Updating a KACLS Endpoint Perimeter

KACLS endpoint perimeters are the policies that allow or disallow the wrap, unwrap, and takeout_unwrap operations. Refer to Access Policies for details.

Updating a perimeter requires understanding of Open Policy Agent.

Use the PATCH /v1/cckm/GoogleWorkspaceCSE/endpoints/{id}/perimeters API to update KACLS endpoint perimeters.

Sample Custom Policies

This section describes various scenarios in which custom policies can be applied.

Allowing Case-Insensitive Email Addresses

Access policies are case-sensitive. If you are using a default policy, and you intend to use case-insensitive checks for email addresses in authentication and authorization tokens, then you can replace the default policy with following custom policy:

package example
default allow = false
allow {
        lower(input.authentication.email) == lower(input.authorization.email)
    }
allow {
        input.perimeter_id == "takeout"
    }

Different Primary and Secondary Email Addresses

If you are using a different email address for the identity provider apart from the Google Workspace domain email address, then you can apply the following custom policy. Where:

• authentication.google_email is your Google Workspace domain email address. In this document, this email Id is referred to as the primary email address.

• authentication.email is your identity provider email address. In this document, this email Id is referred to as the secondary email address.

  package example
  default allow = false
  allow {
      input.authentication.google_email
      lower(input.authorization.email) == lower(input.authentication.google_email)
  }
  allow {
      not input.authentication.google_email
      lower(input.authorization.email) == lower(input.authentication.email)
  }
  allow {
      input.perimeter_id == "takeout"
  }
  

Allowing File Encryption/Decryption to a Specific User

If only a user (with the email address user@domain) should be able to encrypt/decrypt a file, a custom policy similar to the following can be used:

package example
default allow = false
allow {
        input.authentication.email == "user@domain"
        input.authorization.email == "user@domain"
    }
allow {
        input.perimeter_id == "takeout"
    }

Allowing File Encryption/Decryption to a List of Users

If only specific users (for example, user1 and user2) should be able to encrypt/decrypt a file, a custom policy similar to the following can be used:

package example
default allow = false
allow {
        input.authentication.email == {"user1@domain.com", "user2@domain.com"}[_]
        input.authorization.email == {"user1@domain.com", "user2@domain.com"}[_]
    }
allow {
        input.perimeter_id == "takeout"
    }

Restricting File Encryption/Decryption to a List of Users of a Domain

If only specific users (for example, user3 and user4) of a domain should be restricted from encrypting/decrypting a file, a custom policy similar to the following can be used:

package example
import future.keywords
default allow = false
allow {
        input.authentication.google_email users := {"user3@domain.com", "user4@domain.com"}
        not input.authentication.google_email in users
        lower(input.authorization.email) == lower(input.authentication.google_email)
    }
allow {
        not input.authentication.google_email  users := {"user3@domain.com", "user4@domain.com"}
        not input.authentication.email in users
        lower(input.authorization.email) == lower(input.authentication.email)
    }
allow {
        input.perimeter_id == "takeout"
    }

Syntax

curl -k '<IP>/api/v1/cckm/GoogleWorkspaceCSE/endpoints/{id}/perimeters' -X PATCH -H 'Authorization: Bearer AUTHTOKEN' --compressed

Request Parameters

Example Request

curl -k 'https://127.0.0.1/api/v1/cckm/GoogleWorkspaceCSE/endpoints/c1583936-7d03-4e2d-a0ae-3a1ae2d2e200/perimeters' -X PATCH -H 'Authorization: Bearer AUTHTOKEN' --compressed
package example
default allow = false
allow {
    input.authorization.email == "abc@foo.com"
    input.authentication.email == "abc@foo.com"
    input.perimeter_id == "takeout"
}

Example Response

"package example default allow = false allow { input.authorization.email == \"abc@foo.com\" input.authentication.email == \"abc@foo.com\" input.perimeter_id == \"takeout\" }"

Response Codes

Refer to HTTP status codes for details.