Home / API Documentation / Platform management / Users / Resource authentication / Resource authentication

`*`Resource authentication

Requests

HTTP request

POST /auth/v1/selfsubjectaccessreviews

Request body

Content-Type application/json

Sample request

verify permissions body

{
   "apiVersion": "authorization.k8s.io/v1",
   "kind": "SelfSubjectAccessReview",
   "spec": {
     "resourceAttributes": {
       "cluster": "business",
       "group": "auth.alauda.io",
       "namespace": "myproj05-ns02",
       "project": "myproj05",
       "resource": "userbindings",
       "verb": "create"
     }
   }
 }

Parmeters

Name	Type	Required	Description
apiVersion	string	True	See common parameters
kind	string	True	See common parameters
spec	object	True	verify permissions body spec Path: spec
spec.resourceAttributes	object	True	ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface Path: spec.resourceAttributes
resourceAttributes.cluster	string	True	the cluster restruct Path: spec.resourceAttributes.cluster
resourceAttributes.group	string	True	Group is the API Group of the Resource. "" means all. Path:* spec.resourceAttributes.group
resourceAttributes.namespace	string	True	Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces "" (empty) is defaulted for LocalSubjectAccessReviews "" (empty) is empty for cluster-scoped resources "" (empty) means "all" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview Path: spec.resourceAttributes.namespace
resourceAttributes.project	string	True	the project restruct Path: spec.resourceAttributes.project
resourceAttributes.resource	string	True	Resource is one of the existing resource types. "" means all. Path:* spec.resourceAttributes.resource
resourceAttributes.verb	string	True	Verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy. "" means all. Path:* spec.resourceAttributes.verb

Responses

Content-Type application/json

Status code: 201

Sample response

SelfSubjectAccessReview checks whether or the current user can perform an action. Not filling in a spec.namespace means "in all namespaces". Self is a special case, because users should always be able to check whether they can perform an action

{
   "apiVersion": "authorization.k8s.io/v1",
   "kind": "SelfSubjectAccessReview",
   "metadata": {
     "creationTimestamp": null
   },
   "spec": {
     "resourceAttributes": {
       "cluster": "business",
       "group": "auth.alauda.io",
       "namespace": "myproj05-ns02",
       "project": "myproj05",
       "resource": "userbindings",
       "verb": "create"
     }
   },
   "status": {
     "allowed": true
   }
 }

Parameters

Name	Type	Description
apiVersion	string	See common parameters
kind	string	See common parameters
metadata	object	See common parameters
spec	object	SelfSubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be set Path: spec
spec.resourceAttributes	object	ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface Path: spec.resourceAttributes
resourceAttributes.group	string	Group is the API Group of the Resource. "" means all. Path:* spec.resourceAttributes.group
resourceAttributes.namespace	string	Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces "" (empty) is defaulted for LocalSubjectAccessReviews "" (empty) is empty for cluster-scoped resources "" (empty) means "all" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview Path: spec.resourceAttributes.namespace
resourceAttributes.resource	string	Resource is one of the existing resource types. "" means all. Path:* spec.resourceAttributes.resource
resourceAttributes.verb	string	Verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy. "" means all. Path:* spec.resourceAttributes.verb
status	object	SubjectAccessReviewStatus Path: status
status.allowed	boolean	Allowed is required. True if the action would be allowed, false otherwise. Path: status.allowed

*Resource authentication