Examples with AuthenticatedUser org.apache.cassandra.auth.AuthenticatedUser used on opensource projects

Example 11 with AuthenticatedUser

use of org.apache.cassandra.auth.AuthenticatedUser in project cassandra by apache.

the class CredentialsMessage method execute.

public Message.Response execute(QueryState state, long queryStartNanoTime) {
    try {
        AuthenticatedUser user = DatabaseDescriptor.getAuthenticator().legacyAuthenticate(credentials);
        state.getClientState().login(user);
        AuthMetrics.instance.markSuccess();
    } catch (AuthenticationException e) {
        AuthMetrics.instance.markFailure();
        return ErrorMessage.fromException(e);
    }
    return new ReadyMessage();
}

Example 12 with AuthenticatedUser

use of org.apache.cassandra.auth.AuthenticatedUser in project cassandra by apache.

the class AlterSchemaStatement method execute.

public ResultMessage execute(QueryState state, boolean locally) {
    if (SchemaConstants.isLocalSystemKeyspace(keyspaceName))
        throw ire("System keyspace '%s' is not user-modifiable", keyspaceName);
    KeyspaceMetadata keyspace = Schema.instance.getKeyspaceMetadata(keyspaceName);
    if (null != keyspace && keyspace.isVirtual())
        throw ire("Virtual keyspace '%s' is not user-modifiable", keyspaceName);
    validateKeyspaceName();
    KeyspacesDiff diff = MigrationManager.announce(this, locally);
    clientWarnings(diff).forEach(ClientWarn.instance::warn);
    if (diff.isEmpty())
        return new ResultMessage.Void();
    /*
         * When a schema alteration results in a new db object being created, we grant permissions on the new
         * object to the user performing the request if:
         * - the user is not anonymous
         * - the configured IAuthorizer supports granting of permissions (not all do, AllowAllAuthorizer doesn't and
         *   custom external implementations may not)
         */
    AuthenticatedUser user = state.getClientState().getUser();
    if (null != user && !user.isAnonymous())
        createdResources(diff).forEach(r -> grantPermissionsOnResource(r, user));
    return new ResultMessage.SchemaChange(schemaChangeEvent(diff));
}

Example 13 with AuthenticatedUser

use of org.apache.cassandra.auth.AuthenticatedUser in project cassandra by apache.

the class AuthResponse method execute.

@Override
protected Response execute(QueryState queryState, long queryStartNanoTime, boolean traceRequest) {
    try {
        IAuthenticator.SaslNegotiator negotiator = ((ServerConnection) connection).getSaslNegotiator(queryState);
        byte[] challenge = negotiator.evaluateResponse(token);
        if (negotiator.isComplete()) {
            AuthenticatedUser user = negotiator.getAuthenticatedUser();
            queryState.getClientState().login(user);
            ClientMetrics.instance.markAuthSuccess();
            AuthEvents.instance.notifyAuthSuccess(queryState);
            // authentication is complete, send a ready message to the client
            return new AuthSuccess(challenge);
        } else {
            return new AuthChallenge(challenge);
        }
    } catch (AuthenticationException e) {
        ClientMetrics.instance.markAuthFailure();
        AuthEvents.instance.notifyAuthFailure(queryState, e);
        return ErrorMessage.fromException(e);
    }
}

Example 14 with AuthenticatedUser

use of org.apache.cassandra.auth.AuthenticatedUser in project cassandra by apache.

the class InvalidatePermissionsCacheTest method testInvalidatePermissionsForAllRoles.

@Test
public void testInvalidatePermissionsForAllRoles() {
    DataResource rootDataResource = DataResource.root();
    Set<Permission> dataPermissions = rootDataResource.applicablePermissions();
    AuthenticatedUser roleA = new AuthenticatedUser(ROLE_A.getRoleName());
    AuthenticatedUser roleB = new AuthenticatedUser(ROLE_B.getRoleName());
    // cache permissions
    roleA.getPermissions(rootDataResource);
    roleB.getPermissions(rootDataResource);
    long originalReadsCount = getRolePermissionsReadCount();
    // enure permissions are cached
    assertThat(roleA.getPermissions(rootDataResource)).isEqualTo(dataPermissions);
    assertThat(roleB.getPermissions(rootDataResource)).isEqualTo(dataPermissions);
    assertThat(originalReadsCount).isEqualTo(getRolePermissionsReadCount());
    // invalidate both permissions
    ToolRunner.ToolResult tool = ToolRunner.invokeNodetool("invalidatepermissionscache");
    tool.assertOnCleanExit();
    assertThat(tool.getStdout()).isEmpty();
    // ensure permission for roleA is reloaded
    assertThat(roleA.getPermissions(rootDataResource)).isEqualTo(dataPermissions);
    long readsCountAfterFirstReLoad = getRolePermissionsReadCount();
    assertThat(originalReadsCount).isLessThan(readsCountAfterFirstReLoad);
    // ensure permission for roleB is reloaded
    assertThat(roleB.getPermissions(rootDataResource)).isEqualTo(dataPermissions);
    long readsCountAfterSecondReLoad = getRolePermissionsReadCount();
    assertThat(readsCountAfterFirstReLoad).isLessThan(readsCountAfterSecondReLoad);
}

Example 15 with AuthenticatedUser

use of org.apache.cassandra.auth.AuthenticatedUser in project cassandra by apache.

the class InvalidatePermissionsCacheTest method assertInvalidation.

private void assertInvalidation(IResource resource, List<String> options) {
    Set<Permission> dataPermissions = resource.applicablePermissions();
    AuthenticatedUser role = new AuthenticatedUser(ROLE_A.getRoleName());
    // cache permission
    role.getPermissions(resource);
    long originalReadsCount = getRolePermissionsReadCount();
    // enure permission is cached
    assertThat(role.getPermissions(resource)).isEqualTo(dataPermissions);
    assertThat(originalReadsCount).isEqualTo(getRolePermissionsReadCount());
    // invalidate permission
    List<String> args = new ArrayList<>();
    args.add("invalidatepermissionscache");
    args.add(ROLE_A.getRoleName());
    args.addAll(options);
    ToolRunner.ToolResult tool = ToolRunner.invokeNodetool(args);
    tool.assertOnCleanExit();
    assertThat(tool.getStdout()).isEmpty();
    // ensure permission is reloaded
    assertThat(role.getPermissions(resource)).isEqualTo(dataPermissions);
    assertThat(originalReadsCount).isLessThan(getRolePermissionsReadCount());
}