Examples with AccessController io.cdap.cdap.security.spi.authorization.AccessController used on opensource projects

Example 11 with AccessController

use of io.cdap.cdap.security.spi.authorization.AccessController in project cdap by cdapio.

the class DefaultAccessEnforcerTest method testMetricsContextNotCalledIfDisabled.

@Test
public void testMetricsContextNotCalledIfDisabled() throws IOException, AccessException {
    CConfiguration cConfCopy = CConfiguration.copy(CCONF);
    cConfCopy.setBoolean(Constants.Metrics.AUTHORIZATION_METRICS_ENABLED, false);
    ControllerWrapper controllerWrapper = createControllerWrapper(cConfCopy, SCONF, null);
    AccessController accessController = controllerWrapper.accessController;
    DefaultAccessEnforcer accessEnforcer = controllerWrapper.defaultAccessEnforcer;
    DatasetId ds = NS.dataset("ds");
    accessController.grant(Authorizable.fromEntityId(NS), ALICE, ImmutableSet.of(StandardPermission.GET, StandardPermission.UPDATE));
    accessEnforcer.enforce(NS, ALICE, ImmutableSet.of(StandardPermission.GET, StandardPermission.UPDATE));
    // Verify the metrics context was not called
    verify(controllerWrapper.mockMetricsContext, times(0)).increment(any(String.class), any(Long.class));
    verify(controllerWrapper.mockMetricsContext, times(0)).gauge(any(String.class), any(Long.class));
}

Example 12 with AccessController

use of io.cdap.cdap.security.spi.authorization.AccessController in project cdap by cdapio.

the class DefaultAccessEnforcerTest method testAuthEnforceWithEncryptedCredential.

@Test
public void testAuthEnforceWithEncryptedCredential() throws IOException, AccessException, CipherException, GeneralSecurityException {
    SConfiguration sConfCopy = enableCredentialEncryption();
    TinkCipher cipher = new TinkCipher(sConfCopy);
    String cred = cipher.encryptToBase64("credential".getBytes(StandardCharsets.UTF_8), null);
    Principal userWithCredEncrypted = new Principal("userFoo", Principal.PrincipalType.USER, null, new Credential(cred, Credential.CredentialType.EXTERNAL_ENCRYPTED));
    ControllerWrapper controllerWrapper = createControllerWrapper(CCONF, sConfCopy, null);
    AccessController accessController = controllerWrapper.accessController;
    DefaultAccessEnforcer accessEnforcer = controllerWrapper.defaultAccessEnforcer;
    assertAuthorizationFailure(accessEnforcer, NS, userWithCredEncrypted, StandardPermission.UPDATE);
    accessController.grant(Authorizable.fromEntityId(NS), userWithCredEncrypted, ImmutableSet.of(StandardPermission.GET, StandardPermission.UPDATE));
    accessEnforcer.enforce(NS, userWithCredEncrypted, StandardPermission.GET);
    accessEnforcer.enforce(NS, userWithCredEncrypted, StandardPermission.UPDATE);
    // Verify the metrics context was called with correct metrics
    verify(controllerWrapper.mockMetricsContext, times(2)).increment(Constants.Metrics.Authorization.EXTENSION_CHECK_SUCCESS_COUNT, 1);
    verify(controllerWrapper.mockMetricsContext, times(1)).increment(Constants.Metrics.Authorization.EXTENSION_CHECK_FAILURE_COUNT, 1);
    verify(controllerWrapper.mockMetricsContext, times(3)).gauge(eq(Constants.Metrics.Authorization.EXTENSION_CHECK_MILLIS), any(Long.class));
}

Example 13 with AccessController

use of io.cdap.cdap.security.spi.authorization.AccessController in project cdap by cdapio.

the class DefaultAccessEnforcerTest method testIsVisible.

@Test
public void testIsVisible() throws IOException, AccessException {
    ControllerWrapper controllerWrapper = createControllerWrapper(CCONF, SCONF, null);
    AccessController accessController = controllerWrapper.accessController;
    DefaultAccessEnforcer authEnforcementService = controllerWrapper.defaultAccessEnforcer;
    NamespaceId ns1 = new NamespaceId("ns1");
    NamespaceId ns2 = new NamespaceId("ns2");
    DatasetId ds11 = ns1.dataset("ds11");
    DatasetId ds12 = ns1.dataset("ds12");
    DatasetId ds21 = ns2.dataset("ds21");
    DatasetId ds22 = ns2.dataset("ds22");
    DatasetId ds23 = ns2.dataset("ds33");
    Set<NamespaceId> namespaces = ImmutableSet.of(ns1, ns2);
    // Alice has access on ns1, ns2, ds11, ds21, ds23, Bob has access on ds11, ds12, ds22
    accessController.grant(Authorizable.fromEntityId(ns1), ALICE, Collections.singleton(StandardPermission.UPDATE));
    accessController.grant(Authorizable.fromEntityId(ns2), ALICE, Collections.singleton(StandardPermission.UPDATE));
    accessController.grant(Authorizable.fromEntityId(ds11), ALICE, Collections.singleton(StandardPermission.GET));
    accessController.grant(Authorizable.fromEntityId(ds11), BOB, Collections.singleton(StandardPermission.UPDATE));
    accessController.grant(Authorizable.fromEntityId(ds21), ALICE, Collections.singleton(StandardPermission.UPDATE));
    accessController.grant(Authorizable.fromEntityId(ds12), BOB, Collections.singleton(StandardPermission.UPDATE));
    accessController.grant(Authorizable.fromEntityId(ds12), BOB, EnumSet.allOf(StandardPermission.class));
    accessController.grant(Authorizable.fromEntityId(ds21), ALICE, Collections.singleton(StandardPermission.UPDATE));
    accessController.grant(Authorizable.fromEntityId(ds23), ALICE, Collections.singleton(StandardPermission.UPDATE));
    accessController.grant(Authorizable.fromEntityId(ds22), BOB, Collections.singleton(StandardPermission.UPDATE));
    Assert.assertEquals(namespaces.size(), authEnforcementService.isVisible(namespaces, ALICE).size());
    // bob should also be able to list two namespaces since he has privileges on the dataset in both namespaces
    Assert.assertEquals(namespaces.size(), authEnforcementService.isVisible(namespaces, BOB).size());
    Set<DatasetId> expectedDatasetIds = ImmutableSet.of(ds11, ds21, ds23);
    Assert.assertEquals(expectedDatasetIds.size(), authEnforcementService.isVisible(expectedDatasetIds, ALICE).size());
    expectedDatasetIds = ImmutableSet.of(ds12, ds22);
    // this will be empty since now isVisible will not check the hierarchy privilege for the parent of the entity
    Assert.assertEquals(Collections.EMPTY_SET, authEnforcementService.isVisible(expectedDatasetIds, ALICE));
    expectedDatasetIds = ImmutableSet.of(ds11, ds12, ds22);
    Assert.assertEquals(expectedDatasetIds.size(), authEnforcementService.isVisible(expectedDatasetIds, BOB).size());
    expectedDatasetIds = ImmutableSet.of(ds21, ds23);
    Assert.assertTrue(authEnforcementService.isVisible(expectedDatasetIds, BOB).isEmpty());
    // Verify the metrics context was called with correct metrics
    verify(controllerWrapper.mockMetricsContext, times(6)).increment(Constants.Metrics.Authorization.NON_INTERNAL_VISIBILITY_CHECK_COUNT, 1);
    verify(controllerWrapper.mockMetricsContext, times(6)).gauge(eq(Constants.Metrics.Authorization.EXTENSION_VISIBILITY_MILLIS), any(Long.class));
}

Example 14 with AccessController

use of io.cdap.cdap.security.spi.authorization.AccessController in project cdap by cdapio.

the class AccessControllerInstantiatorTest method testAccessControllerExtensionExtraClasspath.

@Test
public void testAccessControllerExtensionExtraClasspath() throws IOException, ClassNotFoundException {
    Location externalAuthJar = createValidAuthExtensionJar();
    CConfiguration cConfCopy = CConfiguration.copy(CCONF);
    cConfCopy.set(Constants.Security.Authorization.EXTENSION_JAR_PATH, externalAuthJar.toString());
    cConfCopy.set(Constants.Security.Authorization.EXTENSION_CONFIG_PREFIX + "config.path", "/path/config.ini");
    cConfCopy.set(Constants.Security.Authorization.EXTENSION_CONFIG_PREFIX + "service.address", "http://foo.bar.co:5555");
    cConfCopy.set(Constants.Security.Authorization.EXTENSION_CONFIG_PREFIX + "cache.ttl.secs", "500");
    cConfCopy.set(Constants.Security.Authorization.EXTENSION_CONFIG_PREFIX + "cache.max.entries", "50000");
    cConfCopy.set("foo." + Constants.Security.Authorization.EXTENSION_CONFIG_PREFIX + "dont.include", "not.prefix.should.not.be.included");
    try (AccessControllerInstantiator instantiator = new AccessControllerInstantiator(cConfCopy, AUTH_CONTEXT_FACTORY)) {
        // should be able to load the ExternalAccessController class via the AccessControllerInstantiatorService
        AccessController externalAccessController1 = instantiator.get();
        Assert.assertNotNull(externalAccessController1);
        AccessController externalAccessController2 = instantiator.get();
        Assert.assertNotNull(externalAccessController2);
        // verify that get returns the same  instance each time it is called.
        Assert.assertEquals(externalAccessController1, externalAccessController2);
        ClassLoader accessControllerClassLoader = externalAccessController1.getClass().getClassLoader();
        ClassLoader parent = accessControllerClassLoader.getParent();
        // should be able to load the AccessController interface via the parent
        parent.loadClass(AccessController.class.getName());
        // should not be able to load the ExternalAccessController class via the parent class loader
        try {
            parent.loadClass(ValidExternalAccessController.class.getName());
            Assert.fail("Should not be able to load external accessController classes via the parent classloader of the " + "AccessController class loader.");
        } catch (ClassNotFoundException expected) {
        // expected
        }
        // should be able to load the ExternalAccessController class via the AccessControllerClassLoader
        accessControllerClassLoader.loadClass(ValidExternalAccessController.class.getName());
        // have to do this because the external accessController instance is created in a new classloader, so casting will
        // not work.
        Gson gson = new Gson();
        ValidExternalAccessController validAccessController = gson.fromJson(gson.toJson(externalAccessController1), ValidExternalAccessController.class);
        Properties expectedProps = new Properties();
        expectedProps.put("config.path", "/path/config.ini");
        expectedProps.put("service.address", "http://foo.bar.co:5555");
        expectedProps.put("cache.ttl.secs", "500");
        expectedProps.put("cache.max.entries", "50000");
        Properties actualProps = validAccessController.getProperties();
        Assert.assertEquals(expectedProps, actualProps);
    }
}

Example 15 with AccessController

use of io.cdap.cdap.security.spi.authorization.AccessController in project cdap by cdapio.

the class DefaultAccessEnforcerTest method testIsVisibleWithEncryptedCredential.

@Test
public void testIsVisibleWithEncryptedCredential() throws IOException, AccessException, CipherException, GeneralSecurityException {
    SConfiguration sConfCopy = enableCredentialEncryption();
    TinkCipher cipher = new TinkCipher(sConfCopy);
    String cred = cipher.encryptToBase64("credential".getBytes(StandardCharsets.UTF_8), null);
    Principal userWithCredEncrypted = new Principal("userFoo", Principal.PrincipalType.USER, null, new Credential(cred, Credential.CredentialType.EXTERNAL_ENCRYPTED));
    ControllerWrapper controllerWrapper = createControllerWrapper(CCONF, sConfCopy, null);
    AccessController accessController = controllerWrapper.accessController;
    DefaultAccessEnforcer accessEnforcer = controllerWrapper.defaultAccessEnforcer;
    Set<NamespaceId> namespaces = ImmutableSet.of(NS);
    Assert.assertEquals(0, accessEnforcer.isVisible(namespaces, userWithCredEncrypted).size());
    accessController.grant(Authorizable.fromEntityId(NS), userWithCredEncrypted, ImmutableSet.of(StandardPermission.GET, StandardPermission.UPDATE));
    Assert.assertEquals(1, accessEnforcer.isVisible(namespaces, userWithCredEncrypted).size());
    // Verify the metrics context was called with correct metrics
    verify(controllerWrapper.mockMetricsContext, times(2)).increment(Constants.Metrics.Authorization.NON_INTERNAL_VISIBILITY_CHECK_COUNT, 1);
    verify(controllerWrapper.mockMetricsContext, times(2)).gauge(eq(Constants.Metrics.Authorization.EXTENSION_VISIBILITY_MILLIS), any(Long.class));
}