Examples with AuthorizationInfo io.druid.server.security.AuthorizationInfo used on opensource projects

Example 6 with AuthorizationInfo

use of io.druid.server.security.AuthorizationInfo in project druid by druid-io.

the class OverlordResource method securedTaskRunnerWorkItem.

private Collection<? extends TaskRunnerWorkItem> securedTaskRunnerWorkItem(Collection<? extends TaskRunnerWorkItem> collectionToFilter, HttpServletRequest req) {
    final Map<Pair<Resource, Action>, Access> resourceAccessMap = new HashMap<>();
    final AuthorizationInfo authorizationInfo = (AuthorizationInfo) req.getAttribute(AuthConfig.DRUID_AUTH_TOKEN);
    return Collections2.filter(collectionToFilter, new Predicate<TaskRunnerWorkItem>() {

        @Override
        public boolean apply(TaskRunnerWorkItem input) {
            final String taskId = input.getTaskId();
            final Optional<Task> optionalTask = taskStorageQueryAdapter.getTask(taskId);
            if (!optionalTask.isPresent()) {
                throw new WebApplicationException(Response.serverError().entity(String.format("No task information found for task with id: [%s]", taskId)).build());
            }
            Resource resource = new Resource(optionalTask.get().getDataSource(), ResourceType.DATASOURCE);
            Action action = Action.READ;
            Pair<Resource, Action> key = new Pair<>(resource, action);
            if (resourceAccessMap.containsKey(key)) {
                return resourceAccessMap.get(key).isAllowed();
            } else {
                Access access = authorizationInfo.isAuthorized(key.lhs, key.rhs);
                resourceAccessMap.put(key, access);
                return access.isAllowed();
            }
        }
    });
}

Example 7 with AuthorizationInfo

use of io.druid.server.security.AuthorizationInfo in project druid by druid-io.

the class OverlordResource method taskPost.

@POST
@Path("/task")
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
public Response taskPost(final Task task, @Context final HttpServletRequest req) {
    if (authConfig.isEnabled()) {
        // This is an experimental feature, see - https://github.com/druid-io/druid/pull/2424
        final String dataSource = task.getDataSource();
        final AuthorizationInfo authorizationInfo = (AuthorizationInfo) req.getAttribute(AuthConfig.DRUID_AUTH_TOKEN);
        Preconditions.checkNotNull(authorizationInfo, "Security is enabled but no authorization info found in the request");
        Access authResult = authorizationInfo.isAuthorized(new Resource(dataSource, ResourceType.DATASOURCE), Action.WRITE);
        if (!authResult.isAllowed()) {
            return Response.status(Response.Status.FORBIDDEN).header("Access-Check-Result", authResult).build();
        }
    }
    return asLeaderWith(taskMaster.getTaskQueue(), new Function<TaskQueue, Response>() {

        @Override
        public Response apply(TaskQueue taskQueue) {
            try {
                taskQueue.add(task);
                return Response.ok(ImmutableMap.of("task", task.getId())).build();
            } catch (EntryExistsException e) {
                return Response.status(Response.Status.BAD_REQUEST).entity(ImmutableMap.of("error", String.format("Task[%s] already exists!", task.getId()))).build();
            }
        }
    });
}

Example 8 with AuthorizationInfo

use of io.druid.server.security.AuthorizationInfo in project druid by druid-io.

the class OverlordResource method getCompleteTasks.

@GET
@Path("/completeTasks")
@Produces(MediaType.APPLICATION_JSON)
public Response getCompleteTasks(@Context final HttpServletRequest req) {
    final List<TaskStatus> recentlyFinishedTasks;
    if (authConfig.isEnabled()) {
        // This is an experimental feature, see - https://github.com/druid-io/druid/pull/2424
        final Map<Pair<Resource, Action>, Access> resourceAccessMap = new HashMap<>();
        final AuthorizationInfo authorizationInfo = (AuthorizationInfo) req.getAttribute(AuthConfig.DRUID_AUTH_TOKEN);
        recentlyFinishedTasks = ImmutableList.copyOf(Iterables.filter(taskStorageQueryAdapter.getRecentlyFinishedTaskStatuses(), new Predicate<TaskStatus>() {

            @Override
            public boolean apply(TaskStatus input) {
                final String taskId = input.getId();
                final Optional<Task> optionalTask = taskStorageQueryAdapter.getTask(taskId);
                if (!optionalTask.isPresent()) {
                    throw new WebApplicationException(Response.serverError().entity(String.format("No task information found for task with id: [%s]", taskId)).build());
                }
                Resource resource = new Resource(optionalTask.get().getDataSource(), ResourceType.DATASOURCE);
                Action action = Action.READ;
                Pair<Resource, Action> key = new Pair<>(resource, action);
                if (resourceAccessMap.containsKey(key)) {
                    return resourceAccessMap.get(key).isAllowed();
                } else {
                    Access access = authorizationInfo.isAuthorized(key.lhs, key.rhs);
                    resourceAccessMap.put(key, access);
                    return access.isAllowed();
                }
            }
        }));
    } else {
        recentlyFinishedTasks = taskStorageQueryAdapter.getRecentlyFinishedTaskStatuses();
    }
    final List<TaskResponseObject> completeTasks = Lists.transform(recentlyFinishedTasks, new Function<TaskStatus, TaskResponseObject>() {

        @Override
        public TaskResponseObject apply(TaskStatus taskStatus) {
            // Would be nice to include the real created date, but the TaskStorage API doesn't yet allow it.
            return new TaskResponseObject(taskStatus.getId(), new DateTime(0), new DateTime(0), Optional.of(taskStatus), TaskLocation.unknown());
        }
    });
    return Response.ok(completeTasks).build();
}

Example 9 with AuthorizationInfo

use of io.druid.server.security.AuthorizationInfo in project druid by druid-io.

the class OverlordResource method getWaitingTasks.

@GET
@Path("/waitingTasks")
@Produces(MediaType.APPLICATION_JSON)
public Response getWaitingTasks(@Context final HttpServletRequest req) {
    return workItemsResponse(new Function<TaskRunner, Collection<? extends TaskRunnerWorkItem>>() {

        @Override
        public Collection<? extends TaskRunnerWorkItem> apply(TaskRunner taskRunner) {
            // A bit roundabout, but works as a way of figuring out what tasks haven't been handed
            // off to the runner yet:
            final List<Task> allActiveTasks = taskStorageQueryAdapter.getActiveTasks();
            final List<Task> activeTasks;
            if (authConfig.isEnabled()) {
                // This is an experimental feature, see - https://github.com/druid-io/druid/pull/2424
                final Map<Pair<Resource, Action>, Access> resourceAccessMap = new HashMap<>();
                final AuthorizationInfo authorizationInfo = (AuthorizationInfo) req.getAttribute(AuthConfig.DRUID_AUTH_TOKEN);
                activeTasks = ImmutableList.copyOf(Iterables.filter(allActiveTasks, new Predicate<Task>() {

                    @Override
                    public boolean apply(Task input) {
                        Resource resource = new Resource(input.getDataSource(), ResourceType.DATASOURCE);
                        Action action = Action.READ;
                        Pair<Resource, Action> key = new Pair<>(resource, action);
                        if (resourceAccessMap.containsKey(key)) {
                            return resourceAccessMap.get(key).isAllowed();
                        } else {
                            Access access = authorizationInfo.isAuthorized(key.lhs, key.rhs);
                            resourceAccessMap.put(key, access);
                            return access.isAllowed();
                        }
                    }
                }));
            } else {
                activeTasks = allActiveTasks;
            }
            final Set<String> runnersKnownTasks = Sets.newHashSet(Iterables.transform(taskRunner.getKnownTasks(), new Function<TaskRunnerWorkItem, String>() {

                @Override
                public String apply(final TaskRunnerWorkItem workItem) {
                    return workItem.getTaskId();
                }
            }));
            final List<TaskRunnerWorkItem> waitingTasks = Lists.newArrayList();
            for (final Task task : activeTasks) {
                if (!runnersKnownTasks.contains(task.getId())) {
                    waitingTasks.add(// Would be nice to include the real created date, but the TaskStorage API doesn't yet allow it.
                    new TaskRunnerWorkItem(task.getId(), SettableFuture.<TaskStatus>create(), new DateTime(0), new DateTime(0)) {

                        @Override
                        public TaskLocation getLocation() {
                            return TaskLocation.unknown();
                        }
                    });
                }
            }
            return waitingTasks;
        }
    });
}

Example 10 with AuthorizationInfo

use of io.druid.server.security.AuthorizationInfo in project druid by druid-io.

the class TaskResourceFilter method filter.

@Override
public ContainerRequest filter(ContainerRequest request) {
    if (getAuthConfig().isEnabled()) {
        // This is an experimental feature, see - https://github.com/druid-io/druid/pull/2424
        final String taskId = Preconditions.checkNotNull(request.getPathSegments().get(Iterables.indexOf(request.getPathSegments(), new Predicate<PathSegment>() {

            @Override
            public boolean apply(PathSegment input) {
                return input.getPath().equals("task");
            }
        }) + 1).getPath());
        Optional<Task> taskOptional = taskStorageQueryAdapter.getTask(taskId);
        if (!taskOptional.isPresent()) {
            throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST).entity(String.format("Cannot find any task with id: [%s]", taskId)).build());
        }
        final String dataSourceName = Preconditions.checkNotNull(taskOptional.get().getDataSource());
        final AuthorizationInfo authorizationInfo = (AuthorizationInfo) getReq().getAttribute(AuthConfig.DRUID_AUTH_TOKEN);
        Preconditions.checkNotNull(authorizationInfo, "Security is enabled but no authorization info found in the request");
        final Access authResult = authorizationInfo.isAuthorized(new Resource(dataSourceName, ResourceType.DATASOURCE), getAction(request));
        if (!authResult.isAllowed()) {
            throw new WebApplicationException(Response.status(Response.Status.FORBIDDEN).entity(String.format("Access-Check-Result: %s", authResult.toString())).build());
        }
    }
    return request;
}