OutputVariable stringValue="uriParams"/> <L7p:SplitPattern stringValue="/"/> </L7p:Split> <L7p:Split> <L7p:InputVariable stringValue="request.http.header.Authorization"/> <L7p:OutputVariable stringValue="auth"/> <L7p:SplitPattern stringValue=" "/> </L7p:Split> <L7p:SetVariable> <L7p:Base64Expression stringValue="eyAgDQogICAgImlucHV0Ijogew0KICAgICAgICAicGF0aCI6IFsiJHt1cmlQYXJhbXNbMV19IiwgIiR7dXJpUGFyYW1zWzJdfSIsICIke3VyaVBhcmFtc1szXX0iXSwNCiAgICAgICAgIm1ldGhvZCI6ICIke3JlcXVlc3QuaHR0cC5tZXRob2R9IiwNCiAgICAgICAgInRva2VuIjogIiR7YXV0aFsxXX0iLA0KICAgICAgICAic2hhcmVkU2VjcmV0IjogImNPTlNDZXJ5dEFyY0hpc09tQlJvcEhlbGllVFJhaWxpU3RyIiwNCiAgICAgICAgInJlc291cmNlIjogImFjY291bnRzIiwNCiAgICAgICAgImFjdGlvbiI6ICIke3JlcXVlc3QuaHR0cC5oZWFkZXIuYWN0aW9ufSINCiAgICB9DQp9"/> <L7p:ContentType stringValue="application/json; charset=utf-8"/> <L7p:DataType variableDataType="message"/> <L7p:VariableToSet stringValue="opa"/> </L7p:SetVariable> <L7p:Encapsulated> <L7p:EncapsulatedAssertionConfigGuid stringValue="d54aa78b-7b25-4024-a327-10f93f71077c"/> <L7p:EncapsulatedAssertionConfigName stringValue="OPA Validation"/> <L7p:Parameters mapValue="included"> <L7p:entry> <L7p:key stringValue="failOnRejection"/> <L7p:value stringValue="true"/> </L7p:entry> <L7p:entry> <L7p:key stringValue="opaInputMessage"/> <L7p:value stringValue="opa"/> </L7p:entry> <L7p:entry> <L7p:key stringValue="opaPackage"/> <L7p:value stringValue="layer7/jwt"/> </L7p:entry> <L7p:entry> <L7p:key stringValue="opaUrl"/> <L7p:value stringValue="http://opa.opa.svc.cluster.local:8181/v1/data/"/> </L7p:entry> </L7p:Parameters> </L7p:Encapsulated> <L7p:HardcodedResponse> <L7p:Base64ResponseBody stringValue="ewogICJtZXNzYWdlIjogInN1Y2Nlc3MiCn0="/> <L7p:ResponseContentType stringValue="application/json; charset=UTF-8"/> </L7p:HardcodedResponse> </wsp:All> </wsp:Policy> true true