St2: Feature request: limit api key access to a subset of webhooks

[keatsfonam]

After reading https://docs.stackstorm.com/authentication.html#api-keys it seems that any api-key generated can auth against any webhook. I would like to limit which webhooks can be triggered using a particular api key. One option I can think of is to associate an api-key with a particular pack and only be able to trigger webhooks from that pack.

[cognifloyd]

💯 and please don't tie it up with RBAC. Please make this feature separate from RBAC so it can be used with open source ST2.

[LindsayHill]

This capability already exists, using RBAC. API keys get the permissions of the associated user.

Example:

Assume system has two web hooks:

---
    name: "sample_rule_with_webhook"
    pack: "st2_demos"
    description: "Sample rule dumping webhook payload to a file."
    enabled: true

    trigger:
        type: "core.st2.webhook"
        parameters:
            url: "sample"

    criteria:
        trigger.body.name:
            pattern: "st2"
            type: "equals"

    action:
        ref: "core.local"
        parameters:
            cmd: "echo \"{{trigger.body}}\" >> ~/st2.webhook_sample.out"

and

---
    name: "Rule with RBAC"
    pack: "st2_demos"
    description: "Rule demonstrating RBAC and Webhooks"
    enabled: true

    trigger:
        type: "core.st2.webhook"
        parameters:
            url: "rbac"

    criteria: {}

    action:
        ref: "core.local"
        parameters:
            cmd: "echo \"{{trigger.body}}\" >> ~/st2.webhook_rbac.out"

Then create a key as st2admin, and use that in a curl request:

extreme@EWC:/opt/stackstorm/rbac/assignments$ export ST2_API_KEY=`st2 apikey create -k`
extreme@EWC:/opt/stackstorm/rbac/assignments$ echo $ST2_API_KEY
ZjFmN2U0MjA4YjkxYTg4YzU4NTk1NmYxZDE4ZDY0YTU0NTJmMWRlMjU2NmU4ZDJmNzViODQ2N2JiZTU0OGVhZQ
extreme@EWC:/opt/stackstorm/rbac/assignments$ curl -k -X POST https://localhost/api/v1/webhooks/rbac -H "St2-Api-Key: $ST2_API_KEY" -H "Content-Type: application/json" --data '{"name": "st2"}'
{
    "name": "st2"
extreme@EWC:/opt/stackstorm/rbac/assignments$ curl -k -X POST https://localhost/api/v1/webhooks/sample -H "St2-Api-Key: $ST2_API_KEY" -H "Content-Type: application/json" --data '{"name": "st2"}'
{
    "name": "st2"
}extreme@EWC:/opt/stackstorm/rbac/assignments$

That adds to the st2.webhook* files in ~stanley:

extreme@EWC:/opt/stackstorm/rbac/assignments$ ls -l ~stanley/st2.webhook_*
-rw-r--r-- 1 stanley stanley 54 Mar 21 17:52 /home/stanley/st2.webhook_rbac.out
-rw-r--r-- 1 stanley stanley 36 Mar 21 17:52 /home/stanley/st2.webhook_sample.out
extreme@EWC:/opt/stackstorm/rbac/assignments$

That is all as expected.

Now create a new user, webhookrbac:
sudo htpasswd /etc/st2/htpasswd webhookrbac.
Then create a new role & assignment.
Role:

---
    name: "webhook"
    description: "Send permission to one specific webhook"
    enabled: true
    permission_grants:
        -
            resource_uid: "webhook:rbac"
            permission_types:
               - "webhook_send"

Assignment:

---
  username: "webhookrbac"
  roles:
    - "webhook"

Apply those assignments with sudo st2-apply-rbac-definitions --config-file=/etc/st2/st2.conf.

Now create a new API Key, associated with that user:

extreme@EWC:/opt/stackstorm/rbac/assignments$ export ST2_RBAC_KEY=`st2 apikey create -k -u webhookrbac`
extreme@EWC:/opt/stackstorm/rbac/assignments$ echo $ST2_RBAC_KEY
OTBhYzU0YzIwNGY4YzcyNzg1ZDVjNTQwYWIwNTNkMDJlNGUzMDQxNWQxNTU3YmY5OWY4NjczMDFkZDhjODU0Zg

Use that key to submit to the /rbac endpoint, and it works as expected:

extreme@EWC:/opt/stackstorm/rbac/assignments$ curl -k -X POST https://localhost/api/v1/webhooks/rbac -H "St2-Api-Key: $ST2_RBAC_KEY" -H "Content-Type: application/json" --data '{"name": "st2"}'
{
    "name": "st2"
}extreme@EWC:/opt/stackstorm/rbac/assignments$

Now POST to the sample endpoint:

extreme@EWC:/opt/stackstorm/rbac/assignments$ curl -k -X POST https://localhost/api/v1/webhooks/sample -H "St2-Api-Key: $ST2_RBAC_KEY" -H "Content-Type: application/json" --data '{"name": "st2"}'
{
    "faultstring": "User \"webhookrbac\" doesn't have required permission \"webhook_send\" on resource \"webhook:sample\""
}extreme@EWC:/opt/stackstorm/rbac/assignments$

This fails, as expected: proof that RBAC is properly working for restricting API keys to specific web hooks.

No plans to add RBAC to StackStorm Community at this time.

[armab]

Magic! :heart:

[Kami]

If not documented already, we should also document this example / use case somewhere in the RBAC docs.

[armab]

Somewhat it's cross-linked & documented by @LindsayHill as a forum topic/HOWTO: https://forum.stackstorm.com/t/howto-restrict-api-key-to-specific-webhooks/96