Authorization

Flipt supports the ability to secure its core API routes by setting the required field to true on the authorization configuration object.

authorization:
  required: true

When authorization is set to required, the API will ensure valid credentials are present on all management API requests.

​

Backends

Flipt uses Open Policy Agent (OPA) to enforce authorization policies. OPA is a general-purpose policy engine that can be used to enforce policies across the stack.

Flipt supports sourcing policies and external data from various backends. Currently, Flipt supports the following backends:

• Local

​

Local

Flipt supports loading policy and external data from the local filesystem.

​

Policies

For configuring policies, the files must be valid Rego files.

You can specify the path to the policy file in the policy object in the authorization configuration object.

authorization:
  required: true
  local:
    policy:
      path: "policy.rego"

The policy must have the following package declaration:

package flipt.authz.v2

​

Polling Interval

Flipt will poll the policy file for changes at a regular interval. By default, Flipt will poll the policy file every 5 minutes. You can adjust this interval by setting the poll_interval field in the policy object.

authorization:
  required: true
  local:
    policy:
      path: "policy.rego"
      poll_interval: "1m"

​

External Data

In addition to policies that can be used to enforce authorization rules, Flipt also provides a way to pass external data to the policy evaluation from the local filesystem. These data objects must be valid JSON objects.

This can be done by setting the data object in the authorization configuration object.

authorization:
  required: true
  local:
    policy:
      path: "policy.rego"
    data:
      path: "data.json"

​

Polling Interval

Like policies, Flipt will poll data files for changes at a regular interval. By default, Flipt will poll the data file every 30 seconds. You can adjust this interval by setting the poll_interval field in the data object.

authorization:
  required: true
  local:
    data:
      path: "data.json"
      poll_interval: "1m"