fix(authz): include realm identifier in OPA authorization input for tenant isolation#4992
Merged
dimas-b merged 4 commits intoJul 14, 2026
Merged
Conversation
Contributor
|
FYI: @gracechen09 |
dimas-b
previously approved these changes
Jul 7, 2026
dimas-b
left a comment
dimas-b
left a comment
Contributor
There was a problem hiding this comment.
This change looks reasonable to me 👍 Let's collect some more reviews, though, particularly from people working more closely with OPA 😉
github-project-automation
Bot
moved this from PRs In Progress
to Ready to merge
in Basic Kanban Board
vigneshio
force-pushed
the
fix/opa-realm-authorization-input
branch
from
July 8, 2026 11:29
80f2629 to
74318bd
Compare
Contributor
|
Looks good to me, thanks @vigneshio for putting together the PR! This change makes sense and enables OPA authorizer to perform realm-based authorization |
flyrain
previously approved these changes
Jul 9, 2026
flyrain
left a comment
flyrain
left a comment
Contributor
There was a problem hiding this comment.
LGTM overall. Left two minor comments.
vigneshio
force-pushed
the
fix/opa-realm-authorization-input
branch
2 times, most recently
from
July 9, 2026 11:41
65ea87c to
ad5c427
Compare
dimas-b
previously approved these changes
Jul 10, 2026
Contributor
|
@vigneshio : there are odd CI failures... Could you try rebasing, please? |
…enant isolation The OPA authorizer was not receiving any realm/tenant information. This meant that for the same principal/role/resource names, the authorization input sent to OPA was identical across realms (except for the random request_id). - Add optional 'realm' field to the Context model - Thread realm from RealmContext in OpaPolarisAuthorizerFactory (same pattern as RangerPolarisAuthorizerFactory) - Update authorizer to include it in buildContext() - Regenerate schema + update test/docs/CHANGELOG This fixes cross-realm authorization confusion when using OPA with multi-realm + shared policy.
vigneshio
force-pushed
the
fix/opa-realm-authorization-input
branch
from
July 13, 2026 18:34
ad5c427 to
c1bb787
Compare
dimas-b
reviewed
Jul 14, 2026
dimas-b
approved these changes
Jul 14, 2026
github-project-automation
Bot
moved this from Ready to merge
to Done
in Basic Kanban Board
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds the realm identifier to the OPA authorization input so policies can properly enforce isolation across realms.
Previously the input sent to OPA was essentially identical for the same principal/role/resource names in different realms (only the random request_id differed), unlike the Ranger authorizer which deliberately scopes by realm.
Changes
realmfield to the OPAContextmodelRealmContextthrough constructor injection inOpaPolarisAuthorizerFactory(same pattern as other factory dependencies)OpaPolarisAuthorizerto accept realm as a required constructor parameter and always include it inbuildContext()opa-input-schema.jsonsorealmis marked requiredThis closes the cross-realm authorization gap when using
polaris.authorization.type=opawith multiple realms pointing at the same policy.Checklist