SDK (function) to list NPE/PE attributes?

[b-long]

Using the golang SDK, is there a mechanism to identify the attributes that an NPE or PE has?

In other words, if I want to call the function below, and set values to something appropriate; is there a function that I can call elsewhere (e.g. in an integration test) to list potential values ?

// Based on 
// - https://github.com/opentdf/platform/tree/main/sdk
// - https://github.com/opentdf/otdfctl
//
// Create a TDF
_, err = sdkClient.CreateTDF(enc, bytes.NewReader(b),
	sdk.WithDataAttributes(values...),
	sdk.WithKasInformation(sdk.KASInfo{
		URL:       config.KasUrl,
		PublicKey: "",
	},
	),
)

[jrschumacher]

Yes, but we don't have a convenient method quite yet. What you'll need to do is use the Authorization Service https://github.com/opentdf/platform/blob/main/sdk/sdk.go#L140 which uses this proto https://github.com/opentdf/platform/blob/main/service/authorization/authorization.proto.

Also keep in mind that the client (i.e. service-client) will need the appropriate permissions.

It should look something like this, but keep in mind you'll need to import the protocols for authorization.

package main

import "github.com/opentdf/platform/protocol/go/authorization"

// ... 
sdkClient.Authorization.GetEntitlements(context.TODO(), &authorization.GetEntitlementsRequest{
	Entities: []*authorization.Entity{
		{
			Id:           "e1",
			EntityType: &authorization.Entity_EmailAddress{
				EmailAddress: "bob@example.com",
			},
		},
	},
})

[b-long]

Will this idea only work for entities with an email address? Is there a different usage for other accounts (and PEs vs NPEs)? In particular, I'm wondering about the opentdf-sdk NPE or an application NPE (down the road):

platform/service/cmd/keycloak_data.yaml

Lines 39 to 49 in 57c2a45

	- client:
	clientID: opentdf-sdk
	enabled: true
	name: opentdf-sdk
	serviceAccountsEnabled: true
	clientAuthenticatorType: client-secret
	secret: secret
	protocolMappers:
	- *customAudMapper
	sa_realm_roles:
	- opentdf-standard

[jrschumacher]

These are current, supported entity types:

platform/service/authorization/authorization.proto

Lines 20 to 28 in 57c2a45

	oneof entity_type {
	string email_address = 2;
	string user_name = 3;
	string remote_claims_url = 4;
	string uuid = 5;
	google.protobuf.Any claims = 6;
	EntityCustom custom = 7;
	string client_id = 8;
	}

@pflynn-virtru do you any additional context?

[b-long]

Also, and you probably guessed it, I'm still learning Golang, so forgive any naive questions now or for the next decade 😆

That said, parsing this proto... does that mean that any of these fields can stand alone as an entity? I assume so, and we just have to map to the Golang values?

I must be holding it wrong. I have the following function, which works:

func encryptBytes(b []byte, values []string, config EncryptionConfig) (*bytes.Buffer, error) {
	sdkClient, err := sdk.New(config.PlatformEndpoint,
		sdk.WithClientCredentials(config.ClientId, config.ClientSecret, values),
		sdk.WithTokenEndpoint(config.TokenEndpoint),
		sdk.WithInsecurePlaintextConn(),
	)

	if err != nil {
		return nil, err
	}

	var encrypted []byte
	enc := bytes.NewBuffer(encrypted)

	// entitlements, err := sdkClient.Authorization.GetEntitlements(context.TODO(), &authorization.GetEntitlementsRequest{
	// 	Entities: []*authorization.Entity{
	// 		{
	// 			Id: config.ClientId,
	// 			EntityType: &authorization.Entity_ClientId{
	// 				ClientId: config.ClientId,
	// 			},
	// 		},
	// 	},
	// })

	// if err != nil {
	// 	return nil, err
	// }
	// fmt.Println(entitlements)

	// TODO: validate values are FQNs or return an error [https://github.com/opentdf/platform/issues/515]
	_, err = sdkClient.CreateTDF(enc, bytes.NewReader(b),
		sdk.WithDataAttributes(values...),
		sdk.WithKasInformation(sdk.KASInfo{
			URL:       config.KasUrl,
			PublicKey: "",
		},
		),
	)
	if err != nil {
		return nil, err
	}
	return enc, nil
}

But, when I uncomment the bit about obtaining entitlements it fails.

This is a contrived example, and not how I would use this in the end, but if my sdkClient works to call CreateTDF(), why is it failing to call GetEntitlements() ?

The error I get when uncommenting the broken bit is here:

status.Status {s: *google.golang.org/genproto/googleapis/rpc/status.Status {state: (*"google.golang.org/protobuf/internal/impl.MessageState")(0x140001e4240), sizeCache: 0, unknownFields: []uint8 len: 0, cap: 0, nil, Code: 16, Message: "unauthenticated", Details: []*google.golang.org/protobuf/types/known/anypb.Any len: 0, cap: 0, nil}}

[jrschumacher]

I don't know if we mentioned it, but it looks like authz is missing for this service #975. This can be worked around by overriding auth.policy.csv