Cerbos v0.11.0 :: Cerbos Authorization Management Platform // Documentation

Cerbos v0.11.0

Highlights

This release’s defining feature is the support for defining schemas for the contextual data that is required to evaluate policies. From the get go, Cerbos was designed to be a stateless application that had no access to your important data. Client applications have the responsibility of sending all the data required to evaluate access policies with each request to the PDP. With the new schema support introduced in this release, policy authors can define JSON schemas for the principal and resource attributes required by each policy. Using the full expressive power of JSON schema draft 2020-12, the entire shape of the request can be defined including the enforcing strict data types and formats for fields and marking some fields as required.

Schema enforcement is disabled by default for backward compatibility. Once you have defined schemas and updated your policies to reference them, you can initially configure the Cerbos PDPs to warn when requests don’t conform to the schema. The warnings are returned in the response and logged to the audit logs as well. After you have fixed the warnings, set the enforcement level to reject and any invalid request will result in a DENY response. See Schemas for more information.

This release also adds preliminary support for OpenTelemetry distributed traces in either W3C Trace Context or B3 formats. See Tracing block for more information.

Changelog

Bug Fixes

Features

Enhancements

Documentation

Chores