Tutorial: Using Cerbos with FusionAuth

An example stack of integrating Cerbos with an Express server using FusionAuth for authentication.

This example is based off the FusionAuth/fusionauth-example-node repo.

Dependencies

• docker-compose

Getting started

1. Clone the repo

   git clone git@github.com:cerbos/express-fusionauth-cerbos.git

Start Stack

Start up the stack docker compose up - this will take some time to pull down all the images and launch them, but once started the following services will be running.

• FusionAuth http://localhost:9011

• Cerbos http://localhost:3592/

• Node App http://localhost:8080/

• Postgres DB for FustionAuth on port 5432

Configure FusionAuth

This example is based off the FusionAuth 5\ Minute Guide - and most of the steps have bee handled by the docker compose setup.

The only manual steps required are creating the application. To do this, open up http://localhost:9011 and complete the setup wizard, then:

1. Create an Application. An Application is something that a user can log into. This is the application we are building or that we are migrating to use FusionAuth.

2. We’ll click the Application menu option on the left side of the page or the Setup button in the box at the top of the page.

3. Next, we’ll click the green plus button (the add button) at the top of the page:

4. On the Application form, we’ll need to provide a name for our Application and a couple of items on the OAuth tab. Most of the defaults will work, but we also need to provide these items:

   • An authorized redirect URL: http://localhost:8080/auth/callback
   • Optionally, specify a valid Logout URL.
   • Ensure that the Authorization Code grant is selected in the Enabled Grants.

5. Add the roles that will be used by our policies: user, editor (admin should already exist).

Configure Node App

Add the Client ID and Client Secret from FusionAuth into the top of app/index.js (line 12 & 13).

Test the app

Now navigate to http://localhost:8080 and press the login link to authenticate with your FusionAuth account.

Policies

This example has a simple CRUD policy in place for a resource kind of contact - like a CRM system would have. The policy file can be found in the cerbos/policies folder here.

The policy expects one of two roles to be set on the principal - admin and user. These roles are authorized as follows:

Request Flow

1. User accesses the application and clicks Login

2. User is directed to the FusionAuth UI and authenticates

3. A token is returned back in the redirect URL to the application

4. That token is then exchanged for user profile information

5. The user profile from FusionAuth is stored (user Id, email, roles etc).

6. Any requests to the /contacts endpoints fetch the data required from the data store.

7. Call the Cerbos PDP with the principal, resource and action to check authorization.

   const allowed = await cerbos.check({
        principal: { //pass in the Okta user ID and groups
          id: req.userContext.userinfo.sub,
          roles: req.userContext.userinfo.groups,
        },
        resource: {
          kind: "contact",
          instances: {
            //a map of the resource(s) being accessed
            [contact.id]: {
              attr: contact,
            },
          },
        },
        actions: ["read"], //the list of actions being performed
    });

if (!allowed.isAuthorized(contact.id, "read")) {
        return res.status(403).json({ error: "Unauthorized" });
    }

Implementation at this stage will depend on your business requirements.