https://cerbos.dev logo
Title
d

Dmitry Meyerson

05/08/2023, 9:10 PM
cerbos, seems pretty cool - wondering if I can combine derivedRoles w/ a logical AND op when I write resourcePolicy
or does that implicitly involve role inheritance (and is hence not supported)
@Dennis (Cerbos)
for example say I have derivedRole based on locale then a derivedRole based on function (ex: manager)
i want to write a resourcePolicy that allows Florida based managers to perform some action
I know I can create “Florida_manager” derivedRole
d

Dennis (Cerbos)

05/08/2023, 10:38 PM
Thanks. I got your use case. That’s not supported now, but we are considering adding it.
d

Dmitry Meyerson

05/08/2023, 10:38 PM
but that can quickly multiply?
ok thank you for clarifying
can you recommend a best practice for this at the moment
d

Dennis (Cerbos)

05/08/2023, 10:44 PM
This is the approach of creating “Florida_manager” roles unfortunately, but as a temporary workaround, you can use Yaml manipulation tools to avoid copy-pasting.
d

Dmitry Meyerson

05/08/2023, 10:51 PM
ok got it thanks!
what are some yaml manipulation would you recommend for this - im familiar w yq
maybe @Charith (Cerbos) cc @Dennis (Cerbos)
c

Charith (Cerbos)

05/09/2023, 5:06 PM
ytt is my personal favourite.
Cue is another choice.
d

Dmitry Meyerson

05/10/2023, 9:47 PM
@Alex Olivier (Cerbos) or @Aldin Kiselica - in defining a derivedRole - looks like parentRoles have to original id issuer role (or whatever I choose to stick into the request in the roles [] list) it cannot be another derived role - can you confirm?
cc @Emre (Cerbos)
d

Dennis (Cerbos)

05/10/2023, 9:54 PM
Correct, you can’t use another derived role as a parent role. You can only reference roles that you pass in the request, with the exception of using wildcards.
d

Dmitry Meyerson

05/10/2023, 9:56 PM
ok makes sense - back to the whole ‘no role hierarchy’ as a intentional design choice, makes sense
can i set a default parentRole
since I’m mostly using attributes to determine derivedRoles
d

Dennis (Cerbos)

05/10/2023, 9:58 PM
No, there’s NO notion of a default parent role, but you can use `*`meaning any role.
d

Dmitry Meyerson

05/11/2023, 5:42 PM
ok playing w/ ytt - can someone point me to a cerbos specific example - maybe @Alex Olivier (Cerbos) cc @Dennis (Cerbos)
d

Dennis (Cerbos)

05/11/2023, 9:39 PM
I don’t think we have a public example with ytt.
d

Dmitry Meyerson

05/12/2023, 2:45 AM
got it, I have something I can push if there is repo where that makes sense
d

Dennis (Cerbos)

05/12/2023, 2:50 AM
@Aldin Kiselica
c

Charith (Cerbos)

05/12/2023, 7:53 AM
Please push to your own repo and share the link on #community