| /* |
| * Licensed to the Apache Software Foundation (ASF) under one or more |
| * contributor license agreements. See the NOTICE file distributed with |
| * this work for additional information regarding copyright ownership. |
| * The ASF licenses this file to You under the Apache License, Version 2.0 |
| * (the "License"); you may not use this file except in compliance with |
| * the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| package org.apache.nifi.registry.service; |
| |
| import org.apache.commons.lang3.StringUtils; |
| import org.apache.nifi.registry.authorization.AccessPolicy; |
| import org.apache.nifi.registry.authorization.AccessPolicySummary; |
| import org.apache.nifi.registry.authorization.CurrentUser; |
| import org.apache.nifi.registry.authorization.Permissions; |
| import org.apache.nifi.registry.authorization.Resource; |
| import org.apache.nifi.registry.authorization.ResourcePermissions; |
| import org.apache.nifi.registry.authorization.Tenant; |
| import org.apache.nifi.registry.authorization.User; |
| import org.apache.nifi.registry.authorization.UserGroup; |
| import org.apache.nifi.registry.bucket.Bucket; |
| import org.apache.nifi.registry.exception.ResourceNotFoundException; |
| import org.apache.nifi.registry.security.authorization.AccessPolicyProvider; |
| import org.apache.nifi.registry.security.authorization.AccessPolicyProviderInitializationContext; |
| import org.apache.nifi.registry.security.authorization.AuthorizableLookup; |
| import org.apache.nifi.registry.security.authorization.Authorizer; |
| import org.apache.nifi.registry.security.authorization.AuthorizerCapabilityDetection; |
| import org.apache.nifi.registry.security.authorization.AuthorizerConfigurationContext; |
| import org.apache.nifi.registry.security.authorization.ConfigurableAccessPolicyProvider; |
| import org.apache.nifi.registry.security.authorization.ConfigurableUserGroupProvider; |
| import org.apache.nifi.registry.security.authorization.Group; |
| import org.apache.nifi.registry.security.authorization.ManagedAuthorizer; |
| import org.apache.nifi.registry.security.authorization.RequestAction; |
| import org.apache.nifi.registry.security.authorization.UserAndGroups; |
| import org.apache.nifi.registry.security.authorization.UserGroupProvider; |
| import org.apache.nifi.registry.security.authorization.UserGroupProviderInitializationContext; |
| import org.apache.nifi.registry.security.authorization.exception.AccessDeniedException; |
| import org.apache.nifi.registry.security.authorization.exception.AuthorizationAccessException; |
| import org.apache.nifi.registry.security.authorization.resource.Authorizable; |
| import org.apache.nifi.registry.security.authorization.resource.ResourceFactory; |
| import org.apache.nifi.registry.security.authorization.resource.ResourceType; |
| import org.apache.nifi.registry.security.authorization.user.NiFiUser; |
| import org.apache.nifi.registry.security.authorization.user.NiFiUserUtils; |
| import org.apache.nifi.registry.security.exception.SecurityProviderCreationException; |
| import org.apache.nifi.registry.security.exception.SecurityProviderDestructionException; |
| import org.slf4j.Logger; |
| import org.slf4j.LoggerFactory; |
| import org.springframework.beans.factory.annotation.Autowired; |
| import org.springframework.stereotype.Service; |
| |
| import java.util.ArrayList; |
| import java.util.Collection; |
| import java.util.List; |
| import java.util.Objects; |
| import java.util.Set; |
| import java.util.stream.Collectors; |
| |
| /** |
| * Service for performing operations on users, groups, and policies. |
| */ |
| @Service |
| public class AuthorizationService { |
| |
| private static final Logger LOGGER = LoggerFactory.getLogger(AuthorizationService.class); |
| |
| public static final String MSG_NON_MANAGED_AUTHORIZER = "This NiFi Registry is not configured to internally manage users, groups, or policies. Please contact your system administrator."; |
| public static final String MSG_NON_CONFIGURABLE_POLICIES = "This NiFi Registry is not configured to allow configurable policies. Please contact your system administrator."; |
| public static final String MSG_NON_CONFIGURABLE_USERS = "This NiFi Registry is not configured to allow configurable users and groups. Please contact your system administrator."; |
| |
| private AuthorizableLookup authorizableLookup; |
| private Authorizer authorizer; |
| private RegistryService registryService; |
| private UserGroupProvider userGroupProvider; |
| private AccessPolicyProvider accessPolicyProvider; |
| |
| @Autowired |
| public AuthorizationService( |
| final AuthorizableLookup authorizableLookup, |
| final Authorizer authorizer, |
| final RegistryService registryService) { |
| this.authorizableLookup = authorizableLookup; |
| this.authorizer = authorizer; |
| this.registryService = registryService; |
| |
| if (AuthorizerCapabilityDetection.isManagedAuthorizer(this.authorizer)) { |
| this.accessPolicyProvider = ((ManagedAuthorizer) authorizer).getAccessPolicyProvider(); |
| } else { |
| this.accessPolicyProvider = createExceptionThrowingAccessPolicyProvider(); |
| } |
| this.userGroupProvider = accessPolicyProvider.getUserGroupProvider(); |
| } |
| |
| |
| // ---------------------- Authorization methods ------------------------------------- |
| |
| public AuthorizableLookup getAuthorizableLookup() { |
| return authorizableLookup; |
| } |
| |
| public void authorize(Authorizable authorizable, RequestAction action) throws AccessDeniedException { |
| authorizable.authorize(authorizer, action, NiFiUserUtils.getNiFiUser()); |
| } |
| |
| public boolean isManagedAuthorizer() { |
| return AuthorizerCapabilityDetection.isManagedAuthorizer(authorizer); |
| } |
| |
| public boolean isConfigurableUserGroupProvider() { |
| return AuthorizerCapabilityDetection.isConfigurableUserGroupProvider(authorizer); |
| } |
| |
| public boolean isConfigurableAccessPolicyProvider() { |
| return AuthorizerCapabilityDetection.isConfigurableAccessPolicyProvider(authorizer); |
| } |
| |
| public void verifyAuthorizerIsManaged() { |
| if (!isManagedAuthorizer()) { |
| throw new IllegalStateException(AuthorizationService.MSG_NON_MANAGED_AUTHORIZER); |
| } |
| } |
| |
| public void verifyAuthorizerSupportsConfigurablePolicies() { |
| if (!isConfigurableAccessPolicyProvider()) { |
| verifyAuthorizerIsManaged(); |
| throw new IllegalStateException(AuthorizationService.MSG_NON_CONFIGURABLE_POLICIES); |
| } |
| } |
| |
| public void verifyAuthorizerSupportsConfigurableUserGroups() { |
| if (!isConfigurableUserGroupProvider()) { |
| throw new IllegalStateException(AuthorizationService.MSG_NON_CONFIGURABLE_USERS); |
| } |
| } |
| |
| // ---------------------- Permissions methods --------------------------------------- |
| |
| public CurrentUser getCurrentUser() { |
| final NiFiUser user = NiFiUserUtils.getNiFiUser(); |
| final CurrentUser currentUser = new CurrentUser(); |
| currentUser.setIdentity(user.getIdentity()); |
| currentUser.setAnonymous(user.isAnonymous()); |
| currentUser.setResourcePermissions(getTopLevelPermissions()); |
| return currentUser; |
| } |
| |
| public Permissions getPermissionsForResource(Authorizable authorizableResource) { |
| NiFiUser user = NiFiUserUtils.getNiFiUser(); |
| final Permissions permissions = new Permissions(); |
| permissions.setCanRead(authorizableResource.isAuthorized(authorizer, RequestAction.READ, user)); |
| permissions.setCanWrite(authorizableResource.isAuthorized(authorizer, RequestAction.WRITE, user)); |
| permissions.setCanDelete(authorizableResource.isAuthorized(authorizer, RequestAction.DELETE, user)); |
| return permissions; |
| } |
| |
| public Permissions getPermissionsForResource(Authorizable authorizableResource, Permissions knownParentAuthorizablePermissions) { |
| if (knownParentAuthorizablePermissions == null) { |
| return getPermissionsForResource(authorizableResource); |
| } |
| |
| final Permissions permissions = new Permissions(knownParentAuthorizablePermissions); |
| NiFiUser user = NiFiUserUtils.getNiFiUser(); |
| |
| if (!permissions.getCanRead()) { |
| permissions.setCanRead(authorizableResource.isAuthorized(authorizer, RequestAction.READ, user)); |
| } |
| |
| if (!permissions.getCanWrite()) { |
| permissions.setCanWrite(authorizableResource.isAuthorized(authorizer, RequestAction.WRITE, user)); |
| } |
| |
| if (!permissions.getCanDelete()) { |
| permissions.setCanDelete(authorizableResource.isAuthorized(authorizer, RequestAction.DELETE, user)); |
| } |
| |
| return permissions; |
| } |
| |
| private ResourcePermissions getTopLevelPermissions() { |
| |
| NiFiUser user = NiFiUserUtils.getNiFiUser(); |
| ResourcePermissions resourcePermissions = new ResourcePermissions(); |
| |
| final Permissions bucketsPermissions = getPermissionsForResource(authorizableLookup.getBucketsAuthorizable()); |
| resourcePermissions.setBuckets(bucketsPermissions); |
| |
| final Permissions policiesPermissions = getPermissionsForResource(authorizableLookup.getPoliciesAuthorizable()); |
| resourcePermissions.setPolicies(policiesPermissions); |
| |
| final Permissions tenantsPermissions = getPermissionsForResource(authorizableLookup.getTenantsAuthorizable()); |
| resourcePermissions.setTenants(tenantsPermissions); |
| |
| final Permissions proxyPermissions = getPermissionsForResource(authorizableLookup.getProxyAuthorizable()); |
| resourcePermissions.setProxy(proxyPermissions); |
| |
| return resourcePermissions; |
| } |
| |
| // ---------------------- User methods ---------------------------------------------- |
| |
| public User createUser(final User user) { |
| verifyUserGroupProviderIsConfigurable(); |
| |
| if (StringUtils.isBlank(user.getIdentity())) { |
| throw new IllegalArgumentException("User identity must be specified when creating a new user."); |
| } |
| |
| final org.apache.nifi.registry.security.authorization.User createdUser = |
| configurableUserGroupProvider().addUser(userFromDTO(user)); |
| return userToDTO(createdUser); |
| } |
| |
| public List<User> getUsers() { |
| return userGroupProvider.getUsers().stream().map(this::userToDTO).collect(Collectors.toList()); |
| } |
| |
| public User getUser(final String identifier) { |
| final org.apache.nifi.registry.security.authorization.User user = userGroupProvider.getUser(identifier); |
| if (user == null) { |
| LOGGER.warn("The specified user id [{}] does not exist.", identifier); |
| throw new ResourceNotFoundException("The specified user ID does not exist in this registry."); |
| } |
| |
| return userToDTO(user); |
| } |
| |
| public User getUserByIdentity(final String identity) { |
| final org.apache.nifi.registry.security.authorization.User user = userGroupProvider.getUserByIdentity(identity); |
| if (user == null) { |
| LOGGER.warn("The specified user identity [{}] does not exist.", identity); |
| throw new ResourceNotFoundException("The specified user ID does not exist in this registry."); |
| } |
| |
| return userToDTO(user); |
| } |
| |
| public void verifyUserExists(final String identifier) { |
| final org.apache.nifi.registry.security.authorization.User user = userGroupProvider.getUser(identifier); |
| if (user == null) { |
| LOGGER.warn("The specified user id [{}] does not exist.", identifier); |
| throw new ResourceNotFoundException("The specified user ID does not exist in this registry."); |
| } |
| } |
| |
| public User updateUser(final User user) { |
| verifyUserGroupProviderIsConfigurable(); |
| |
| final org.apache.nifi.registry.security.authorization.User updatedUser = |
| configurableUserGroupProvider().updateUser(userFromDTO(user)); |
| |
| if (updatedUser == null) { |
| LOGGER.warn("The specified user id [{}] does not exist.", user.getIdentifier()); |
| throw new ResourceNotFoundException("The specified user ID does not exist in this registry."); |
| } |
| |
| return userToDTO(updatedUser); |
| } |
| |
| public User deleteUser(final String identifier) { |
| verifyUserGroupProviderIsConfigurable(); |
| |
| final org.apache.nifi.registry.security.authorization.User user = userGroupProvider.getUser(identifier); |
| if (user == null) { |
| LOGGER.warn("The specified user id [{}] does not exist.", identifier); |
| throw new ResourceNotFoundException("The specified user ID does not exist in this registry."); |
| } |
| |
| configurableUserGroupProvider().deleteUser(user); |
| return userToDTO(user); |
| } |
| |
| // ---------------------- User Group methods -------------------------------------- |
| |
| public UserGroup createUserGroup(final UserGroup userGroup) { |
| verifyUserGroupProviderIsConfigurable(); |
| |
| if (StringUtils.isBlank(userGroup.getIdentity())) { |
| throw new IllegalArgumentException("User group identity must be specified when creating a new group."); |
| } |
| |
| final org.apache.nifi.registry.security.authorization.Group createdGroup = |
| configurableUserGroupProvider().addGroup(userGroupFromDTO(userGroup)); |
| return userGroupToDTO(createdGroup); |
| } |
| |
| public List<UserGroup> getUserGroups() { |
| return userGroupProvider.getGroups().stream().map(this::userGroupToDTO).collect(Collectors.toList()); |
| } |
| |
| public UserGroup getUserGroup(final String identifier) { |
| final org.apache.nifi.registry.security.authorization.Group group = userGroupProvider.getGroup(identifier); |
| |
| if (group == null) { |
| LOGGER.warn("The specified user group id [{}] does not exist.", identifier); |
| throw new ResourceNotFoundException("The specified user group ID does not exist in this registry."); |
| } |
| |
| return userGroupToDTO(group); |
| } |
| |
| public void verifyUserGroupExists(final String identifier) { |
| final org.apache.nifi.registry.security.authorization.Group group = userGroupProvider.getGroup(identifier); |
| if (group == null) { |
| LOGGER.warn("The specified user group id [{}] does not exist.", identifier); |
| throw new ResourceNotFoundException("The specified user group ID does not exist in this registry."); |
| } |
| } |
| |
| public UserGroup updateUserGroup(final UserGroup userGroup) { |
| verifyUserGroupProviderIsConfigurable(); |
| |
| final org.apache.nifi.registry.security.authorization.Group updatedGroup = |
| configurableUserGroupProvider().updateGroup(userGroupFromDTO(userGroup)); |
| |
| if (updatedGroup == null) { |
| LOGGER.warn("The specified user group id [{}] does not exist.", userGroup.getIdentifier()); |
| throw new ResourceNotFoundException("The specified user group ID does not exist in this registry."); |
| } |
| |
| return userGroupToDTO(updatedGroup); |
| } |
| |
| public UserGroup deleteUserGroup(final String identifier) { |
| verifyUserGroupProviderIsConfigurable(); |
| |
| final Group group = userGroupProvider.getGroup(identifier); |
| if (group == null) { |
| LOGGER.warn("The specified user group id [{}] does not exist.", group.getIdentifier()); |
| throw new ResourceNotFoundException("The specified user group ID does not exist in this registry."); |
| } |
| |
| configurableUserGroupProvider().deleteGroup(group); |
| return userGroupToDTO(group); |
| } |
| |
| |
| // ---------------------- Access Policy methods ---------------------------------------- |
| |
| public AccessPolicy createAccessPolicy(final AccessPolicy accessPolicy) { |
| verifyAccessPolicyProviderIsConfigurable(); |
| |
| if (accessPolicy.getResource() == null) { |
| throw new IllegalArgumentException("Resource must be specified when creating a new access policy."); |
| } |
| |
| RequestAction.valueOfValue(accessPolicy.getAction()); |
| |
| final org.apache.nifi.registry.security.authorization.AccessPolicy createdAccessPolicy = |
| configurableAccessPolicyProvider().addAccessPolicy(accessPolicyFromDTO(accessPolicy)); |
| return accessPolicyToDTO(createdAccessPolicy); |
| } |
| |
| public AccessPolicy getAccessPolicy(final String identifier) { |
| final org.apache.nifi.registry.security.authorization.AccessPolicy accessPolicy = |
| accessPolicyProvider.getAccessPolicy(identifier); |
| |
| if (accessPolicy == null) { |
| LOGGER.warn("The specified access policy id [{}] does not exist.", identifier); |
| throw new ResourceNotFoundException("The specified policy does not exist in this registry."); |
| } |
| |
| return accessPolicyToDTO(accessPolicy); |
| } |
| |
| public AccessPolicy getAccessPolicy(final String resource, final RequestAction action) { |
| final org.apache.nifi.registry.security.authorization.AccessPolicy accessPolicy = |
| accessPolicyProvider.getAccessPolicy(resource, action); |
| |
| if (accessPolicy == null) { |
| throw new ResourceNotFoundException("No policy found for action='" + action + "', resource='" + resource + "'"); |
| } |
| |
| return accessPolicyToDTO(accessPolicy); |
| } |
| |
| public List<AccessPolicy> getAccessPolicies() { |
| return accessPolicyProvider.getAccessPolicies().stream().map(this::accessPolicyToDTO).collect(Collectors.toList()); |
| } |
| |
| public List<AccessPolicySummary> getAccessPolicySummaries() { |
| return accessPolicyProvider.getAccessPolicies().stream().map(this::accessPolicyToSummaryDTO).collect(Collectors.toList()); |
| } |
| |
| private List<AccessPolicySummary> getAccessPolicySummariesForUser(String userIdentifier) { |
| return accessPolicyProvider.getAccessPolicies().stream() |
| .filter(accessPolicy -> { |
| if (accessPolicy.getUsers().contains(userIdentifier)) { |
| return true; |
| } |
| return accessPolicy.getGroups().stream().anyMatch(g -> { |
| final Group group = userGroupProvider.getGroup(g); |
| return group != null && group.getUsers().contains(userIdentifier); |
| }); |
| }) |
| .map(this::accessPolicyToSummaryDTO) |
| .collect(Collectors.toList()); |
| } |
| |
| private List<AccessPolicySummary> getAccessPolicySummariesForUserGroup(String userGroupIdentifier) { |
| return accessPolicyProvider.getAccessPolicies().stream() |
| .filter(accessPolicy -> accessPolicy.getGroups().contains(userGroupIdentifier)) |
| .map(this::accessPolicyToSummaryDTO) |
| .collect(Collectors.toList()); |
| } |
| |
| public void verifyAccessPolicyExists(final String identifier) { |
| final org.apache.nifi.registry.security.authorization.AccessPolicy accessPolicy = |
| accessPolicyProvider.getAccessPolicy(identifier); |
| if (accessPolicy == null) { |
| LOGGER.warn("The specified access policy id [{}] does not exist.", identifier); |
| throw new ResourceNotFoundException("The specified policy does not exist in this registry."); |
| } |
| } |
| |
| public AccessPolicy updateAccessPolicy(final AccessPolicy accessPolicy) { |
| verifyAccessPolicyProviderIsConfigurable(); |
| |
| // Don't allow changing action or resource of existing policy (should only be adding/removing users/groups) |
| final org.apache.nifi.registry.security.authorization.AccessPolicy currentAccessPolicy = |
| accessPolicyProvider.getAccessPolicy(accessPolicy.getIdentifier()); |
| |
| if (currentAccessPolicy == null) { |
| LOGGER.warn("The specified access policy id [{}] does not exist.", accessPolicy.getIdentifier()); |
| throw new ResourceNotFoundException("The specified policy does not exist in this registry."); |
| } |
| |
| accessPolicy.setResource(currentAccessPolicy.getResource()); |
| accessPolicy.setAction(currentAccessPolicy.getAction().toString()); |
| |
| final org.apache.nifi.registry.security.authorization.AccessPolicy updatedAccessPolicy = |
| configurableAccessPolicyProvider().updateAccessPolicy(accessPolicyFromDTO(accessPolicy)); |
| |
| if (updatedAccessPolicy == null) { |
| LOGGER.warn("The specified access policy id [{}] does not exist.", accessPolicy.getIdentifier()); |
| throw new ResourceNotFoundException("The specified policy does not exist in this registry."); |
| } |
| |
| return accessPolicyToDTO(updatedAccessPolicy); |
| } |
| |
| public AccessPolicy deleteAccessPolicy(final String identifier) { |
| verifyAccessPolicyProviderIsConfigurable(); |
| |
| final org.apache.nifi.registry.security.authorization.AccessPolicy accessPolicy = |
| accessPolicyProvider.getAccessPolicy(identifier); |
| |
| if (accessPolicy == null) { |
| LOGGER.warn("The specified access policy id [{}] does not exist.", identifier); |
| throw new ResourceNotFoundException("The specified policy does not exist in this registry."); |
| } |
| |
| configurableAccessPolicyProvider().deleteAccessPolicy(identifier); |
| return accessPolicyToDTO(accessPolicy); |
| } |
| |
| |
| // ---------------------- Resource Lookup methods -------------------------------------- |
| |
| public List<Resource> getResources() { |
| final List<Resource> dtoResources = |
| getAuthorizableResources() |
| .stream() |
| .map(AuthorizationService::resourceToDTO) |
| .collect(Collectors.toList()); |
| return dtoResources; |
| } |
| |
| public List<Resource> getAuthorizedResources(RequestAction actionType) { |
| return getAuthorizedResources(actionType, null); |
| } |
| |
| public List<Resource> getAuthorizedResources(RequestAction actionType, ResourceType resourceType) { |
| final List<Resource> authorizedResources = |
| getAuthorizableResources(resourceType) |
| .stream() |
| .filter(resource -> { |
| String resourceId = resource.getIdentifier(); |
| try { |
| authorizableLookup |
| .getAuthorizableByResource(resource.getIdentifier()) |
| .authorize(authorizer, actionType, NiFiUserUtils.getNiFiUser()); |
| return true; |
| } catch (AccessDeniedException e) { |
| return false; |
| } |
| }) |
| .map(AuthorizationService::resourceToDTO) |
| .collect(Collectors.toList()); |
| |
| return authorizedResources; |
| } |
| |
| // ---------------------- Private Helper methods -------------------------------------- |
| |
| private ConfigurableUserGroupProvider configurableUserGroupProvider() { |
| return ((ConfigurableUserGroupProvider) userGroupProvider); |
| } |
| |
| private ConfigurableAccessPolicyProvider configurableAccessPolicyProvider() { |
| return ((ConfigurableAccessPolicyProvider) accessPolicyProvider); |
| } |
| |
| private void verifyUserGroupProviderIsConfigurable() { |
| if (!(userGroupProvider instanceof ConfigurableUserGroupProvider)) { |
| throw new IllegalStateException(MSG_NON_CONFIGURABLE_USERS); |
| } |
| } |
| |
| private void verifyAccessPolicyProviderIsConfigurable() { |
| if (!(accessPolicyProvider instanceof ConfigurableAccessPolicyProvider)) { |
| throw new IllegalStateException(MSG_NON_CONFIGURABLE_POLICIES); |
| } |
| } |
| |
| private ResourcePermissions getTopLevelPermissions(String tenantIdentifier) { |
| ResourcePermissions resourcePermissions = new ResourcePermissions(); |
| |
| final Permissions bucketsPermissions = getPermissionsForResource(tenantIdentifier, ResourceFactory.getBucketsResource()); |
| resourcePermissions.setBuckets(bucketsPermissions); |
| |
| final Permissions policiesPermissions = getPermissionsForResource(tenantIdentifier, ResourceFactory.getPoliciesResource()); |
| resourcePermissions.setPolicies(policiesPermissions); |
| |
| final Permissions tenantsPermissions = getPermissionsForResource(tenantIdentifier, ResourceFactory.getTenantsResource()); |
| resourcePermissions.setTenants(tenantsPermissions); |
| |
| final Permissions proxyPermissions = getPermissionsForResource(tenantIdentifier, ResourceFactory.getProxyResource()); |
| resourcePermissions.setProxy(proxyPermissions); |
| |
| return resourcePermissions; |
| } |
| |
| private Permissions getPermissionsForResource(String tenantIdentifier, org.apache.nifi.registry.security.authorization.Resource resource) { |
| |
| Permissions permissions = new Permissions(); |
| permissions.setCanRead(checkTenantBelongsToPolicy(tenantIdentifier, resource, RequestAction.READ)); |
| permissions.setCanWrite(checkTenantBelongsToPolicy(tenantIdentifier, resource, RequestAction.WRITE)); |
| permissions.setCanDelete(checkTenantBelongsToPolicy(tenantIdentifier, resource, RequestAction.DELETE)); |
| return permissions; |
| |
| } |
| |
| private boolean checkTenantBelongsToPolicy(String tenantIdentifier, org.apache.nifi.registry.security.authorization.Resource resource, RequestAction action) { |
| org.apache.nifi.registry.security.authorization.AccessPolicy policy = |
| accessPolicyProvider.getAccessPolicy(resource.getIdentifier(), action); |
| |
| if (policy == null) { |
| return false; |
| } |
| |
| boolean tenantInPolicy = policy.getUsers().contains(tenantIdentifier) || policy.getGroups().contains(tenantIdentifier); |
| return tenantInPolicy; |
| } |
| |
| private List<org.apache.nifi.registry.security.authorization.Resource> getAuthorizableResources() { |
| return getAuthorizableResources(null); |
| } |
| |
| private List<org.apache.nifi.registry.security.authorization.Resource> getAuthorizableResources(ResourceType includeFilter) { |
| |
| final List<org.apache.nifi.registry.security.authorization.Resource> resources = new ArrayList<>(); |
| |
| if (includeFilter == null || includeFilter.equals(ResourceType.Policy)) { |
| resources.add(ResourceFactory.getPoliciesResource()); |
| } |
| if (includeFilter == null || includeFilter.equals(ResourceType.Tenant)) { |
| resources.add(ResourceFactory.getTenantsResource()); |
| } |
| if (includeFilter == null || includeFilter.equals(ResourceType.Proxy)) { |
| resources.add(ResourceFactory.getProxyResource()); |
| } |
| if (includeFilter == null || includeFilter.equals(ResourceType.Actuator)) { |
| resources.add(ResourceFactory.getActuatorResource()); |
| } |
| if (includeFilter == null || includeFilter.equals(ResourceType.Swagger)) { |
| resources.add(ResourceFactory.getSwaggerResource()); |
| } |
| if (includeFilter == null || includeFilter.equals(ResourceType.Bucket)) { |
| resources.add(ResourceFactory.getBucketsResource()); |
| // add all buckets |
| for (final Bucket bucket : registryService.getBuckets()) { |
| resources.add(ResourceFactory.getBucketResource(bucket.getIdentifier(), bucket.getName())); |
| } |
| } |
| |
| return resources; |
| } |
| |
| private User userToDTO( |
| final org.apache.nifi.registry.security.authorization.User user) { |
| if (user == null) { |
| return null; |
| } |
| String userIdentifier = user.getIdentifier(); |
| |
| Collection<Tenant> groupsContainingUser = userGroupProvider.getGroups().stream() |
| .filter(group -> group.getUsers().contains(userIdentifier)) |
| .map(this::tenantToDTO) |
| .collect(Collectors.toList()); |
| Collection<AccessPolicySummary> accessPolicySummaries = getAccessPolicySummariesForUser(userIdentifier); |
| |
| User userDTO = new User(user.getIdentifier(), user.getIdentity()); |
| userDTO.setConfigurable(AuthorizerCapabilityDetection.isUserConfigurable(authorizer, user)); |
| userDTO.setResourcePermissions(getTopLevelPermissions(userDTO.getIdentifier())); |
| userDTO.addUserGroups(groupsContainingUser); |
| userDTO.addAccessPolicies(accessPolicySummaries); |
| return userDTO; |
| } |
| |
| private UserGroup userGroupToDTO( |
| final org.apache.nifi.registry.security.authorization.Group userGroup) { |
| if (userGroup == null) { |
| return null; |
| } |
| |
| Collection<Tenant> userTenants = userGroup.getUsers() != null |
| ? userGroup.getUsers().stream().map(this::tenantIdToDTO).filter(Objects::nonNull).collect(Collectors.toSet()) : null; |
| Collection<AccessPolicySummary> accessPolicySummaries = getAccessPolicySummariesForUserGroup(userGroup.getIdentifier()); |
| |
| UserGroup userGroupDTO = new UserGroup(userGroup.getIdentifier(), userGroup.getName()); |
| userGroupDTO.setConfigurable(AuthorizerCapabilityDetection.isGroupConfigurable(authorizer, userGroup)); |
| userGroupDTO.setResourcePermissions(getTopLevelPermissions(userGroupDTO.getIdentifier())); |
| userGroupDTO.addUsers(userTenants); |
| userGroupDTO.addAccessPolicies(accessPolicySummaries); |
| return userGroupDTO; |
| } |
| |
| private AccessPolicy accessPolicyToDTO( |
| final org.apache.nifi.registry.security.authorization.AccessPolicy accessPolicy) { |
| if (accessPolicy == null) { |
| return null; |
| } |
| |
| Collection<Tenant> users = accessPolicy.getUsers() != null |
| ? accessPolicy.getUsers().stream().map(this::tenantIdToDTO).filter(Objects::nonNull).collect(Collectors.toList()) : null; |
| Collection<Tenant> userGroups = accessPolicy.getGroups() != null |
| ? accessPolicy.getGroups().stream().map(this::tenantIdToDTO).filter(Objects::nonNull).collect(Collectors.toList()) : null; |
| |
| Boolean isConfigurable = AuthorizerCapabilityDetection.isAccessPolicyConfigurable(authorizer, accessPolicy); |
| |
| return accessPolicyToDTO(accessPolicy, userGroups, users, isConfigurable); |
| } |
| |
| private Tenant tenantIdToDTO(String identifier) { |
| final org.apache.nifi.registry.security.authorization.User user = userGroupProvider.getUser(identifier); |
| if (user != null) { |
| return tenantToDTO(user); |
| } else { |
| org.apache.nifi.registry.security.authorization.Group group = userGroupProvider.getGroup(identifier); |
| return tenantToDTO(group); |
| } |
| } |
| |
| private AccessPolicySummary accessPolicyToSummaryDTO( |
| final org.apache.nifi.registry.security.authorization.AccessPolicy accessPolicy) { |
| if (accessPolicy == null) { |
| return null; |
| } |
| |
| Boolean isConfigurable = AuthorizerCapabilityDetection.isAccessPolicyConfigurable(authorizer, accessPolicy); |
| |
| final AccessPolicySummary accessPolicySummaryDTO = new AccessPolicySummary(); |
| accessPolicySummaryDTO.setIdentifier(accessPolicy.getIdentifier()); |
| accessPolicySummaryDTO.setAction(accessPolicy.getAction().toString()); |
| accessPolicySummaryDTO.setResource(accessPolicy.getResource()); |
| accessPolicySummaryDTO.setConfigurable(isConfigurable); |
| return accessPolicySummaryDTO; |
| } |
| |
| private Tenant tenantToDTO(org.apache.nifi.registry.security.authorization.User user) { |
| if (user == null) { |
| return null; |
| } |
| Tenant tenantDTO = new Tenant(user.getIdentifier(), user.getIdentity()); |
| tenantDTO.setConfigurable(AuthorizerCapabilityDetection.isUserConfigurable(authorizer, user)); |
| return tenantDTO; |
| } |
| |
| private Tenant tenantToDTO(org.apache.nifi.registry.security.authorization.Group group) { |
| if (group == null) { |
| return null; |
| } |
| Tenant tenantDTO = new Tenant(group.getIdentifier(), group.getName()); |
| tenantDTO.setConfigurable(AuthorizerCapabilityDetection.isGroupConfigurable(authorizer, group)); |
| return tenantDTO; |
| } |
| |
| private static Resource resourceToDTO(org.apache.nifi.registry.security.authorization.Resource resource) { |
| if (resource == null) { |
| return null; |
| } |
| Resource resourceDto = new Resource(); |
| resourceDto.setIdentifier(resource.getIdentifier()); |
| resourceDto.setName(resource.getName()); |
| return resourceDto; |
| } |
| |
| private static org.apache.nifi.registry.security.authorization.User userFromDTO( |
| final User userDTO) { |
| if (userDTO == null) { |
| return null; |
| } |
| return new org.apache.nifi.registry.security.authorization.User.Builder() |
| .identifier(userDTO.getIdentifier()) |
| .identity(userDTO.getIdentity()) |
| .build(); |
| } |
| |
| private static org.apache.nifi.registry.security.authorization.Group userGroupFromDTO( |
| final UserGroup userGroupDTO) { |
| if (userGroupDTO == null) { |
| return null; |
| } |
| org.apache.nifi.registry.security.authorization.Group.Builder groupBuilder = new org.apache.nifi.registry.security.authorization.Group.Builder() |
| .identifier(userGroupDTO.getIdentifier()) |
| .name(userGroupDTO.getIdentity()); |
| Set<Tenant> users = userGroupDTO.getUsers(); |
| if (users != null) { |
| groupBuilder.addUsers(users.stream().map(Tenant::getIdentifier).collect(Collectors.toSet())); |
| } |
| return groupBuilder.build(); |
| } |
| |
| private static org.apache.nifi.registry.security.authorization.AccessPolicy accessPolicyFromDTO( |
| final AccessPolicy accessPolicyDTO) { |
| org.apache.nifi.registry.security.authorization.AccessPolicy.Builder accessPolicyBuilder = |
| new org.apache.nifi.registry.security.authorization.AccessPolicy.Builder() |
| .identifier(accessPolicyDTO.getIdentifier()) |
| .resource(accessPolicyDTO.getResource()) |
| .action(RequestAction.valueOfValue(accessPolicyDTO.getAction())); |
| |
| Set<Tenant> dtoUsers = accessPolicyDTO.getUsers(); |
| if (accessPolicyDTO.getUsers() != null) { |
| accessPolicyBuilder.addUsers(dtoUsers.stream().map(Tenant::getIdentifier).collect(Collectors.toSet())); |
| } |
| |
| Set<Tenant> dtoUserGroups = accessPolicyDTO.getUserGroups(); |
| if (dtoUserGroups != null) { |
| accessPolicyBuilder.addGroups(dtoUserGroups.stream().map(Tenant::getIdentifier).collect(Collectors.toSet())); |
| } |
| |
| return accessPolicyBuilder.build(); |
| } |
| |
| private static AccessPolicy accessPolicyToDTO( |
| final org.apache.nifi.registry.security.authorization.AccessPolicy accessPolicy, |
| final Collection<? extends Tenant> userGroups, |
| final Collection<? extends Tenant> users, |
| final Boolean isConfigurable) { |
| |
| if (accessPolicy == null) { |
| return null; |
| } |
| |
| final AccessPolicy accessPolicyDTO = new AccessPolicy(); |
| accessPolicyDTO.setIdentifier(accessPolicy.getIdentifier()); |
| accessPolicyDTO.setAction(accessPolicy.getAction().toString()); |
| accessPolicyDTO.setResource(accessPolicy.getResource()); |
| accessPolicyDTO.setConfigurable(isConfigurable); |
| accessPolicyDTO.addUsers(users); |
| accessPolicyDTO.addUserGroups(userGroups); |
| return accessPolicyDTO; |
| } |
| |
| private static AccessPolicyProvider createExceptionThrowingAccessPolicyProvider() { |
| |
| return new AccessPolicyProvider() { |
| @Override |
| public Set<org.apache.nifi.registry.security.authorization.AccessPolicy> getAccessPolicies() throws AuthorizationAccessException { |
| throw new IllegalStateException(MSG_NON_MANAGED_AUTHORIZER); |
| } |
| |
| @Override |
| public org.apache.nifi.registry.security.authorization.AccessPolicy getAccessPolicy(String identifier) throws AuthorizationAccessException { |
| throw new IllegalStateException(MSG_NON_MANAGED_AUTHORIZER); |
| } |
| |
| @Override |
| public org.apache.nifi.registry.security.authorization.AccessPolicy getAccessPolicy(String resourceIdentifier, RequestAction action) throws AuthorizationAccessException { |
| throw new IllegalStateException(MSG_NON_MANAGED_AUTHORIZER); |
| } |
| |
| @Override |
| public UserGroupProvider getUserGroupProvider() { |
| return new UserGroupProvider() { |
| @Override |
| public Set<org.apache.nifi.registry.security.authorization.User> getUsers() throws AuthorizationAccessException { |
| throw new IllegalStateException(MSG_NON_MANAGED_AUTHORIZER); |
| } |
| |
| @Override |
| public org.apache.nifi.registry.security.authorization.User getUser(String identifier) throws AuthorizationAccessException { |
| throw new IllegalStateException(MSG_NON_MANAGED_AUTHORIZER); |
| } |
| |
| @Override |
| public org.apache.nifi.registry.security.authorization.User getUserByIdentity(String identity) throws AuthorizationAccessException { |
| throw new IllegalStateException(MSG_NON_MANAGED_AUTHORIZER); |
| } |
| |
| @Override |
| public Set<Group> getGroups() throws AuthorizationAccessException { |
| throw new IllegalStateException(MSG_NON_MANAGED_AUTHORIZER); |
| } |
| |
| @Override |
| public Group getGroup(String identifier) throws AuthorizationAccessException { |
| throw new IllegalStateException(MSG_NON_MANAGED_AUTHORIZER); |
| } |
| |
| @Override |
| public UserAndGroups getUserAndGroups(String identity) throws AuthorizationAccessException { |
| throw new IllegalStateException(MSG_NON_MANAGED_AUTHORIZER); |
| } |
| |
| @Override |
| public void initialize(UserGroupProviderInitializationContext initializationContext) throws SecurityProviderCreationException { |
| |
| } |
| |
| @Override |
| public void onConfigured(AuthorizerConfigurationContext configurationContext) throws SecurityProviderCreationException { |
| |
| } |
| |
| @Override |
| public void preDestruction() throws SecurityProviderDestructionException { |
| |
| } |
| }; |
| } |
| |
| @Override |
| public void initialize(AccessPolicyProviderInitializationContext initializationContext) throws SecurityProviderCreationException { |
| } |
| |
| @Override |
| public void onConfigured(AuthorizerConfigurationContext configurationContext) throws SecurityProviderCreationException { |
| } |
| |
| @Override |
| public void preDestruction() throws SecurityProviderDestructionException { |
| } |
| }; |
| |
| } |
| |
| } |
