Rules Conditions

As explained in the previous chapter, Security Policies are a set of rules that are evaluated at runtime to answer simple questions and return an "Allow" or "Deny" response.

Comparators

Conditions are evaluated against various metadata (see next sections) using one of the following comparator:

Glob Matcher

The Glob Matcher comparator is a specific manager performing "glob-like" comparison against files/folders paths. As such it's probably only useful in association with the FullPath field.

The expected pattern supports some specific flags and wildchars using the following format ([flags])/path/to/folder/[wildchars]:

• Flags:
  • i : for case-insensitive comparison
  • p : The p flag refers to 'parents'. It means that it applies similarly to all segments of the path
• Wildchars:
  • * : applies to all children first-level
  • ** : applies to all children recursively

Using these flags, you can for example provide a Read/Write access only to a specific folder and everything below, by combining two rules:

• (ip)datasource/path/to/folder => [R] : open traversing (R) access to the folder's parents
• (i)datasource/path/to/folder{,/**} => [RW] : allow creating any resource inside this folder and inside this folder chilren: braces are equivalent to /folder OR /folder/**

While the examples above match a fixed folder, Glob provides the ability to match a recurring pattern. A common use case can be to have "one folder per partner/client/collaborator" with a fixed structure of folders inside each, and to create rules to access only specific folders. Let's say you have

Master folder under datasource/path :

• ClientA
  • Commercial
  • Support
• ClientB
  • Commercial
  • Support
• ClientC
  • Commercial
  • Support
• And so on...

Create a profile that will only interact with the inner Support folders, the rules above can be changed to :

• (ip)datasource/path/*/Support => [R] : open traversing (R) access to this pattern (any clients)
• (i)datasource/path/*/Support{,/**} => [RW] : allow creating any resource inside Support and below

Request Metadata

Every request sent to the server via Cells APIs carries a set of metadata that can be used in Conditions to restrict or authorize particular accesses.

Nodes Metadata

Many Cells REST API requests carry information about a specific "node", which is a file or folder, located in one of the authorized workspace. This node may or may not exist at the time of the request.

Typically, an upload request will "PUT" an object to "/workspace/path/to/file.ext" that does not exist yet. On the other hand, a listing or stat request will generally point to an existing file that can expose its own advanced metadata.

Using Custom Metadata can be typically used to evaluate a condition against user-defined tags. For example, you can define a policy that hides any file tagged with a specific value (like "confidential"), or on the opposite only show files that are tagged with a specific value (like "scanned-for-viruses")

Examples

Below are some condition examples:

Using Go Templates

As a bonus, to provide even more flexibility and make security policies totally dynamic, you can also use Go Templates inside the various conditions fields, which can be handy if you want to compare to a context-related value. Typically, one could compare a custom metadata content to the currently-logged user login, enabling/disabling specific permissions for the owner of a file.

The available template variables are as follows: