Examples with RoleInfo com.alibaba.nacos.config.server.auth.RoleInfo used on opensource projects

Example 1 with RoleInfo

use of com.alibaba.nacos.config.server.auth.RoleInfo in project XHuiCloud by sindaZeng.

the class NacosAuthManager method loginRemote.

@Override
public User loginRemote(Object request) throws AccessException {
    Request req = (Request) request;
    String token = resolveToken(req);
    if (StringUtils.isBlank(token)) {
        throw new AccessException("user not found!");
    }
    try {
        tokenManager.validateToken(token);
    } catch (ExpiredJwtException e) {
        throw new AccessException("token expired!");
    } catch (Exception e) {
        throw new AccessException("token invalid!");
    }
    Authentication authentication = tokenManager.getAuthentication(token);
    SecurityContextHolder.getContext().setAuthentication(authentication);
    String username = authentication.getName();
    NacosUser user = new NacosUser();
    user.setUserName(username);
    user.setToken(token);
    List<RoleInfo> roleInfoList = roleService.getRoles(username);
    if (roleInfoList != null) {
        for (RoleInfo roleInfo : roleInfoList) {
            if (roleInfo.getRole().equals(NacosRoleServiceImpl.GLOBAL_ADMIN_ROLE)) {
                user.setGlobalAdmin(true);
                break;
            }
        }
    }
    return user;
}

Example 2 with RoleInfo

use of com.alibaba.nacos.config.server.auth.RoleInfo in project XHuiCloud by sindaZeng.

the class NacosRoleServiceImpl method hasPermission.

/**
 * Determine if the user has permission of the resource.
 *
 * <p>
 * Note if the user has many roles, this method returns true if any one role of the
 * user has the desired permission.
 * @param username user info
 * @param permission permission to auth
 * @return true if granted, false otherwise
 */
public boolean hasPermission(String username, Permission permission) {
    // update password
    if (NacosAuthConfig.UPDATE_PASSWORD_ENTRY_POINT.equals(permission.getResource())) {
        return true;
    }
    List<RoleInfo> roleInfoList = getRoles(username);
    if (Collections.isEmpty(roleInfoList)) {
        return false;
    }
    // Global admin pass:
    for (RoleInfo roleInfo : roleInfoList) {
        if (GLOBAL_ADMIN_ROLE.equals(roleInfo.getRole())) {
            return true;
        }
    }
    // Old global admin can pass resource 'console/':
    if (permission.getResource().startsWith(NacosAuthConfig.CONSOLE_RESOURCE_NAME_PREFIX)) {
        return false;
    }
    // For other roles, use a pattern match to decide if pass or not.
    for (RoleInfo roleInfo : roleInfoList) {
        List<PermissionInfo> permissionInfoList = getPermissions(roleInfo.getRole());
        if (Collections.isEmpty(permissionInfoList)) {
            continue;
        }
        for (PermissionInfo permissionInfo : permissionInfoList) {
            String permissionResource = permissionInfo.getResource().replaceAll("\\*", ".*");
            String permissionAction = permissionInfo.getAction();
            if (permissionAction.contains(permission.getAction()) && Pattern.matches(permissionResource, permission.getResource())) {
                return true;
            }
        }
    }
    return false;
}

Example 3 with RoleInfo

use of com.alibaba.nacos.config.server.auth.RoleInfo in project XHuiCloud by sindaZeng.

the class NacosRoleServiceImpl method reload.

@Scheduled(initialDelay = 5000, fixedDelay = 15000)
private void reload() {
    try {
        Page<RoleInfo> roleInfoPage = rolePersistService.getRolesByUserName(StringUtils.EMPTY, DEFAULT_PAGE_NO, Integer.MAX_VALUE);
        if (roleInfoPage == null) {
            return;
        }
        Set<String> tmpRoleSet = new HashSet<>(16);
        Map<String, List<RoleInfo>> tmpRoleInfoMap = new ConcurrentHashMap<>(16);
        for (RoleInfo roleInfo : roleInfoPage.getPageItems()) {
            if (!tmpRoleInfoMap.containsKey(roleInfo.getUsername())) {
                tmpRoleInfoMap.put(roleInfo.getUsername(), new ArrayList<>());
            }
            tmpRoleInfoMap.get(roleInfo.getUsername()).add(roleInfo);
            tmpRoleSet.add(roleInfo.getRole());
        }
        Map<String, List<PermissionInfo>> tmpPermissionInfoMap = new ConcurrentHashMap<>(16);
        for (String role : tmpRoleSet) {
            Page<PermissionInfo> permissionInfoPage = permissionPersistService.getPermissions(role, DEFAULT_PAGE_NO, Integer.MAX_VALUE);
            tmpPermissionInfoMap.put(role, permissionInfoPage.getPageItems());
        }
        roleSet = tmpRoleSet;
        roleInfoMap = tmpRoleInfoMap;
        permissionInfoMap = tmpPermissionInfoMap;
    } catch (Exception e) {
        Loggers.AUTH.warn("[LOAD-ROLES] load failed", e);
    }
}

Example 4 with RoleInfo

use of com.alibaba.nacos.config.server.auth.RoleInfo in project nacos by alibaba.

the class NacosRoleServiceImpl method hasPermission.

/**
 * Determine if the user has permission of the resource.
 *
 * <p>Note if the user has many roles, this method returns true if any one role of the user has the desired
 * permission.
 *
 * @param username   user info
 * @param permission permission to auth
 * @return true if granted, false otherwise
 */
public boolean hasPermission(String username, Permission permission) {
    // update password
    if (NacosAuthConfig.UPDATE_PASSWORD_ENTRY_POINT.equals(permission.getResource())) {
        return true;
    }
    List<RoleInfo> roleInfoList = getRoles(username);
    if (Collections.isEmpty(roleInfoList)) {
        return false;
    }
    // Global admin pass:
    for (RoleInfo roleInfo : roleInfoList) {
        if (GLOBAL_ADMIN_ROLE.equals(roleInfo.getRole())) {
            return true;
        }
    }
    // Old global admin can pass resource 'console/':
    if (permission.getResource().startsWith(NacosAuthConfig.CONSOLE_RESOURCE_NAME_PREFIX)) {
        return false;
    }
    // For other roles, use a pattern match to decide if pass or not.
    for (RoleInfo roleInfo : roleInfoList) {
        List<PermissionInfo> permissionInfoList = getPermissions(roleInfo.getRole());
        if (Collections.isEmpty(permissionInfoList)) {
            continue;
        }
        for (PermissionInfo permissionInfo : permissionInfoList) {
            String permissionResource = permissionInfo.getResource().replaceAll("\\*", ".*");
            String permissionAction = permissionInfo.getAction();
            if (permissionAction.contains(permission.getAction()) && Pattern.matches(permissionResource, permission.getResource())) {
                return true;
            }
        }
    }
    return false;
}

Example 5 with RoleInfo

use of com.alibaba.nacos.config.server.auth.RoleInfo in project nacos by alibaba.

the class UserController method deleteUser.

/**
 * Delete an existed user.
 *
 * @param username username of user
 * @return ok if deleted succeed, keep silent if user not exist
 * @since 1.2.0
 */
@DeleteMapping
@Secured(resource = NacosAuthConfig.CONSOLE_RESOURCE_NAME_PREFIX + "users", action = ActionTypes.WRITE)
public Object deleteUser(@RequestParam String username) {
    List<RoleInfo> roleInfoList = roleService.getRoles(username);
    if (roleInfoList != null) {
        for (RoleInfo roleInfo : roleInfoList) {
            if (roleInfo.getRole().equals(NacosRoleServiceImpl.GLOBAL_ADMIN_ROLE)) {
                throw new IllegalArgumentException("cannot delete admin: " + username);
            }
        }
    }
    userDetailsService.deleteUser(username);
    return RestResultUtils.success("delete user ok!");
}