{"action":"opened","issue":{"url":"https://api.github.com/repos/ory-am/hydra/issues/268","repository_url":"https://api.github.com/repos/ory-am/hydra","labels_url":"https://api.github.com/repos/ory-am/hydra/issues/268/labels{/name}","comments_url":"https://api.github.com/repos/ory-am/hydra/issues/268/comments","events_url":"https://api.github.com/repos/ory-am/hydra/issues/268/events","html_url":"https://github.com/ory-am/hydra/issues/268","id":179994245,"number":268,"title":"Please clarify warden/token/valid API","user":{"login":"nikolay-turpitko","id":1192730,"avatar_url":"https://avatars.githubusercontent.com/u/1192730?v=3","gravatar_id":"","url":"https://api.github.com/users/nikolay-turpitko","html_url":"https://github.com/nikolay-turpitko","followers_url":"https://api.github.com/users/nikolay-turpitko/followers","following_url":"https://api.github.com/users/nikolay-turpitko/following{/other_user}","gists_url":"https://api.github.com/users/nikolay-turpitko/gists{/gist_id}","starred_url":"https://api.github.com/users/nikolay-turpitko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nikolay-turpitko/subscriptions","organizations_url":"https://api.github.com/users/nikolay-turpitko/orgs","repos_url":"https://api.github.com/users/nikolay-turpitko/repos","events_url":"https://api.github.com/users/nikolay-turpitko/events{/privacy}","received_events_url":"https://api.github.com/users/nikolay-turpitko/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-09-29T09:16:45Z","updated_at":"2016-09-29T09:16:45Z","closed_at":null,"body":"At http://docs.hdyra.apiary.io/#reference/warden:-access-control-for-resource-providers/check-if-an-access-tokens-subject-is-allowed-to-do-something/check-if-an-access-token's-subject-is-allowed-to-do-something\r\n\r\n```\r\nAccess Control Requirements\r\nResource: rn:hydra:warden:token:allowed:<id>\r\n```\r\n\r\nWhat exactly is `<id>`? Is it id of another policy which this token allowed to check or something else?\r\n\r\nParticularly, we want to create set of policies, to manage access to particular API methods of our app. Like:\r\ntoken xxx allowed to do GET requests to /api/profile,\r\ntoken yyy allowed to do also POST requests to /api/profile, etc.\r\n\r\nIn our middleware we are trying to check if access token from web client allowed to do particular task.\r\n\r\nNow we are struggling with policies setup. I understood that we must allow to server-to-server token to do requests to validate other tokens like:\r\n`hydra policies create --allow -r \"rn:hydra:warden:token:allowed:<[^:]+>\" -s \"<.*>\" -a \"decide\" --skip-tls-verify` (allow everyone to decide). And `hydra policies create --allow -r \"/api/profile\" -s \"<.*>\" -a \"GET\" --skip-tls-verify` (allow everyone to access particular URL).\r\n\r\nWith this setup we get 403 Forbidden in Hydra log. What we are missing?\r\nAlso, is it allowed to use slashes in resource field?\r\n\r\nIs it possible to restrict access to particular URL for some client_id in this request?"}}
{"actor":{"display_login":"nikolay-turpitko"}}