Examples with KsqlSecurityContext io.confluent.ksql.security.KsqlSecurityContext used on opensource projects

Example 6 with KsqlSecurityContext

use of io.confluent.ksql.security.KsqlSecurityContext in project ksql by confluentinc.

the class DefaultKsqlSecurityContextProviderTest method shouldCreateDefaultServiceContextIfUserPrincipalIsMissing.

@Test
public void shouldCreateDefaultServiceContextIfUserPrincipalIsMissing() {
    // Given:
    when(securityExtension.getUserContextProvider()).thenReturn(Optional.of(userContextProvider));
    when(apiSecurityContext.getPrincipal()).thenReturn(Optional.empty());
    // When:
    final KsqlSecurityContext ksqlSecurityContext = ksqlSecurityContextProvider.provide(apiSecurityContext);
    // Then:
    assertThat(ksqlSecurityContext.getUserPrincipal(), is(Optional.empty()));
    assertThat(ksqlSecurityContext.getServiceContext(), is(defaultServiceContext));
}

Example 7 with KsqlSecurityContext

use of io.confluent.ksql.security.KsqlSecurityContext in project ksql by confluentinc.

the class DefaultKsqlSecurityContextProviderTest method shouldCreateUserServiceContextIfUserContextProviderIsEnabled.

@Test
public void shouldCreateUserServiceContextIfUserContextProviderIsEnabled() {
    // Given:
    when(securityExtension.getUserContextProvider()).thenReturn(Optional.of(userContextProvider));
    // When:
    final KsqlSecurityContext ksqlSecurityContext = ksqlSecurityContextProvider.provide(apiSecurityContext);
    // Then:
    verify(userServiceContextFactory).create(eq(ksqlConfig), eq(Optional.empty()), any(), any(), any(), any(), any(), any());
    assertThat(ksqlSecurityContext.getUserPrincipal(), is(Optional.of(user1)));
    assertThat(ksqlSecurityContext.getServiceContext(), is(userServiceContext));
}

Example 8 with KsqlSecurityContext

use of io.confluent.ksql.security.KsqlSecurityContext in project ksql by confluentinc.

the class StreamedQueryResourceTest method setup.

@Before
public void setup() {
    when(serviceContext.getTopicClient()).thenReturn(mockKafkaTopicClient);
    query = PreparedStatement.of(PUSH_QUERY_STRING, mock(Query.class));
    invalid = PreparedStatement.of("sql", mock(Statement.class));
    when(mockStatementParser.parseSingleStatement(PUSH_QUERY_STRING)).thenReturn(invalid);
    final PreparedStatement<Statement> pullQueryStatement = PreparedStatement.of(PULL_QUERY_STRING, mock(Query.class));
    when(mockStatementParser.parseSingleStatement(PULL_QUERY_STRING)).thenReturn(pullQueryStatement);
    when(errorsHandler.accessDeniedFromKafkaResponse(any(Exception.class))).thenReturn(AUTHORIZATION_ERROR_RESPONSE);
    when(errorsHandler.generateResponse(exception.capture(), any())).thenReturn(EndpointResponse.failed(500));
    when(queryExecutor.handleStatement(any(), any(), any(), any(), any(), any(), any(), anyBoolean())).thenReturn(queryMetadataHolder);
    when(pullQueryResult.getPullQueryQueue()).thenReturn(pullQueryQueue);
    securityContext = new KsqlSecurityContext(Optional.empty(), serviceContext);
    testResource = new StreamedQueryResource(mockKsqlEngine, ksqlRestConfig, mockStatementParser, commandQueue, DISCONNECT_CHECK_INTERVAL, COMMAND_QUEUE_CATCHUP_TIMOEUT, activenessRegistrar, Optional.of(authorizationValidator), errorsHandler, denyListPropertyValidator, queryExecutor);
    testResource.configure(VALID_CONFIG);
}

Example 9 with KsqlSecurityContext

use of io.confluent.ksql.security.KsqlSecurityContext in project ksql by confluentinc.

the class DistributingExecutorTest method shouldThrowServerExceptionIfServerServiceContextIsDeniedAuthorization.

@Test
public void shouldThrowServerExceptionIfServerServiceContextIsDeniedAuthorization() {
    // Given:
    final KsqlSecurityContext userSecurityContext = new KsqlSecurityContext(Optional.empty(), SandboxedServiceContext.create(TestServiceContext.create()));
    final PreparedStatement<Statement> preparedStatement = PreparedStatement.of("", new ListProperties(Optional.empty()));
    final ConfiguredStatement<Statement> configured = ConfiguredStatement.of(preparedStatement, SessionConfig.of(KSQL_CONFIG, ImmutableMap.of()));
    doNothing().when(authorizationValidator).checkAuthorization(eq(userSecurityContext), any(), any());
    doThrow(KsqlTopicAuthorizationException.class).when(authorizationValidator).checkAuthorization(ArgumentMatchers.argThat(securityContext -> securityContext.getServiceContext() == serviceContext), any(), any());
    // When:
    final Exception e = assertThrows(KsqlServerException.class, () -> distributor.execute(configured, executionContext, userSecurityContext));
    // Then:
    assertThat(e.getCause(), (is(instanceOf(KsqlTopicAuthorizationException.class))));
}

Example 10 with KsqlSecurityContext

use of io.confluent.ksql.security.KsqlSecurityContext in project ksql by confluentinc.

the class DistributingExecutorTest method setUp.

@Before
public void setUp() throws InterruptedException {
    scnCounter = new AtomicLong();
    when(schemaInjector.inject(any())).thenAnswer(inv -> inv.getArgument(0));
    when(topicInjector.inject(any())).thenAnswer(inv -> inv.getArgument(0));
    when(queue.enqueueCommand(any(), any(), any())).thenReturn(status);
    when(status.tryWaitForFinalStatus(any())).thenReturn(SUCCESS_STATUS);
    when(status.getCommandId()).thenReturn(CS_COMMAND);
    when(status.getCommandSequenceNumber()).thenAnswer(inv -> scnCounter.incrementAndGet());
    when(executionContext.getMetaStore()).thenReturn(metaStore);
    when(executionContext.createSandbox(any())).thenReturn(sandboxContext);
    when(commandRunnerWarning.get()).thenReturn("");
    serviceContext = SandboxedServiceContext.create(TestServiceContext.create());
    when(executionContext.getServiceContext()).thenReturn(serviceContext);
    when(validatedCommandFactory.create(any(), any())).thenReturn(command);
    when(queue.createTransactionalProducer()).thenReturn(transactionalProducer);
    securityContext = new KsqlSecurityContext(Optional.empty(), serviceContext);
    distributor = new DistributingExecutor(KSQL_CONFIG, queue, DURATION_10_MS, (ec, sc) -> InjectorChain.of(schemaInjector, topicInjector), Optional.of(authorizationValidator), validatedCommandFactory, errorHandler, commandRunnerWarning);
}