docs: decision record for scope-based API authorization - #430
Closed
paullatzelsperger wants to merge 529 commits into
Closed
docs: decision record for scope-based API authorization#430paullatzelsperger wants to merge 529 commits into
paullatzelsperger wants to merge 529 commits into
Conversation
* feat: add column for `private_entries` * checkstyle
…e storage (eclipse-edc#5381) fix: strip eventual secret from transfer destination before storage
…on termination event (eclipse-edc#5362) * fix(data-plane-core) Restore the final status of the lease renewal coverage task When the asynchronous execution result of a task and the lease renewal occur concurrently, it may cause the status of the task execution result to be reset to "STARTED" due to the lease renewal. By fixing the lease renewal process to only update the "updatedAt" field, we ensure that the final state is not overwritten. * Fix flow state assertions in UpdateFlowLease test * Add assertTrue import for unit tests * Replace assertTrue with assertThat for clarity * Update test to check flow state and updatedAt * Add import for java.time.Clock in DataPlaneManagerImplTest * Add assertion for data flow save in tests * fix(contract): Add the reason for the error in the contract negotiation termination event - Add the "reason" field in the "ContractNegotiationTerminated" event - Modify the event construction logic to include the error details of the negotiation - Update the test cases to verify the correct transmission of the error cause
* feat: refactor hashicorp vault # Conflicts: # core/common/connector-core/src/main/java/org/eclipse/edc/connector/core/SecurityDefaultServicesExtension.java # core/common/lib/keys-lib/src/main/java/org/eclipse/edc/keys/VaultPrivateKeyResolver.java # core/common/lib/keys-lib/src/test/java/org/eclipse/edc/keys/VaultPrivateKeyResolverTest.java # core/control-plane/control-plane-transfer-manager/src/main/java/org/eclipse/edc/connector/controlplane/transfer/TransferManagerExtension.java # spi/common/boot-spi/src/main/java/org/eclipse/edc/spi/security/Vault.java * fix compile error * sourcedoc, tests * source doc, tests * add tests (wip) * add tests, refactor token provider factory * add tests, some cosmetics * fall back to default vault if partition config not found * make fallback vault configurable
feat: allow extensibilit of PC
….0-alpha to 1.9.0-alpha (eclipse-edc#5388) build(deps): bump io.opentelemetry.proto:opentelemetry-proto Bumps [io.opentelemetry.proto:opentelemetry-proto](https://github.com/open-telemetry/opentelemetry-proto-java) from 1.8.0-alpha to 1.9.0-alpha. - [Release notes](https://github.com/open-telemetry/opentelemetry-proto-java/releases) - [Commits](https://github.com/open-telemetry/opentelemetry-proto-java/commits) --- updated-dependencies: - dependency-name: io.opentelemetry.proto:opentelemetry-proto dependency-version: 1.9.0-alpha dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…#5389) Bumps `bouncyCastle-jdk18on` from 1.82 to 1.83. Updates `org.bouncycastle:bcpkix-jdk18on` from 1.82 to 1.83 - [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html) - [Commits](https://github.com/bcgit/bc-java/commits) Updates `org.bouncycastle:bcprov-jdk18on` from 1.82 to 1.83 - [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html) - [Commits](https://github.com/bcgit/bc-java/commits) --- updated-dependencies: - dependency-name: org.bouncycastle:bcpkix-jdk18on dependency-version: '1.83' dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: org.bouncycastle:bcprov-jdk18on dependency-version: '1.83' dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
chore: fix package declaration
chore: moves edc catalog transformers
Bumps `swagger` from 2.2.40 to 2.2.41. Updates `io.swagger.core.v3:swagger-annotations-jakarta` from 2.2.40 to 2.2.41 Updates `io.swagger.core.v3.swagger-gradle-plugin` from 2.2.40 to 2.2.41 --- updated-dependencies: - dependency-name: io.swagger.core.v3:swagger-annotations-jakarta dependency-version: 2.2.41 dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.swagger.core.v3.swagger-gradle-plugin dependency-version: 2.2.41 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps `jetty` from 12.1.4 to 12.1.5. Updates `org.eclipse.jetty:jetty-http` from 12.1.4 to 12.1.5 Updates `org.eclipse.jetty:jetty-server` from 12.1.4 to 12.1.5 Updates `org.eclipse.jetty.ee10:jetty-ee10-servlet` from 12.1.4 to 12.1.5 Updates `org.eclipse.jetty.websocket:jetty-websocket` from 12.1.4 to 12.1.5 --- updated-dependencies: - dependency-name: org.eclipse.jetty:jetty-http dependency-version: 12.1.5 dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: org.eclipse.jetty:jetty-server dependency-version: 12.1.5 dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: org.eclipse.jetty.ee10:jetty-ee10-servlet dependency-version: 12.1.5 dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: org.eclipse.jetty.websocket:jetty-websocket dependency-version: 12.1.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…c#5400) Bumps [com.gradleup.shadow](https://github.com/GradleUp/shadow) from 9.2.2 to 9.3.0. - [Release notes](https://github.com/GradleUp/shadow/releases) - [Commits](GradleUp/shadow@9.2.2...9.3.0) --- updated-dependencies: - dependency-name: com.gradleup.shadow dependency-version: 9.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…c#5406) feat: data flow controller selection
fix: copy private properties over
* feat: profile field in CatalogRequest and DatasetRequest * feat: profile field in ContractRequest and ContractNegotiation * feat: profile field in Transfer Request * feat: switch to profile in mgmt v5 fixtures api * chore: update mgmt api version file * chore: fix tests * chore: pr suggiestions
…clipse-edc#5752) * feat: add validation of profile/protocol field in v5 management api * chore: pr suggiestions
Bumps `cloudEvents` from 4.0.1 to 4.0.2. Updates `io.cloudevents:cloudevents-http-basic` from 4.0.1 to 4.0.2 Updates `io.cloudevents:cloudevents-json-jackson` from 4.0.1 to 4.0.2 --- updated-dependencies: - dependency-name: io.cloudevents:cloudevents-http-basic dependency-version: 4.0.2 dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.cloudevents:cloudevents-json-jackson dependency-version: 4.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps `swagger` from 2.2.49 to 2.2.50. Updates `io.swagger.core.v3:swagger-annotations-jakarta` from 2.2.49 to 2.2.50 Updates `io.swagger.core.v3.swagger-gradle-plugin` from 2.2.49 to 2.2.50 --- updated-dependencies: - dependency-name: io.swagger.core.v3.swagger-gradle-plugin dependency-version: 2.2.50 dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.swagger.core.v3:swagger-annotations-jakarta dependency-version: 2.2.50 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…#5785) * feat: add profile based validation for policy definition * chore: fix tests
…ansformer (eclipse-edc#5787) fix: properly map name and description from VC payload in JwtToVerifiableCredentialTransformer Previously, the transformer incorrectly set name to the JWT subject claim. Now name and description are read directly from the vc object properties, and the JWT subject is no longer used as a fallback for name. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* refactor: discovery response improvements * chore: update management-api version
Describes moving the EDC management API from role-based to scope-based access control: a hierarchy-capable scope grammar (management-api:[resource:]action, admin superset of write superset of read), retaining the runtime resource-ownership check with admin as the cross-tenant elevation flag, moving principal identity to the standard sub claim, and removing the role/provisioner concept. This retires the custom Keycloak extensions and makes the connector IdP-agnostic. Notes the breaking nature and downstream impact (notably IdentityHub). Signed-off-by: Paul Latzelsperger <paul.latzelsperger@beardyinc.com> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Owner
Author
|
Superseded by eclipse-edc#5798 (retargeted to the upstream repo). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
12 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this does
Adds a decision record proposing the move from role-based to scope-based access control on the EDC management API.
Key points:
roleclaim,@RolesAllowed, and theadmin/provisioner/participantroles; authorize via a single, hierarchy-capablescopeclaim — grammarmanagement-api:[resource:]action, withadmin ⊇ write ⊇ readand a*resource wildcard.…:adminis the cross-tenant elevation flag. Ownership is data-dependent and not expressible as a static scope.subclaim, retiring the customparticipant_context_idinjector.Document:
docs/developer/decision-records/2026-06-06-scope-based-api-authorization/README.mdDraft — opening for review of the decision record itself before implementation. The implementation (a
Scope/ScopeMatcherinauth-spiplus theAuthorizationServiceImplelevation change) will follow in a separate PR.🤖 Generated with Claude Code