A cloud native Identity & Access Proxy / API (IAP) and Access Control Decision API

Last update: Jan 6, 2023

Comments: 15

Heimdall

Heimdall is inspired by Ory's OAthkeeper, tries however to resolve the functional limitations of that product by also building on a more modern technology stack resulting in a much simpler and faster implementation.

Heimdall authenticates and authorizes incoming HTTP requests as well as enriches these with further information and transforms resulting subject information to a format, both required by the upstream services. It is supposed to be used either as a Reverse Proxy in front of your upstream API or web server that rejects unauthorized requests and forwards authorized ones to your end points, or as a Decision API, which integrates with your API Gateway (Kong, NGNIX, Envoy, Traefik, etc) and then acts as a Policy Decision Point.

The current implementation is a pre alpha version, but already supports

Decision API
Loading rules from the file system
Authenticator types (anonymous, basic-auth, generic, jwt, noop, oauth2 introspection, unauthorized)
Authorizers (allow, deny, subject attributes & remote)
Hydrators (generic) - to enrich the subject information retrieved from the authenticator
Mutators (opaque cookie, opaque header, jwt in the Authorization header, noop) to transform the subject information
Error Handlers (default, redirect, www-authenticate), which support accept type negotiation as well
Opentracing support (jaeger & instana)
Key store in pem format for rsa-pss and ecdsa keys (pkcs#1 - plain only & pkcs#8 - plain and encrypted)
Rules URL matching
Flexible pipeline definition: authenticators+ -> any order(authorizer+, hydrator*) -> mutator+ -> error_handler+
Optional default rule taking effect if no rule matches
If Default rule is configured, the actual rule definition can reuse it (less yaml code)
Typical execution time if caches are active is around 300µs (on my laptop)

Features to come are (more or less in this sequence):

Not really a feature - but tests, tests, tests ;)
Use the defined JSON schema to validate the configuration.
Documentation
X.509 certificates in key store
jwks endpoint to let the upstream service verify the jwt signatures
Health & Readiness Probes
k8s CRDs to load rules from.
Reverse Proxy

Owner

Dimitrij Drus

https://github.com/dadrus/heimdall

Comments

chore(deps): update module k8s.io/client-go to v11
This PR contains the following updates:

| Package | Type | Update | Change | |---|---|---|---| | k8s.io/client-go | require | major | v0.25.4 -> v11.0.0+incompatible |

Release Notes

kubernetes/client-go

v11.0.0+incompatible

Compare Source

v10.0.0+incompatible

Compare Source

v9.0.0+incompatible

Compare Source

v8.0.0+incompatible

Compare Source

v7.0.0+incompatible

Compare Source

v6.0.0+incompatible

Compare Source

v5.0.1+incompatible

Compare Source

v5.0.0+incompatible

Compare Source

v4.0.0+incompatible

Compare Source

v3.0.0+incompatible

Compare Source

v2.0.0+incompatible

Compare Source

v1.5.2

Compare Source

v1.5.1

Compare Source

v1.5.0

Compare Source

Included the auth plugin (https://github.com/kubernetes/kubernetes/pull/33334)

Added timeout field to RESTClient config (https://github.com/kubernetes/kubernetes/pull/33958)

v1.4.0

Compare Source

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

[ ] If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.
chore(deps): update github.com/johannesboyne/gofakes3 digest to df26ca4
This PR contains the following updates:

| Package | Type | Update | Change | |---|---|---|---| | github.com/johannesboyne/gofakes3 | require | digest | 1065b17 -> df26ca4 |

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

[ ] If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.
chore: commands in k8s quickstart readme updated
Related issue(s)

none

Checklist

[x] I agree to follow this project's Code of Conduct.

[x] I have read, and I am following this repository's Contributing Guidelines.

[x] I have read the Security Policy.

[x] I have updated the documentation.

Description

This PR updates the Kubernetes quick start readme: some of the documented cmd commands were not complete. So, would not lead to the expected result.
refactor!: New type for key store configuration introduced
Related issue(s)

relates to #274

Checklist

[x] I agree to follow this project's Code of Conduct.

[x] I have read, and I am following this repository's Contributing Guidelines.

[x] I have read the Security Policy.

[x] I have referenced an issue describing the bug/feature request.

[x] I have added tests that prove the correctness of my implementation.

[x] I have updated the documentation.

Description

This PR introduces a dedicated configuration type for Key Stores:

key_store: path: /path/to/keystore.pem password: SomePassword

On one hand, that would be required anyway, when #274 will be addressed (in sense of the configuration new type property will be introduced). On the other hand, it makes the documentation less repetitive and allows better handling of key stores in code by having same structures for all available key stores, without the need to know, for which purpose it was configured.

However, this PR does also introduce a breaking change. Here an overview, how key stores were configured before this PR, and how they have to be configured after this PR is merged:

Old tls configuration:

tls: key_store: /path/to/keystore.pem password: SomePassword # other tls specific properties

New tls configuration:

tls: key_store: path: /path/to/keystore.pem password: SomePassword # other tls specific properties

Old signer configuration:

signer: key_store: /path/to/keystore.pem password: SomePassword # other signer specific properties

New signer configuration:

signer: key_store: path: /path/to/keystore.pem password: SomePassword # other signer specific properties

Changelist

Hopefully this PR does also fix a flacky cloudblob implementation related test, which sometimes fails (a DNS error is expected, but does not happen)
chore: Helm chart version badge added
Related issue(s)

Does not relate to any issue

Checklist

[x] I agree to follow this project's Code of Conduct.

[x] I have read, and I am following this repository's Contributing Guidelines.

[x] I have read the Security Policy.

Description

Adds a badge about the released Helm Chart to the README.md file
feat: Remaining validity of configured certificates exposed as metric
Related issue(s)

closes #397

Checklist

[x] I agree to follow this project's Code of Conduct.

[x] I have read, and I am following this repository's Contributing Guidelines.

[x] I have read the Security Policy.

[x] I have referenced an issue describing the bug/feature request.

[x] I have added tests that prove the correctness of my implementation.

[x] I have updated the documentation.

Description

Implements new gauge metrics for all certificates configured in all key stores.
chore: helm chart release 0.2.0
Related issue(s)

relates to #422 and #420

Checklist

[x] I agree to follow this project's Code of Conduct.

[x] I have read, and I am following this repository's Contributing Guidelines.

[x] I have read the Security Policy.

[x] I have referenced an issue describing the bug/feature request.

Description

Releases new chart version (0.2.0), with the fix implemented in #420. This way, there is no need to wait until the new heimdall release (#423) is done. In addition, this PR updates the documentation and the README of the chart with information about monitoring as possible chart post installation steps.
chore(deps): update module go.uber.org/fx to v1.19.0
This PR contains the following updates:

| Package | Type | Update | Change | |---|---|---|---| | go.uber.org/fx | require | minor | v1.18.2 -> v1.19.0 |

Release Notes

uber-go/fx

v1.19.0

Compare Source

Added

fx.RecoverFromPanics Option which allows Fx to recover from user-provided constructors and invoked functions.

fx.Private that allows the constructor to limit the scope of its outputs to the wrapping fx.Module.

ExitCode ShutdownOption which allows setting custom exit code at the end of app lifecycle.

Wait which returns a channel that can be used for waiting on application shutdown.

fxevent/ZapLogger now exposes UseLogLevel and UseErrorLevel methods to set the level of the Zap logs produced by it.

Add lifecycle hook-convertible methods: StartHook, StopHook, StartStopHook that can be used with more function signatures.

Changed

fx.WithLogger can now be passed at fx.Module level, setting custom logger at Module scope instead of the whole App.

Fixed

fx.OnStart and fx.OnStop Annotations now work with annotated types that was provided by the annotated constructor.

fxevent/ZapLogger: Errors from fx.Supply are now logged at Error level, not Info.

A race condition in lifecycle Start/Stop methods.

Typos in docs.

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

[ ] If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.
chore(deps): update github.com/johannesboyne/gofakes3 digest to 1065b17
This PR contains the following updates:

| Package | Type | Update | Change | |---|---|---|---| | github.com/johannesboyne/gofakes3 | require | digest | c2f5cc6 -> 1065b17 |

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

[ ] If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.
chore: build recipe in Justfile fixed to reference the proper module for embedding version information
Related issue(s)

Not related to any documented issue

Checklist

[x] I agree to follow this project's Code of Conduct.

[x] I have read, and I am following this repository's Contributing Guidelines.

[x] I have read the Security Policy.

Description

After moving the Version type into its own module, the build recipe in Justfile has not been updated. That rendered local builds useless regarding the embedded version information - it was just not set until this PR.
docs: Example setups for docker-compose and kubernetes
Related issue(s)

closes #407 closes #408

Checklist

[x] I agree to follow this project's Code of Conduct.

[x] I have read, and I am following this repository's Contributing Guidelines.

[x] I have read the Security Policy.

[x] I have referenced an issue describing the bug/feature request.

[x] I have updated the documentation.

Description

This PR adds fully working examples for quickstarts and guides described in the documentation. These can also be used to verify the Helm Chart is working (even if not a demo set is done - see #422)
wip: Version schema for rule sets
Related issue(s)

closes #398

Checklist

[x] I agree to follow this project's Code of Conduct.

[x] I have read, and I am following this repository's Contributing Guidelines.

[x] I have read the Security Policy.

[x] I have referenced an issue describing the bug/feature request.

[ ] I have added tests that prove the correctness of my implementation.

[ ] I have updated the documentation.

Description

Implements a version schema for rule sets, which are not loaded from Kubernetes resources (the corresponding CRD has its own schema). This will make heimdall deployments better manageable and allow migration of rule sets to new versions if a new version of heimdall does not support an older version anymore. Future releases might implement a command to enable automatic migrations.

This PR introduces a breaking change as the rule set structure has been changed.

Here are the changes introduced by this PR:

Old rule set definition:

- id: rule1 match: url: http://foo.bar/<**> strategy: glob upstream: http://bar.foo methods: - GET - POST execute: # rule specific pipeline - .... on_error: # rule specific error pipeline - .... - id: rule2 # etc

New rule set definition

version: v1alpha1 # <-- new property. Same version values as for the rule sets deployed in Kubernetes name: some name # <-- new property. Optional name for the rule set. rules: # <-- new property. All rules of a rule set must be defined here. - id: rule1 match: url: http://foo.bar/<**> strategy: glob upstream: http://bar.foo methods: - GET - POST execute: # rule specific pipeline - .... on_error: # rule specific error pipeline - .... - id: rule2 # etc

This way rule sets deployed as resources in Kubernetes, as well as rule sets loaded from other providers have comparable structure and same versioning.
chore(deps): update golang.org/x/exp digest to 4b8118a
This PR contains the following updates:

| Package | Type | Update | Change | |---|---|---|---| | golang.org/x/exp | require | digest | 738e83a -> 4b8118a |

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

[ ] If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.
chore(main): release 0.6.0-alpha
:robot: I have created a release beep boop

0.6.0-alpha (2023-01-09)

⚠ BREAKING CHANGES

New type for key store configuration introduced (#434)

Features

Remaining validity of configured certificates exposed as metric (#432) (95b24f0)

Bug Fixes

Helm Chart fixed and does neither expect a heimdall config file, nor check for not existing property anymore (#420) (8a0c299)

Code Refactoring

New type for key store configuration introduced (#434) (b2a9e58)

This PR was generated with Release Please. See documentation.
Support the configuration of credentials verified by basic auth authenticator in PHC format

... including the support for argon2, scrypt, bcrypt and pbkdf2 to increase security. Thus way this authenticator will not only be resistant against side channel attacks (implemented today), but also against brute force, dictionary, etc attacks.

Related tags

Public API Wrappers heimdall

Graph Role-Based Access Control by Animeshon

gRBAC - Graph Role-Based Access Control A cloud-native graph implementation of the Role-Based Access Control (RBAC) authorization architecture powered

Nov 9, 2022

Cloud governance reports from native services in a clear and readable digest

cloudig, or Cloudigest, is a simple CLI tool for creating reports from various cloud sources with user-provided comments. It is written in Go and curr

Nov 10, 2022

rpCheckup is an AWS resource policy security checkup tool that identifies public, external account access, intra-org account access, and private resources.

rpCheckup - Catch AWS resource policy backdoors like Endgame rpCheckup is an AWS resource policy security checkup tool that identifies public, externa

Dec 26, 2022

Breaking Cloud Native Web APIs in their natural habitat.

cnfuzz - Cloud Native Web API Fuzzer "Breaking Cloud Native Web APIs in their natural habitat." Fuzzing web APIs in their fully converged Cloud Native

Nov 28, 2022

A collection of cloud security icons :cloud::lock:

Cloud Security Icons These icons are published under the extremely permissive Creative Commons Zero v1.0 Universal license. Downloads We provide all i

Jan 7, 2023

lambda-go-api-proxy makes it easy to port APIs written with Go frameworks such as Gin to AWS Lambda and Amazon API Gateway.

aws-lambda-go-api-proxy makes it easy to run Golang APIs written with frameworks such as Gin with AWS Lambda and Amazon API Gateway.

Jan 6, 2023

A cloud native Identity & Access Proxy / API (IAP) and Access Control Decision API

Heimdall

Owner

Dimitrij Drus

Comments

chore(deps): update module k8s.io/client-go to v11

Release Notes

Configuration

chore(deps): update github.com/johannesboyne/gofakes3 digest to df26ca4

Configuration

chore: commands in k8s quickstart readme updated

Related issue(s)

Checklist

Description

refactor!: New type for key store configuration introduced

Related issue(s)

Checklist

Description

Changelist

chore: Helm chart version badge added

Related issue(s)

Checklist

Description

feat: Remaining validity of configured certificates exposed as metric

Related issue(s)

Checklist

Description

chore: helm chart release 0.2.0

Related issue(s)

Checklist

Description

chore(deps): update module go.uber.org/fx to v1.19.0

Release Notes

Added

Changed

Fixed

Configuration

chore(deps): update github.com/johannesboyne/gofakes3 digest to 1065b17

Configuration

chore: build recipe in Justfile fixed to reference the proper module for embedding version information

Related issue(s)

Checklist

Description

docs: Example setups for docker-compose and kubernetes

Related issue(s)

Checklist

Description

wip: Version schema for rule sets

Related issue(s)

Checklist

Description

chore(deps): update golang.org/x/exp digest to 4b8118a

Configuration

chore(main): release 0.6.0-alpha

:robot: I have created a release beep boop

0.6.0-alpha (2023-01-09)

⚠ BREAKING CHANGES

Features

Bug Fixes

Code Refactoring

Support the configuration of credentials verified by basic auth authenticator in PHC format

Related tags

Graph Role-Based Access Control by Animeshon

Cloud governance reports from native services in a clear and readable digest

rpCheckup is an AWS resource policy security checkup tool that identifies public, external account access, intra-org account access, and private resources.

Breaking Cloud Native Web APIs in their natural habitat.

A collection of cloud security icons :cloud::lock:

lambda-go-api-proxy makes it easy to port APIs written with Go frameworks such as Gin to AWS Lambda and Amazon API Gateway.

Command line interface to windows clipboard over KiTTY remote-control printing

🐥 Sturdy is an open-source, real-time, version control platform for startups

Fast and light-weight API proxy firewall for request and response validation by OpenAPI specs.

Clusterpedia-client - clusterpedia-client supports the use of native client-go mode to call the clusterpedia API

Client-go - Clusterpedia-client supports the use of native client-go mode to call the clusterpedia API

SDK to provide access to JUNO API (Open Banking) (2.0.0)

A simple Kubernetes-native CI system for the Bhojpur.NET Platform.

Go library to access geocoding and reverse geocoding APIs

Automatically roll your AWS IAM access key (aws_access_key_id) and secret key (aws_secret_access_key).

A note taking app, that you can draw in, syncs to the cloud, and is on most platforms!

Useful AWS access key attribution tool

A package for access aws service using AWS SDK for Golang