Examples with AccessDeniedException io.trino.spi.security.AccessDeniedException used on opensource projects

Example 11 with AccessDeniedException

use of io.trino.spi.security.AccessDeniedException in project trino by trinodb.

the class QueryResource method cancelQuery.

@ResourceSecurity(AUTHENTICATED_USER)
@DELETE
@Path("{queryId}")
public void cancelQuery(@PathParam("queryId") QueryId queryId, @Context HttpServletRequest servletRequest, @Context HttpHeaders httpHeaders) {
    requireNonNull(queryId, "queryId is null");
    try {
        BasicQueryInfo queryInfo = dispatchManager.getQueryInfo(queryId);
        checkCanKillQueryOwnedBy(sessionContextFactory.extractAuthorizedIdentity(servletRequest, httpHeaders, alternateHeaderName), queryInfo.getSession().toIdentity(), accessControl);
        dispatchManager.cancelQuery(queryId);
    } catch (AccessDeniedException e) {
        throw new ForbiddenException();
    } catch (NoSuchElementException ignored) {
    }
}

Example 12 with AccessDeniedException

use of io.trino.spi.security.AccessDeniedException in project trino by trinodb.

the class TestFileBasedSystemAccessControl method testCanSetUserOperations.

@Test
public void testCanSetUserOperations() {
    SystemAccessControl accessControl = newFileBasedSystemAccessControl("file-based-system-catalog_principal.json");
    try {
        accessControl.checkCanSetUser(Optional.empty(), alice.getUser());
        throw new AssertionError("expected AccessDeniedException");
    } catch (AccessDeniedException expected) {
    }
    accessControl.checkCanSetUser(kerberosValidAlice.getPrincipal(), kerberosValidAlice.getUser());
    accessControl.checkCanSetUser(kerberosValidNonAsciiUser.getPrincipal(), kerberosValidNonAsciiUser.getUser());
    try {
        accessControl.checkCanSetUser(kerberosInvalidAlice.getPrincipal(), kerberosInvalidAlice.getUser());
        throw new AssertionError("expected AccessDeniedException");
    } catch (AccessDeniedException expected) {
    }
    accessControl.checkCanSetUser(kerberosValidShare.getPrincipal(), kerberosValidShare.getUser());
    try {
        accessControl.checkCanSetUser(kerberosInValidShare.getPrincipal(), kerberosInValidShare.getUser());
        throw new AssertionError("expected AccessDeniedException");
    } catch (AccessDeniedException expected) {
    }
    accessControl.checkCanSetUser(validSpecialRegexWildDot.getPrincipal(), validSpecialRegexWildDot.getUser());
    accessControl.checkCanSetUser(validSpecialRegexEndQuote.getPrincipal(), validSpecialRegexEndQuote.getUser());
    try {
        accessControl.checkCanSetUser(invalidSpecialRegex.getPrincipal(), invalidSpecialRegex.getUser());
        throw new AssertionError("expected AccessDeniedException");
    } catch (AccessDeniedException expected) {
    }
    SystemAccessControl accessControlNoPatterns = newFileBasedSystemAccessControl("file-based-system-catalog.json");
    accessControlNoPatterns.checkCanSetUser(kerberosValidAlice.getPrincipal(), kerberosValidAlice.getUser());
}

Example 13 with AccessDeniedException

use of io.trino.spi.security.AccessDeniedException in project trino by trinodb.

the class S3SecurityMappingConfigurationProvider method updateConfiguration.

@Override
public void updateConfiguration(Configuration configuration, HdfsContext context, URI uri) {
    if (!SCHEMES.contains(uri.getScheme())) {
        return;
    }
    S3SecurityMapping mapping = mappings.get().getMapping(context.getIdentity(), uri).orElseThrow(() -> new AccessDeniedException("No matching S3 security mapping"));
    if (mapping.isUseClusterDefault()) {
        return;
    }
    Hasher hasher = Hashing.sha256().newHasher();
    mapping.getCredentials().ifPresent(credentials -> {
        configuration.set(S3_ACCESS_KEY, credentials.getAWSAccessKeyId());
        configuration.set(S3_SECRET_KEY, credentials.getAWSSecretKey());
        hasher.putString(credentials.getAWSAccessKeyId(), UTF_8);
        hasher.putString(credentials.getAWSSecretKey(), UTF_8);
    });
    selectRole(mapping, context).ifPresent(role -> {
        configuration.set(S3_IAM_ROLE, role);
        hasher.putString(role, UTF_8);
    });
    selectKmsKeyId(mapping, context).ifPresent(key -> {
        configuration.set(S3_KMS_KEY_ID, key);
        hasher.putString(S3_KMS_KEY_ID + ":" + key, UTF_8);
    });
    mapping.getEndpoint().ifPresent(endpoint -> {
        configuration.set(S3_ENDPOINT, endpoint);
        hasher.putString(endpoint, UTF_8);
    });
    mapping.getRoleSessionName().ifPresent(roleSessionName -> {
        configuration.set(S3_ROLE_SESSION_NAME, roleSessionName.replace("${USER}", context.getIdentity().getUser()));
        hasher.putString(roleSessionName, UTF_8);
    });
    setCacheKey(configuration, hasher.hash().toString());
}

Example 14 with AccessDeniedException

use of io.trino.spi.security.AccessDeniedException in project trino by trinodb.

the class PasswordManagerFormAuthenticator method isValidCredential.

@Override
public Optional<String> isValidCredential(String username, String password, boolean secure) {
    if (username == null) {
        return Optional.empty();
    }
    if (!secure) {
        return Optional.of(username).filter(user -> insecureAuthenticationOverHttpAllowed && password == null);
    }
    List<PasswordAuthenticator> authenticators = passwordAuthenticatorManager.getAuthenticators();
    for (PasswordAuthenticator authenticator : authenticators) {
        try {
            Principal principal = authenticator.createAuthenticatedPrincipal(username, password);
            String authenticatedUser = userMapping.mapUser(principal.toString());
            return Optional.of(authenticatedUser);
        } catch (AccessDeniedException | UserMappingException e) {
        // Try another one
        } catch (RuntimeException e) {
            log.debug(e, "Error authenticating user for Web UI");
        }
    }
    return Optional.empty();
}

Example 15 with AccessDeniedException

use of io.trino.spi.security.AccessDeniedException in project trino by trinodb.

the class UiQueryResource method getQueryInfo.

@ResourceSecurity(WEB_UI)
@GET
@Path("{queryId}")
public Response getQueryInfo(@PathParam("queryId") QueryId queryId, @Context HttpServletRequest servletRequest, @Context HttpHeaders httpHeaders) {
    requireNonNull(queryId, "queryId is null");
    Optional<QueryInfo> queryInfo = dispatchManager.getFullQueryInfo(queryId);
    if (queryInfo.isPresent()) {
        try {
            checkCanViewQueryOwnedBy(sessionContextFactory.extractAuthorizedIdentity(servletRequest, httpHeaders, alternateHeaderName), queryInfo.get().getSession().toIdentity(), accessControl);
            return Response.ok(queryInfo.get()).build();
        } catch (AccessDeniedException e) {
            throw new ForbiddenException();
        }
    }
    return Response.status(Status.GONE).build();
}