improve opa rules and fix reporting task access

Author: maltesander

tests/templates/kuttl/oidc-opa/25-opa-rego.yaml

@@ -9,6 +9,9 @@ data:
   nifi.rego: |
     package nifi
 
+    nifi_node_proxy := "CN=generated certificate for pod"
+    nifi_reporting_task_user := "admin"
+
     # Setting "resourceNotFound" to true results in the parent resource beingevaluated for authorization,
     # e.g. the parent of a processor is the processor-group.
     # If a resource is matched by a rego rule that is not the default the parent resource will be ignored.
@@ -61,15 +64,47 @@ data:
       group == "nifi-user"
     }
 
+    ### Reporting Task permissions (NiFi 1.x.x)
+
+    # Allow the reporting task user
+    allow := {
+      "allowed": true,
+      "dumpCache": true
+    } if {
+      input.identity.name == nifi_reporting_task_user
+    }
+
+    ### NiFi Node permissions
+
+    # NiFi Nodes need this permission to communicate with each other
     allow := {
       "allowed": true,
       "dumpCache": true
     } if {
-      input.identity.name == "CN=generated certificate for pod"
+      input.identity.name == nifi_node_proxy
       input.resource.id == "/proxy"
     }
 
-    user_groups := user_groups if {
-      user_group_paths := data.stackable.opa.userinfo.v1.userInfoByUsername(input.identity.name).groups
-      user_groups := [ trim(user_group,"/") | user_group := user_group_paths[_] ]
+    # Check processor queues
+    allow := {
+      "allowed": true,
+      "dumpCache": true
+    } if {
+      input.identity.name == nifi_node_proxy
+      startswith(input.resource.id, "/data/processors/")
+    }
+
+    ### Helper functions
+
+    user_groups := get_user_groups(input.identity.name)
+
+    get_user_groups(name) = groups if {
+      not startswith(name, nifi_node_proxy)
+      groups_raw := data.stackable.opa.userinfo.v1.userInfoByUsername(name).groups
+      groups := [trim(g, "/") | g := groups_raw[_]]
+    }
+
+    # filter nifi_node_proxy calls to UIF
+    get_user_groups(name) := [] if {
+      startswith(name, nifi_node_proxy)
     }