src/java/org/apache/cassandra/auth/AuthenticatedUser.java

/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.apache.cassandra.auth;

import java.net.InetSocketAddress;
import java.util.Collections;
import java.util.Map;
import java.util.Set;
import com.google.common.base.Objects;

import org.apache.cassandra.auth.IAuthenticator.AuthenticationMode;
import org.apache.cassandra.config.DatabaseDescriptor;
import org.apache.cassandra.dht.Datacenters;

import static org.apache.cassandra.auth.IAuthenticator.AuthenticationMode.UNAUTHENTICATED;

/**
 * Returned from IAuthenticator#authenticate(), represents an authenticated user everywhere internally.
 *
 * Holds the name of the user and the roles that have been granted to the user. The roles will be cached
 * for roles_validity.
 */
public class AuthenticatedUser
{
    public static final String SYSTEM_USERNAME = "system";
    public static final AuthenticatedUser SYSTEM_USER = new AuthenticatedUser(SYSTEM_USERNAME);

    public static final String ANONYMOUS_USERNAME = "anonymous";
    public static final AuthenticatedUser ANONYMOUS_USER = new AuthenticatedUser(ANONYMOUS_USERNAME);

    // User-level permissions cache.
    public static final PermissionsCache permissionsCache = new PermissionsCache(DatabaseDescriptor.getAuthorizer());
    public static final NetworkPermissionsCache networkPermissionsCache = new NetworkPermissionsCache(DatabaseDescriptor.getNetworkAuthorizer());

    private static final ICIDRAuthorizer cidrAuthorizer = DatabaseDescriptor.getCIDRAuthorizer();

    /** Use {@link AuthCacheService#initializeAndRegisterCaches} rather than calling this directly */
    public static void init()
    {
        AuthCacheService.instance.register(permissionsCache);
        AuthCacheService.instance.register(networkPermissionsCache);

        cidrAuthorizer.initCaches();
    }

    private final String name;

    private final AuthenticationMode authenticationMode;

    private final Map<String, Object> metadata;

    // Primary Role of the logged-in user
    private final RoleResource role;

    public AuthenticatedUser(String name)
    {
        this(name, UNAUTHENTICATED);
    }

    public AuthenticatedUser(String name, AuthenticationMode authenticationMode)
    {
        this(name, authenticationMode, Collections.emptyMap());
    }

    /**
     * Defines authenticated user context established within a client connection.
     *
     * @param name The user's role name
     * @param authenticationMode How the user was authenticated
     * @param metadata contextual metadata about how the user was authenticated.  Note that this data is exposed
     *                 through the <code>system_views.clients table</code>, <code>nodetool clientstats</code> and
     *                 {@link org.apache.cassandra.metrics.ClientMetrics}-based JMX Beans.  Implementors should
     *                 take care not to store anything sensitive here.
     */
    public AuthenticatedUser(String name, AuthenticationMode authenticationMode, Map<String, Object> metadata)
    {
        this.name = name;
        this.role = RoleResource.role(name);
        this.authenticationMode = authenticationMode;
        this.metadata = metadata;
    }

    public String getName()
    {
        return name;
    }

    public RoleResource getPrimaryRole()
    {
        return role;
    }

    /**
     * @returns the mode of authentication used to authenticate this user
     */
    public AuthenticationMode getAuthenticationMode()
    {
        return authenticationMode;
    }

    /**
     * @returns {@link IAuthenticator}-contextual metadata about how the user was authenticated.
     * <p>
     * Note that this data is exposed through the <code>system_views.clients table</code>,
     * <code>nodetool clientstats</code> and {@link org.apache.cassandra.metrics.ClientMetrics}-based JMX Beans.
     * Implementors should take care not to store anything sensitive here.
     */
    public Map<String, Object> getMetadata()
    {
        return metadata;
    }

    /**
     * Checks the user's superuser status.
     * Only a superuser is allowed to perform CREATE USER and DROP USER queries.
     * Im most cased, though not necessarily, a superuser will have Permission.ALL on every resource
     * (depends on IAuthorizer implementation).
     */
    public boolean isSuper()
    {
        return !isAnonymous() && Roles.hasSuperuserStatus(role);
    }

    /**
     * If IAuthenticator doesn't require authentication, this method may return true.
     */
    public boolean isAnonymous()
    {
        return this == ANONYMOUS_USER;
    }

    /**
     * Some internal operations are performed on behalf of Cassandra itself, in those cases
     * the system user should be used where an identity is required
     * see CreateRoleStatement#execute() and overrides of AlterSchemaStatement#createdResources()
     */
    public boolean isSystem()
    {
        return this == SYSTEM_USER;
    }

    /**
     * Get the roles that have been granted to the user via the IRoleManager
     *
     * @return a set of identifiers for the roles that have been granted to the user
     */
    public Set<RoleResource> getRoles()
    {
        return Roles.getRoles(role);
    }

    /**
     * Get the detailed info on roles granted to the user via IRoleManager
     *
     * @return a set of Role objects detailing the roles granted to the user
     */
    public Set<Role> getRoleDetails()
    {
       return Roles.getRoleDetails(role);
    }

    public Set<Permission> getPermissions(IResource resource)
    {
        return permissionsCache.getPermissions(this, resource);
    }

    /**
     * Check whether this user has login privileges.
     * LOGIN is not inherited from granted roles, so must be directly granted to the primary role for this user
     *
     * @return true if the user is permitted to login, false otherwise.
     */
    public boolean canLogin()
    {
        return Roles.canLogin(getPrimaryRole());
    }

    /**
     * Verify that there is not DC level restriction on this user accessing this node.
     * Further extends the login privilege check by verifying that the primary role for this user is permitted
     * to perform operations in the local (to this node) datacenter. Like LOGIN, this is not inherited from
     * granted roles.
     * @return true if the user is permitted to access nodes in this node's datacenter, false otherwise
     */
    public boolean hasLocalAccess()
    {
        return networkPermissionsCache.get(this.getPrimaryRole()).canAccess(Datacenters.thisDatacenter());
    }

    public boolean hasAccessFromIp(InetSocketAddress remoteAddress)
    {
        return cidrAuthorizer.hasAccessFromIp(role, remoteAddress.getAddress());
    }

    @Override
    public String toString()
    {
        return String.format("#<User %s>", name);
    }

    @Override
    public boolean equals(Object o)
    {
        if (this == o)
            return true;

        if (!(o instanceof AuthenticatedUser))
            return false;

        AuthenticatedUser u = (AuthenticatedUser) o;

        return Objects.equal(name, u.name);
    }

    @Override
    public int hashCode()
    {
        // Note: for reasons of maintaining the invariant that an object that equals maintains the same hashCode,
        // we do not include mode and metadata in the hashCode calculation.
        // This is particularly salient as there are cases where AuthenticatedUser is used as a key in
        // Role/Permissions cache. In effect, we would like to treat all connections sharing the same name as the same
        // user, where mode and metadata are just additional context about how the user authenticated that
        // should not factor into 'equivalence' of users.
        return Objects.hashCode(name);
    }
}