The Open Policy Agent is an open-source, general-purpose policy engine that unifies policy enforcement across the stack. OPA decouples policy decision-making from policy enforcement and application logic. At Dstny Engage, making changes to permissions in the OPA service is a cumbersome and time-consuming process that requires modifying code and deploying it. This project aims to develop a centralized dashboard for a middleware between Dstny Engage's services and the open policy agent, allowing for user-friendly policy modifications in real-time.
You can also check out the user manual in the repository's wiki
You will need to have Node installed to run this project.
- Navigate to the project folder
cd ./opa-dashboard/ - Install the dependencies
npm install - Run the application
npm run serve
You will need to have Node installed to run this project.
- Navigate to the project folder
cd ./opa-dashboard/ - Run the style guide
npm run styleguide
During development, the dashboard has been connecting to the backend using ngrok. Create a .env file in the /opa-dashboard/ directory and set the VUE_APP_BASE_URL variable to your backend link
VUE_APP_BASE_URL = your backend link
Types of authorization policies include:
-
Role-Based Access Control (RBAC): RBAC defines access permissions based on a user’s job function or “role”. Permissions are assigned onto roles (like “Admin” or “User”), and roles are assigned to users by the administrator. This structure allows you to easily understand who has access to what. For example, in AWS, IAM includes managed policies that assign permissions to specific roles. RBAC in IAM involves creating separate policies for each job function and attaching them to identities (i.e., IAM users, user groups).
-
Attribute-Based Access Control (ABAC): ABAC is an authorization system that defines access based on attributes associated with security principals, resources, and the environment of an access request. With ABAC, you can grant a security principal access to a resource based on attributes. For example, you can add a condition that requires an object to have a specific tag to read the object. ABAC allows for more fine-grained access control and can help reduce the number of role assignments.
The dashboard offers GUI support to configure RBAC policies in realtime
as well as a code editor to configure any other types of policies
Check out the UI design on Figma here