Method and apparatus for enforcing policies for authorizing APIs
Some embodiments provide API (Application Programming Interface) authorization platform that allows API-authorization policy stacks to be created and enforced. Policy stacks (called “stacks”) define API-authorization policies across different sets of managed resources in a workspace. A stack in some embodiments defines a uniform set of one or more API-authorization policies for multiple different sets of resources. By instituting common policies across multiple managed resource sets (also called managed systems), stacks can be used to guarantee uniform baseline policies for the workspace. A stack is typically applied to several managed resources that share a common trait. The API-authorization platform of some embodiments allows an administrator to define the traits of the managed resources through labels that are associated with the stacks and the managed systems. This platform in some embodiments also allows a stack to specify an exception for a managed system based on one or more features of the system.
1 . A method of authorizing an application programming interface (API) call to an application executing on a host computer, the method comprising:
at a local agent executing on the host computer:
from the application, receiving the API call along with a request to perform an authorization process to determine whether the API call is authorized and whether an operation specified by the API call should be performed by the application;
based on a set of one or more parameters associated with the API call, identifying (i) at least a first policy from a first set of policies specified for a first set of resources that includes the application and (ii) at least a second policy from a second set of policies specified for each of the first set of resources and a second set of resources, the second set of resources being different than the first set of resources;
using the set of parameters to determine whether one or both of the first and second policies specify whether the API call is authorized and whether the operation specified by the API call should be performed by the application; and
after a determination that at least the second policy specifies that the API call is authorized and the operation specified by the API call should be performed, informing the application that the API call is authorized and that the operation specified by the API should be performed by the application.
2 . The method of claim 1 , wherein:
the first set of resources comprise resources of a first managed system that includes the application and the second set of resources comprise resources of a second managed system; and
a set of system policies that include the first policy is defined for the first managed system, while a set of stack policies that include the second policy is defined for a plurality of managed systems including the first and second managed systems.
3 . The method of claim 2 , wherein the first set of policies is defined by a first set of administrators for the first set of resources, while the second set of policies is defined by a second set administrators that are different than the first set of administrators and who are administrators for a plurality of sets of resources including the first and second sets of resources.
4 . The method of claim 3 , wherein the second set of administrators is a set of administrators of a workspace in a set of one or more software defined datacenters (SDDCs), while the first set of administrators is a set of administrators of just the first set of resources in the SDDC set.
5 . The method of claim 4 , wherein the plurality of sets of resources in the SDDC set comprises a plurality of clusters of Kubernetes compute nodes.
6 . The method of claim 4 , wherein the plurality of sets of resources in the SDDC set comprises a plurality of distributed applications that execute in the SDDC set.
7 . The method of claim 4 , wherein the plurality of sets of resources in the SDDC set comprises a plurality of distributed data storages that operate in the SDDC set.
8 . The method of claim 3 , wherein the second set of administrators comprises a set of administrators of a workspace that operates in one or more datacenters, while the first set of administrators comprise only administrators of the first set of resources that is part of the workspace.
9 . The method of claim 1 , wherein when the first policy specifies that the API call is authorized and the operation specified by the API call should be performed but the second policy specifies that the API call should be rejected and the operation specified by the API call should not be performed, informing the application that the API call is not authorized and that the operation specified by the API call should not be performed by the application.
10 . The method of claim 1 further comprising:
identifying a third policy from the second set of policies specified for the first and second sets of resources;
using the set of parameters to determine whether the third policy specifies whether the API call is authorized and whether the operation specified by the API call should be performed by the application; and
when the second policy specifies that the API call is authorized and the operation should be performed but the third policy specifies that the API call should be rejected and the operation should not be performed, using a conflict resolver to identify a resolution of the second or third policy based on priority levels assigned to the second and third policies.
11 . The method of claim 10 , wherein using the conflict resolver comprises informing the application that the API policy is authorized and the operation should be performed by the application when the second policy has a higher priority than the third policy.
12 . The method of claim 10 , wherein using the conflict resolver comprises informing the application that the API policy should be rejected and the operation should not be performed by the application when the third policy has a higher priority than the second policy.
13 . The method of claim 1 further comprising:
identifying a third policy from the first set of policies specified for first set of resources;
using the set of parameters to determine whether the third policy specifies whether the API call is authorized and whether the operation specified by the API call should be performed by the application; and
when the first policy rejects the API call and the operation specified by the API call but the third policy authorizes the API call and the operation specified by the API call, using a conflict resolver to identify a resolution of the first or third policy based on priority levels assigned to the first and third policies.
14 . The method of claim 13 , wherein using the conflict resolver comprises informing the application that the API call is authorized and the operation should be performed by the application when the third policy has a higher priority than the first policy.
15 . The method of claim 13 , wherein using the conflict resolver comprises informing the application that the API policy should be rejected and the operation should not be performed by the application when the first policy has a higher priority than the third policy.
16 . The method of claim 1 , wherein the first policy specifies that the API call should be rejected and the operation should not be performed by the application, while the second policy specifies that the API call is authorized and the operation should be performed by the application.
17 . The method of claim 16 , wherein when the second policy specifies that the API call is allowed but can be rejected when a policy specified just for the first set of resources specifies that the API call should be rejected and the operation should not be performed by the application, the method further comprises informing the application that the API call should be rejected and the operation should not be performed by the application based on the first policy.
18 . The method of claim 1 , wherein using the set of parameters to determine whether one or both of the first and second policies specify whether the API call is authorized and whether the operation specified by the API call should be performed by the application comprises using a set of feature attributes associated with the application to determine whether the API call relates to a feature that has been associated with the first managed system that includes the application as an exception to the first policy that specifies that the API call should be rejected and the operation should not be performed.