Examples with AuthorizationRequest org.apache.nifi.authorization.AuthorizationRequest used on opensource projects

Example 11 with AuthorizationRequest

use of org.apache.nifi.authorization.AuthorizationRequest in project nifi by apache.

the class TestRangerNiFiAuthorizer method testApprovedWithNonDirectAccess.

@Test
public void testApprovedWithNonDirectAccess() {
    final String systemResource = "/system";
    final RequestAction action = RequestAction.WRITE;
    final String user = "admin";
    // the incoming NiFi request to test
    final AuthorizationRequest request = new AuthorizationRequest.Builder().resource(new MockResource(systemResource, systemResource)).action(action).identity(user).resourceContext(new HashMap<>()).accessAttempt(false).anonymous(false).build();
    // the expected Ranger resource and request that are created
    final RangerAccessResourceImpl resource = new RangerAccessResourceImpl();
    resource.setValue(RangerNiFiAuthorizer.RANGER_NIFI_RESOURCE_NAME, systemResource);
    final RangerAccessRequestImpl expectedRangerRequest = new RangerAccessRequestImpl();
    expectedRangerRequest.setResource(resource);
    expectedRangerRequest.setAction(request.getAction().name());
    expectedRangerRequest.setAccessType(request.getAction().name());
    expectedRangerRequest.setUser(request.getIdentity());
    // no result processor should be provided used non-direct access
    when(rangerBasePlugin.isAccessAllowed(argThat(new RangerAccessRequestMatcher(expectedRangerRequest)))).thenReturn(allowedResult);
    final AuthorizationResult result = authorizer.authorize(request);
    assertEquals(AuthorizationResult.approved().getResult(), result.getResult());
}

Example 12 with AuthorizationRequest

use of org.apache.nifi.authorization.AuthorizationRequest in project nifi by apache.

the class StandardNiFiServiceFacadeTest method testGetActionApprovedThroughController.

@Test
public void testGetActionApprovedThroughController() throws Exception {
    // set the user
    final Authentication authentication = new NiFiAuthenticationToken(new NiFiUserDetails(new Builder().identity(USER_2).build()));
    SecurityContextHolder.getContext().setAuthentication(authentication);
    // get the action
    final ActionEntity entity = serviceFacade.getAction(ACTION_ID_2);
    // verify
    assertEquals(ACTION_ID_2, entity.getId());
    assertTrue(entity.getCanRead());
    // component does not exists, so only checks against the controller
    verify(authorizer, times(0)).authorize(argThat(new ArgumentMatcher<AuthorizationRequest>() {

        @Override
        public boolean matches(Object o) {
            return ((AuthorizationRequest) o).getResource().getIdentifier().endsWith(PROCESSOR_ID_2);
        }
    }));
    verify(authorizer, times(1)).authorize(argThat(new ArgumentMatcher<AuthorizationRequest>() {

        @Override
        public boolean matches(Object o) {
            return ((AuthorizationRequest) o).getResource().equals(ResourceFactory.getControllerResource());
        }
    }));
}

Example 13 with AuthorizationRequest

use of org.apache.nifi.authorization.AuthorizationRequest in project nifi by apache.

the class StandardNiFiServiceFacadeTest method setUp.

@Before
public void setUp() throws Exception {
    // audit service
    final AuditService auditService = mock(AuditService.class);
    when(auditService.getAction(anyInt())).then(invocation -> {
        final Integer actionId = invocation.getArgumentAt(0, Integer.class);
        FlowChangeAction action = null;
        if (ACTION_ID_1.equals(actionId)) {
            action = getAction(actionId, PROCESSOR_ID_1);
        } else if (ACTION_ID_2.equals(actionId)) {
            action = getAction(actionId, PROCESSOR_ID_2);
        }
        return action;
    });
    when(auditService.getActions(any(HistoryQuery.class))).then(invocation -> {
        final History history = new History();
        history.setActions(Arrays.asList(getAction(ACTION_ID_1, PROCESSOR_ID_1), getAction(ACTION_ID_2, PROCESSOR_ID_2)));
        return history;
    });
    // authorizable lookup
    final AuthorizableLookup authorizableLookup = mock(AuthorizableLookup.class);
    when(authorizableLookup.getProcessor(Mockito.anyString())).then(getProcessorInvocation -> {
        final String processorId = getProcessorInvocation.getArgumentAt(0, String.class);
        // processor-2 is no longer part of the flow
        if (processorId.equals(PROCESSOR_ID_2)) {
            throw new ResourceNotFoundException("");
        }
        // component authorizable
        final ComponentAuthorizable componentAuthorizable = mock(ComponentAuthorizable.class);
        when(componentAuthorizable.getAuthorizable()).then(getAuthorizableInvocation -> {
            // authorizable
            final Authorizable authorizable = new Authorizable() {

                @Override
                public Authorizable getParentAuthorizable() {
                    return null;
                }

                @Override
                public Resource getResource() {
                    return ResourceFactory.getComponentResource(ResourceType.Processor, processorId, processorId);
                }
            };
            return authorizable;
        });
        return componentAuthorizable;
    });
    // authorizer
    authorizer = mock(Authorizer.class);
    when(authorizer.authorize(any(AuthorizationRequest.class))).then(invocation -> {
        final AuthorizationRequest request = invocation.getArgumentAt(0, AuthorizationRequest.class);
        AuthorizationResult result = AuthorizationResult.denied();
        if (request.getResource().getIdentifier().endsWith(PROCESSOR_ID_1)) {
            if (USER_1.equals(request.getIdentity())) {
                result = AuthorizationResult.approved();
            }
        } else if (request.getResource().equals(ResourceFactory.getControllerResource())) {
            if (USER_2.equals(request.getIdentity())) {
                result = AuthorizationResult.approved();
            }
        }
        return result;
    });
    // flow controller
    final FlowController controller = mock(FlowController.class);
    when(controller.getResource()).thenCallRealMethod();
    when(controller.getParentAuthorizable()).thenCallRealMethod();
    // controller facade
    final ControllerFacade controllerFacade = new ControllerFacade();
    controllerFacade.setFlowController(controller);
    serviceFacade = new StandardNiFiServiceFacade();
    serviceFacade.setAuditService(auditService);
    serviceFacade.setAuthorizableLookup(authorizableLookup);
    serviceFacade.setAuthorizer(authorizer);
    serviceFacade.setEntityFactory(new EntityFactory());
    serviceFacade.setDtoFactory(new DtoFactory());
    serviceFacade.setControllerFacade(controllerFacade);
}

Example 14 with AuthorizationRequest

use of org.apache.nifi.authorization.AuthorizationRequest in project nifi by apache.

the class StandardNiFiServiceFacadeTest method testGetActionDeniedDespiteControllerAccess.

@Test(expected = AccessDeniedException.class)
public void testGetActionDeniedDespiteControllerAccess() throws Exception {
    // set the user
    final Authentication authentication = new NiFiAuthenticationToken(new NiFiUserDetails(new Builder().identity(USER_2).build()));
    SecurityContextHolder.getContext().setAuthentication(authentication);
    try {
        // get the action
        serviceFacade.getAction(ACTION_ID_1);
        fail();
    } finally {
        // resource exists, but should trigger access denied and will not check the controller
        verify(authorizer, times(1)).authorize(argThat(new ArgumentMatcher<AuthorizationRequest>() {

            @Override
            public boolean matches(Object o) {
                return ((AuthorizationRequest) o).getResource().getIdentifier().endsWith(PROCESSOR_ID_1);
            }
        }));
        verify(authorizer, times(0)).authorize(argThat(new ArgumentMatcher<AuthorizationRequest>() {

            @Override
            public boolean matches(Object o) {
                return ((AuthorizationRequest) o).getResource().equals(ResourceFactory.getControllerResource());
            }
        }));
    }
}

Example 15 with AuthorizationRequest

use of org.apache.nifi.authorization.AuthorizationRequest in project nifi by apache.

the class StandardNiFiServiceFacadeTest method testGetActionApprovedThroughAction.

@Test
public void testGetActionApprovedThroughAction() throws Exception {
    // set the user
    final Authentication authentication = new NiFiAuthenticationToken(new NiFiUserDetails(new Builder().identity(USER_1).build()));
    SecurityContextHolder.getContext().setAuthentication(authentication);
    // get the action
    final ActionEntity entity = serviceFacade.getAction(ACTION_ID_1);
    // verify
    assertEquals(ACTION_ID_1, entity.getId());
    assertTrue(entity.getCanRead());
    // resource exists and is approved, no need to check the controller
    verify(authorizer, times(1)).authorize(argThat(new ArgumentMatcher<AuthorizationRequest>() {

        @Override
        public boolean matches(Object o) {
            return ((AuthorizationRequest) o).getResource().getIdentifier().endsWith(PROCESSOR_ID_1);
        }
    }));
    verify(authorizer, times(0)).authorize(argThat(new ArgumentMatcher<AuthorizationRequest>() {

        @Override
        public boolean matches(Object o) {
            return ((AuthorizationRequest) o).getResource().equals(ResourceFactory.getControllerResource());
        }
    }));
}