authz.yaml

# Copyright 2021 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Optionally allow anonymous users.
# Valid values are YAML primitives representing true and false.
# This is assumed false if unspecified.
# Anonymous users are assigned the id "anonymous" and can be referenced
# in the readers and writers arrays.
anonymous: ${AUTHZ_ANONYMOUS}

# Optionally configure the server to trust JWTs.
# This disables signature verification and should only be used with caution!
# One situation where it is useful is when running in Google Cloud Run when 
# "ALLOW UNAUTHENTICATED REQUESTS" is disabled and users authenticate
# with tokens obtained from the gcloud command with no specified audience.
# For more information, see 
#   https://cloud.google.com/run/docs/troubleshooting#signature-removed
# Valid values are YAML primitives representing true and false.
# This is assumed false if unspecified.
trustJWTs: ${AUTHZ_TRUSTJWTS}

# A JSON or YAML array of user ids that can make read calls.
# If unspecified, this is set to "[]"
readers: ${AUTHZ_READERS}

# A JSON or YAML array of user ids that can make write calls.
# If unspecified, this is set to "[]"
writers: ${AUTHZ_WRITERS}

# A JSON or YAML map of tokens and corresponding user ids.
# Use this to manually add tokens for testing purposes.
# If unspecified, no token mappings are assumed.
tokens: ${AUTHZ_TOKENS}