New policies that use OPA requests and caching
Provide new policies that use OPA request and caching for entitlements groups and legal tags. Initial contribution is done here: https://community.opengroup.org/osdu/platform/security-and-compliance/policy/-/tree/add-dynamic-policy-examples/policy-examples/load%20data%20dynamically%20POC
The scope is to create a data authz policy that supports all the data operations
-Create -Update -Delete -Retrieve
- This needs to be integrated with Storage
- The interface of the contract should be validated by SDMS (doesnt need to be integrated)
- This should replicate the existing system behavior of entitlements and legal enforcement. Refer to the POC policies for reference in the link above
- As the system functional behavior doesnt change all integration tests should pass except where caching is applied and so causes a delay in updates to ACLs by 10 seconds. This is the only acceptable change in behavior
- We should validate performance has not dropped form before
Also
- We should think about how the implementation can be extended in the future when we have custom policies. A custom policy is one provided by a client of the system after osdu is deployed. This will create a distinction between system policies which is what we are defining here and what clients override them with. This may mean a modular approach to creating policies so clients creating their own policies could re-use them. This will likely change as this feature becomes concrete but we should consider the problem in the design of the policies.