OPA Spring Security is a library that enables using OPA for authorization in Spring applications.

• Java 11 or higher

Add dependency using Maven

<dependency>
    <groupId>com.bisnode.opa</groupId>
    <artifactId>opa-filter-spring-boot-starter</artifactId>
    <version>{version}</version>
</dependency>

or Gradle

implementation 'com.bisnode.opa:opa-filter-spring-boot-starter:{version}'

All properties are prefixed with opa.filter

Currently, the filter sends following information to OPA:

• path - path of the resource, that's being requested, e.g. /messages/2
• method - HTTP method, e.g. GET
• encodedJwt - encoded token from authorization (if found, null otherwise)

Those properties are available in your policy's input.

Your OPA policy response should contain following properties:

• allow - with value true if to requested resource should be allowed. false otherwise
• reason - an optional string containing reason behind given accessDecision, it will be supplied to exception message

Unknown properties are ignored.

Example OPA response would look as follows:

{
  "result": 
  {
      "allow": false,
      "reason": "You shall not pass"
  }
}

When library denies access to the resource, AuthorizationFailureEvent is published and therefore can be used in user's code.

Build process and dependency management is done using Gradle. Tests are written in Spock.

Interested in contributing? Please, start by reading this document.