cyberark / conjur-policy-generator Goto Github PK

One type of policy people will commonly encounter is the output of the EPV synchronizer. In order to make it easy to demo what this kind of policy will look like, and to make it easy to generate such policies for testing purposes, we should add a generator that mimics its structure and contents.

To do:

• figure out what the structure of a synchronizer policy is (there might be a spec, or we can work from example)
• decide what the parameters should be for the user to customize such a policy template
• add a new generator for that template
• add a rake task using that generator
• add the generator to the web UI
• write bout the generator in the README

Rack gem version has been updated to greater or equal than 2.0.6 to resolve to Rack security issues.

Right now, the only way to share a policy you create in the generator web interface is to download it and send the text file. But it would be better to also have the option to share it the same way that you see it, preserving the flexibility and display style of the web app.

This might be enabled by enhancing the URL schema to allow deep-linking into a specific generator and parameters.

The secrets control policy example currently includes a host factory with policy like:

    # === Layer for Automated Secret Access ===
    - !policy
      id: hosts
      annotations:
        description: Layer & Host Factory for machines that can read secrets
      body:
        - !layer
        - !host-factory
    - !grant
      role: !group alfa/secrets-users
      member: !layer hosts

This, however, doesn't actually link the layer to the host factory. The policy should be:

    # === Layer for Automated Secret Access ===
    - !policy
      id: hosts
      annotations:
        description: Layer & Host Factory for machines that can read secrets
      body:
        - !layer
        - !host-factory
          layer: !layer # <--- *** linked layer here ***
    - !grant
      role: !group alfa/secrets-users
      member: !layer hosts