Examples with Action co.cask.cdap.proto.security.Action used on opensource projects

Example 11 with Action

use of co.cask.cdap.proto.security.Action in project cdap by caskdata.

the class AuthorizationHandler method grant.

@Path("/privileges/grant")
@POST
@AuditPolicy(AuditDetail.REQUEST_BODY)
public void grant(HttpRequest httpRequest, HttpResponder httpResponder) throws Exception {
    ensureSecurityEnabled();
    GrantRequest request = parseBody(httpRequest, GrantRequest.class);
    verifyAuthRequest(request);
    Set<Action> actions = request.getActions() == null ? EnumSet.allOf(Action.class) : request.getActions();
    // enforce that the user granting access has admin privileges on the entity
    authorizationEnforcer.enforce(request.getEntity(), authenticationContext.getPrincipal(), Action.ADMIN);
    privilegesManager.grant(request.getEntity(), request.getPrincipal(), actions);
    httpResponder.sendStatus(HttpResponseStatus.OK);
    createLogEntry(httpRequest, request, HttpResponseStatus.OK);
}

Example 12 with Action

use of co.cask.cdap.proto.security.Action in project cdap by caskdata.

the class AuthorizationHandler method revoke.

@Path("/privileges/revoke")
@POST
@AuditPolicy(AuditDetail.REQUEST_BODY)
public void revoke(HttpRequest httpRequest, HttpResponder httpResponder) throws Exception {
    ensureSecurityEnabled();
    RevokeRequest request = parseBody(httpRequest, RevokeRequest.class);
    verifyAuthRequest(request);
    // enforce that the user revoking access has admin privileges on the entity
    authorizationEnforcer.enforce(request.getEntity(), authenticationContext.getPrincipal(), Action.ADMIN);
    if (request.getPrincipal() == null && request.getActions() == null) {
        privilegesManager.revoke(request.getEntity());
    } else {
        Set<Action> actions = request.getActions() == null ? EnumSet.allOf(Action.class) : request.getActions();
        privilegesManager.revoke(request.getEntity(), request.getPrincipal(), actions);
    }
    httpResponder.sendStatus(HttpResponseStatus.OK);
    createLogEntry(httpRequest, request, HttpResponseStatus.OK);
}

Example 13 with Action

use of co.cask.cdap.proto.security.Action in project cdap by caskdata.

the class InMemoryAuthorizer method getPrivileges.

private Set<Privilege> getPrivileges(Principal principal) {
    Set<Privilege> result = new HashSet<>();
    for (Map.Entry<EntityId, ConcurrentMap<Principal, Set<Action>>> entry : privileges.entrySet()) {
        EntityId entityId = entry.getKey();
        Set<Action> actions = getActions(entityId, principal);
        for (Action action : actions) {
            result.add(new Privilege(entityId, action));
        }
    }
    return Collections.unmodifiableSet(result);
}

Example 14 with Action

use of co.cask.cdap.proto.security.Action in project cdap by caskdata.

the class StreamAdminTest method testConfigAndTruncate.

@Test
public void testConfigAndTruncate() throws Exception {
    StreamAdmin streamAdmin = getStreamAdmin();
    grantAndAssertSuccess(FOO_NAMESPACE, USER, ImmutableSet.of(Action.WRITE));
    StreamId stream = FOO_NAMESPACE.stream("stream");
    streamAdmin.create(stream);
    Assert.assertTrue(streamAdmin.exists(stream));
    writeEvent(stream);
    // Getting config / properties should work
    streamAdmin.getConfig(stream);
    streamAdmin.getProperties(stream);
    // Now revoke access to the user to the stream and to the namespace
    revokeAndAssertSuccess(FOO_NAMESPACE, USER, ImmutableSet.of(Action.WRITE));
    revokeAndAssertSuccess(stream, USER, EnumSet.allOf(Action.class));
    streamAdmin.getConfig(stream);
    try {
        streamAdmin.getProperties(stream);
        Assert.fail("User should not be able to get the properties.");
    } catch (UnauthorizedException e) {
    // expected
    }
    // read action should be enough to get the stream config
    grantAndAssertSuccess(stream, USER, ImmutableSet.of(Action.READ));
    streamAdmin.getConfig(stream);
    StreamProperties properties = streamAdmin.getProperties(stream);
    try {
        streamAdmin.updateConfig(stream, properties);
        Assert.fail("User should not be able to update the config with just READ permissions.");
    } catch (UnauthorizedException e) {
    // expected
    }
    // This call bypasses the stream handler and thus authorization is not checked for this call and so write
    // to stream will succeed. It is done so that we can check and perform truncate call.
    writeEvent(stream);
    grantAndAssertSuccess(stream, USER, ImmutableSet.of(Action.WRITE));
    writeEvent(stream);
    try {
        streamAdmin.updateConfig(stream, properties);
        Assert.fail("User should not be able to update the config with just READ and WRITE permissions.");
    } catch (UnauthorizedException e) {
    // expected
    }
    try {
        streamAdmin.truncate(stream);
        Assert.fail("User should not be able to truncate the stream without ADMIN permission.");
    } catch (UnauthorizedException e) {
    // expected
    }
    try {
        streamAdmin.drop(stream);
        Assert.fail("User should not be able to drop the stream without ADMIN permission.");
    } catch (UnauthorizedException e) {
    // expdcted
    }
    grantAndAssertSuccess(stream, USER, ImmutableSet.of(Action.ADMIN));
    streamAdmin.updateConfig(stream, properties);
    streamAdmin.truncate(stream);
    Assert.assertEquals(0, getStreamSize(stream));
    streamAdmin.drop(stream);
}

Example 15 with Action

use of co.cask.cdap.proto.security.Action in project cdap by caskdata.

the class StreamAdminTest method revokeAndAssertSuccess.

private void revokeAndAssertSuccess(EntityId entityId, Principal principal, Set<Action> actions) throws Exception {
    Authorizer authorizer = getAuthorizer();
    Set<Privilege> existingPrivileges = authorizer.listPrivileges(principal);
    authorizer.revoke(entityId, principal, actions);
    Set<Privilege> revokedPrivileges = new HashSet<>();
    for (Action action : actions) {
        revokedPrivileges.add(new Privilege(entityId, action));
    }
    Assert.assertEquals(Sets.difference(existingPrivileges, revokedPrivileges), authorizer.listPrivileges(principal));
}