OPA user-info-fetcher sync

[dshershov]

Hello, guys!
I have a some question about working on user-info-fetcher

Previously I used airflow dag sync which works with kk api to download my group and user list.
Now I work with awesome tool user-info-fetcher and try to sync my keycloak groups with OPA

So, when I check list for my user in sidecar used curl -X POST localhost:9476/user -H 'Content-Type: application/json' -d '{"username": "MY-USER-NAME"}' - I can see that all fine:

{
  "id": "SOME ID ",
  "username": "MY-USER-NAME",
  "groups": [
    "/DevOps",
    "/another-groups"
  ],
  "customAttributes": {
    "LDAP_ENTRY_DN": [
      "CN=blahblahblah"
    ],
    "createTimestamp": [
      "20230130130105.0Z"
    ]
  }
}

Rego manifest looks like that:

default allow := false

allow if {
    user := data.stackable.opa.userinfo.v1.userInfoByUsername(input. username)
    "/DevOps" in user.groups
}

But auth isn't working with DENIED error...
Could u can help me with debug this step? probably I can check INPUT block in logs?
Thanks a lot!

[maltesander]

Hi,

There is an extra space in your username reference.

default allow := false

allow if {
    user := data.stackable.opa.userinfo.v1.userInfoByUsername(input.username)
    "/DevOps" in user.groups
}

Otherwise can you check the OPA logs that the input OPA receives is something like this:

{
  "input": {
    "username": "someusername"
  }
}

[dshershov]

I will try to use userInfoByUsername(input.username) and userInfoById(input.id) and missed it when copy for u here, sry about that

I think that I have some trouble with input.id/username path - maybe I need input.conext.id or something like that? but I don't know how to get all INPUT list

[maltesander]

That depends on how your body looks. You can activate decision logging like described here https://docs.stackable.tech/home/stable/opa/usage-guide/logging/#_decision_logging

  servers:
    config:
      logging:
        containers:
          opa:
            console:
              level: INFO
            file:
              level: INFO
            loggers:
              decision:  
                level: INFO

And then check how the request you receive looks like.

[dshershov]

stackabletech/opa-operator#711 (comment)
works for me