<p>Looking into using Istio to handle Authorization for an application built on a microservices architecture in Kubernetes.</p>

<p>One thing we're looking to accomplish is to decouple the authorization of a service by utilizing Istio Authorization.</p>

<p>Our API Gateway (Kong) will handle the verification/parsing of the JWT tokens and pass along any required attributes (usernames, groups, roles etc) as headers e.g. x-username: homer@somewhere.com (abstracts that from the services)</p>

<p>What we want to accomplish is along with verifying based on roles etc we also want to ensure that the x-username is also the owner of the resource e.g. if they are accessing:</p>

<pre><code>/user/{userID}/resource
</code></pre>

<p>That would mean if userId matches the value of the x-username header we can continue serving the request, otherwise we'll send a 401 etc</p>

<p>Is there a way to configure this as part of Istio Authorization?</p>

<p>Thanks in advance for your time</p>

<p>What you're looking for is attribute based access control (<a href="/questions/tagged/abac" class="post-tag" title="show questions tagged &#39;abac&#39;" rel="tag">abac</a>). Look into authorization engines e.g. Axiomatics that plug straight into Kong and provides that level of access control (ownership check).</p>

<ul>
<li><p>Kong authorization <a href="https://github.com/ioannis-iordanidis/kong-axiomatics-plugin" rel="nofollow noreferrer">handler on GitHub</a></p></li>
<li><p>Technical <a href="https://ma.axiomatics.com/acton/media/10529/open-source-api-gateways-and-dynamic-authorization-working-with-kong" rel="nofollow noreferrer">webcast</a> on the integration</p></li>
</ul>

<p>You could also choose to call Axiomatics from Isitio using an adapter based on Istio's <a href="https://istio.io/docs/reference/config/policy-and-telemetry/templates/authorization/" rel="nofollow noreferrer">authorization template</a>.</p>

<p>Policies in Axiomatics are written using either XACML or <a href="https://en.wikipedia.org/wiki/ALFA_(XACML)" rel="nofollow noreferrer">ALFA</a> which are the 2 OASIS standards for ABAC / fine-grained authorization.</p>

<p>You could easily write a condition along the lines of:</p>

<pre><code>rule checkOwner{
    deny
    condition not(owner==user.uid)
}
</code></pre>

<p>BTW you probably want to send back a 403 rather than 401. The latter refers to failed authentication.</p>
