Examples with KsqlSecurityContext io.confluent.ksql.security.KsqlSecurityContext used on opensource projects

Example 11 with KsqlSecurityContext

use of io.confluent.ksql.security.KsqlSecurityContext in project ksql by confluentinc.

the class DistributingExecutorTest method shouldThrowExceptionIfUserServiceContextIsDeniedAuthorization.

@Test
public void shouldThrowExceptionIfUserServiceContextIsDeniedAuthorization() {
    // Given:
    final KsqlSecurityContext userSecurityContext = new KsqlSecurityContext(Optional.empty(), mock(ServiceContext.class));
    final PreparedStatement<Statement> preparedStatement = PreparedStatement.of("", new ListProperties(Optional.empty()));
    final ConfiguredStatement<Statement> configured = ConfiguredStatement.of(preparedStatement, SessionConfig.of(KSQL_CONFIG, ImmutableMap.of()));
    doThrow(KsqlTopicAuthorizationException.class).when(authorizationValidator).checkAuthorization(eq(userSecurityContext), any(), eq(configured.getStatement()));
    // When:
    assertThrows(KsqlTopicAuthorizationException.class, () -> distributor.execute(configured, executionContext, userSecurityContext));
}

Example 12 with KsqlSecurityContext

use of io.confluent.ksql.security.KsqlSecurityContext in project ksql by confluentinc.

the class DefaultKsqlSecurityContextProviderTest method shouldCreateDefaultServiceContextIfUserContextProviderIsNotEnabled.

@Test
public void shouldCreateDefaultServiceContextIfUserContextProviderIsNotEnabled() {
    // Given:
    when(securityExtension.getUserContextProvider()).thenReturn(Optional.empty());
    // When:
    final KsqlSecurityContext ksqlSecurityContext = ksqlSecurityContextProvider.provide(apiSecurityContext);
    // Then:
    assertThat(ksqlSecurityContext.getUserPrincipal(), is(Optional.of(user1)));
    assertThat(ksqlSecurityContext.getServiceContext(), is(defaultServiceContext));
}

Example 13 with KsqlSecurityContext

use of io.confluent.ksql.security.KsqlSecurityContext in project ksql by confluentinc.

the class AuthTest method shouldNotAllowAccessIfPermissionCheckThrowsException.

private void shouldNotAllowAccessIfPermissionCheckThrowsException(ExceptionThrowingRunnable runnable) throws Exception {
    stopServer();
    stopClient();
    this.authorizationProvider = new KsqlAuthorizationProvider() {

        @Override
        public void checkEndpointAccess(final Principal user, final String method, final String path) {
            throw new KsqlException("Forbidden");
        }

        @Override
        public void checkPrivileges(final KsqlSecurityContext securityContext, final AuthObjectType objectType, final String objectName, final List<AclOperation> privileges) {
        // Not required for vert.x authX as it only authorizes endpoints
        }
    };
    createServer(createServerConfig());
    client = createClient();
    runnable.run();
}

Example 14 with KsqlSecurityContext

use of io.confluent.ksql.security.KsqlSecurityContext in project ksql by confluentinc.

the class KsqlResourceTest method setUp.

@Before
public void setUp() throws IOException, RestClientException {
    commandStatus = new QueuedCommandStatus(0, new CommandStatusFuture(new CommandId(TOPIC, "whateva", CREATE)));
    commandStatus1 = new QueuedCommandStatus(1, new CommandStatusFuture(new CommandId(TABLE, "something", DROP)));
    final QueuedCommandStatus commandStatus2 = new QueuedCommandStatus(2, new CommandStatusFuture(new CommandId(STREAM, "something", EXECUTE)));
    kafkaTopicClient = new FakeKafkaTopicClient();
    kafkaConsumerGroupClient = new FakeKafkaConsumerGroupClient();
    serviceContext = TestServiceContext.create(kafkaTopicClient, kafkaConsumerGroupClient);
    schemaRegistryClient = serviceContext.getSchemaRegistryClient();
    registerValueSchema(schemaRegistryClient);
    ksqlRestConfig = new KsqlRestConfig(getDefaultKsqlConfig());
    ksqlConfig = new KsqlConfig(ksqlRestConfig.getKsqlConfigProperties());
    final KsqlExecutionContext.ExecuteResult result = mock(KsqlExecutionContext.ExecuteResult.class);
    when(sandbox.execute(any(), any(ConfiguredKsqlPlan.class))).thenReturn(result);
    when(result.getQuery()).thenReturn(Optional.empty());
    MutableFunctionRegistry fnRegistry = new InternalFunctionRegistry();
    final Metrics metrics = new Metrics();
    UserFunctionLoader.newInstance(ksqlConfig, fnRegistry, ".", metrics).load();
    metaStore = new MetaStoreImpl(fnRegistry);
    final MetricCollectors metricCollectors = new MetricCollectors(metrics);
    realEngine = KsqlEngineTestUtil.createKsqlEngine(serviceContext, metaStore, (engine) -> new KsqlEngineMetrics("", engine, Collections.emptyMap(), Optional.empty(), metricCollectors), new SequentialQueryIdGenerator(), ksqlConfig, metricCollectors);
    securityContext = new KsqlSecurityContext(Optional.empty(), serviceContext);
    when(commandRunner.getCommandQueue()).thenReturn(commandStore);
    when(commandRunnerWarning.get()).thenReturn("");
    when(commandStore.createTransactionalProducer()).thenReturn(transactionalProducer);
    ksqlEngine = realEngine;
    when(sandbox.getMetaStore()).thenAnswer(inv -> metaStore.copy());
    addTestTopicAndSources();
    when(commandStore.enqueueCommand(any(), any(), any(Producer.class))).thenReturn(commandStatus).thenReturn(commandStatus1).thenReturn(commandStatus2);
    streamName = KsqlIdentifierTestUtil.uniqueIdentifierName();
    when(schemaInjectorFactory.apply(any())).thenReturn(sandboxSchemaInjector);
    when(schemaInjectorFactory.apply(serviceContext)).thenReturn(schemaInjector);
    when(topicInjectorFactory.apply(any())).thenReturn(sandboxTopicInjector);
    when(topicInjectorFactory.apply(ksqlEngine)).thenReturn(topicInjector);
    when(sandboxSchemaInjector.inject(any())).thenAnswer(inv -> inv.getArgument(0));
    when(schemaInjector.inject(any())).thenAnswer(inv -> inv.getArgument(0));
    when(sandboxTopicInjector.inject(any())).thenAnswer(inv -> inv.getArgument(0));
    when(topicInjector.inject(any())).thenAnswer(inv -> inv.getArgument(0));
    when(errorsHandler.generateResponse(any(), any())).thenAnswer(new Answer<EndpointResponse>() {

        @Override
        public EndpointResponse answer(final InvocationOnMock invocation) throws Throwable {
            final Object[] args = invocation.getArguments();
            return (EndpointResponse) args[1];
        }
    });
    setUpKsqlResource();
}

Example 15 with KsqlSecurityContext

use of io.confluent.ksql.security.KsqlSecurityContext in project ksql by confluentinc.

the class RequestHandlerTest method setUp.

@Before
public void setUp() {
    metaStore = new MetaStoreImpl(new InternalFunctionRegistry());
    when(ksqlEngine.prepare(any(), any())).thenAnswer(invocation -> KSQL_PARSER.prepare(invocation.getArgument(0), metaStore));
    when(distributor.execute(any(), any(), any())).thenReturn(response);
    when(response.getEntity()).thenReturn(Optional.of(entity));
    when(sessionProperties.getMutableScopedProperties()).thenReturn(ImmutableMap.of());
    when(ksqlEngine.getKsqlConfig()).thenReturn(ksqlConfig);
    doNothing().when(sync).waitFor(any(), any());
    securityContext = new KsqlSecurityContext(Optional.empty(), serviceContext);
}