Examples with AuthorizationResult org.apache.nifi.authorization.AuthorizationResult used on opensource projects

Example 21 with AuthorizationResult

use of org.apache.nifi.authorization.AuthorizationResult in project nifi by apache.

the class UserEventAuthorizer method isAuthorized.

@Override
public boolean isAuthorized(final ProvenanceEventRecord event) {
    if (authorizer == null || user == null) {
        return true;
    }
    final Authorizable eventAuthorizable;
    try {
        if (event.isRemotePortType()) {
            eventAuthorizable = resourceFactory.createRemoteDataAuthorizable(event.getComponentId());
        } else {
            eventAuthorizable = resourceFactory.createLocalDataAuthorizable(event.getComponentId());
        }
    } catch (final ResourceNotFoundException rnfe) {
        return false;
    }
    final AuthorizationResult result = eventAuthorizable.checkAuthorization(authorizer, RequestAction.READ, user, event.getAttributes());
    return Result.Approved.equals(result.getResult());
}

Example 22 with AuthorizationResult

use of org.apache.nifi.authorization.AuthorizationResult in project nifi by apache.

the class TestRangerNiFiAuthorizer method testResourceNotFound.

@Test
public void testResourceNotFound() {
    final String systemResource = "/system";
    final RequestAction action = RequestAction.WRITE;
    final String user = "admin";
    // the incoming NiFi request to test
    final AuthorizationRequest request = new AuthorizationRequest.Builder().resource(new MockResource(systemResource, systemResource)).action(action).identity(user).resourceContext(new HashMap<>()).accessAttempt(true).anonymous(false).build();
    // the expected Ranger resource and request that are created
    final RangerAccessResourceImpl resource = new RangerAccessResourceImpl();
    resource.setValue(RangerNiFiAuthorizer.RANGER_NIFI_RESOURCE_NAME, systemResource);
    final RangerAccessRequestImpl expectedRangerRequest = new RangerAccessRequestImpl();
    expectedRangerRequest.setResource(resource);
    expectedRangerRequest.setAction(request.getAction().name());
    expectedRangerRequest.setAccessType(request.getAction().name());
    expectedRangerRequest.setUser(request.getIdentity());
    // no result processor should be provided used non-direct access
    when(rangerBasePlugin.isAccessAllowed(argThat(new RangerAccessRequestMatcher(expectedRangerRequest)), notNull(RangerAccessResultProcessor.class))).thenReturn(notAllowedResult);
    // return false when checking if a policy exists for the resource
    when(rangerBasePlugin.doesPolicyExist(systemResource, action)).thenReturn(false);
    final AuthorizationResult result = authorizer.authorize(request);
    assertEquals(AuthorizationResult.resourceNotFound().getResult(), result.getResult());
}

Example 23 with AuthorizationResult

use of org.apache.nifi.authorization.AuthorizationResult in project nifi by apache.

the class TestRangerNiFiAuthorizer method testApprovedWithDirectAccess.

@Test
public void testApprovedWithDirectAccess() {
    final String systemResource = "/system";
    final RequestAction action = RequestAction.WRITE;
    final String user = "admin";
    final String clientIp = "192.168.1.1";
    final Map<String, String> userContext = new HashMap<>();
    userContext.put(UserContextKeys.CLIENT_ADDRESS.name(), clientIp);
    // the incoming NiFi request to test
    final AuthorizationRequest request = new AuthorizationRequest.Builder().resource(new MockResource(systemResource, systemResource)).action(action).identity(user).resourceContext(new HashMap<>()).userContext(userContext).accessAttempt(true).anonymous(false).build();
    // the expected Ranger resource and request that are created
    final RangerAccessResourceImpl resource = new RangerAccessResourceImpl();
    resource.setValue(RangerNiFiAuthorizer.RANGER_NIFI_RESOURCE_NAME, systemResource);
    final RangerAccessRequestImpl expectedRangerRequest = new RangerAccessRequestImpl();
    expectedRangerRequest.setResource(resource);
    expectedRangerRequest.setAction(request.getAction().name());
    expectedRangerRequest.setAccessType(request.getAction().name());
    expectedRangerRequest.setUser(request.getIdentity());
    expectedRangerRequest.setClientIPAddress(clientIp);
    // a non-null result processor should be used for direct access
    when(rangerBasePlugin.isAccessAllowed(argThat(new RangerAccessRequestMatcher(expectedRangerRequest)))).thenReturn(allowedResult);
    final AuthorizationResult result = authorizer.authorize(request);
    assertEquals(AuthorizationResult.approved().getResult(), result.getResult());
}

Example 24 with AuthorizationResult

use of org.apache.nifi.authorization.AuthorizationResult in project nifi by apache.

the class TestRangerNiFiAuthorizer method testApprovedWithNonDirectAccess.

@Test
public void testApprovedWithNonDirectAccess() {
    final String systemResource = "/system";
    final RequestAction action = RequestAction.WRITE;
    final String user = "admin";
    // the incoming NiFi request to test
    final AuthorizationRequest request = new AuthorizationRequest.Builder().resource(new MockResource(systemResource, systemResource)).action(action).identity(user).resourceContext(new HashMap<>()).accessAttempt(false).anonymous(false).build();
    // the expected Ranger resource and request that are created
    final RangerAccessResourceImpl resource = new RangerAccessResourceImpl();
    resource.setValue(RangerNiFiAuthorizer.RANGER_NIFI_RESOURCE_NAME, systemResource);
    final RangerAccessRequestImpl expectedRangerRequest = new RangerAccessRequestImpl();
    expectedRangerRequest.setResource(resource);
    expectedRangerRequest.setAction(request.getAction().name());
    expectedRangerRequest.setAccessType(request.getAction().name());
    expectedRangerRequest.setUser(request.getIdentity());
    // no result processor should be provided used non-direct access
    when(rangerBasePlugin.isAccessAllowed(argThat(new RangerAccessRequestMatcher(expectedRangerRequest)))).thenReturn(allowedResult);
    final AuthorizationResult result = authorizer.authorize(request);
    assertEquals(AuthorizationResult.approved().getResult(), result.getResult());
}

Example 25 with AuthorizationResult

use of org.apache.nifi.authorization.AuthorizationResult in project nifi by apache.

the class StandardNiFiServiceFacadeTest method setUp.

@Before
public void setUp() throws Exception {
    // audit service
    final AuditService auditService = mock(AuditService.class);
    when(auditService.getAction(anyInt())).then(invocation -> {
        final Integer actionId = invocation.getArgumentAt(0, Integer.class);
        FlowChangeAction action = null;
        if (ACTION_ID_1.equals(actionId)) {
            action = getAction(actionId, PROCESSOR_ID_1);
        } else if (ACTION_ID_2.equals(actionId)) {
            action = getAction(actionId, PROCESSOR_ID_2);
        }
        return action;
    });
    when(auditService.getActions(any(HistoryQuery.class))).then(invocation -> {
        final History history = new History();
        history.setActions(Arrays.asList(getAction(ACTION_ID_1, PROCESSOR_ID_1), getAction(ACTION_ID_2, PROCESSOR_ID_2)));
        return history;
    });
    // authorizable lookup
    final AuthorizableLookup authorizableLookup = mock(AuthorizableLookup.class);
    when(authorizableLookup.getProcessor(Mockito.anyString())).then(getProcessorInvocation -> {
        final String processorId = getProcessorInvocation.getArgumentAt(0, String.class);
        // processor-2 is no longer part of the flow
        if (processorId.equals(PROCESSOR_ID_2)) {
            throw new ResourceNotFoundException("");
        }
        // component authorizable
        final ComponentAuthorizable componentAuthorizable = mock(ComponentAuthorizable.class);
        when(componentAuthorizable.getAuthorizable()).then(getAuthorizableInvocation -> {
            // authorizable
            final Authorizable authorizable = new Authorizable() {

                @Override
                public Authorizable getParentAuthorizable() {
                    return null;
                }

                @Override
                public Resource getResource() {
                    return ResourceFactory.getComponentResource(ResourceType.Processor, processorId, processorId);
                }
            };
            return authorizable;
        });
        return componentAuthorizable;
    });
    // authorizer
    authorizer = mock(Authorizer.class);
    when(authorizer.authorize(any(AuthorizationRequest.class))).then(invocation -> {
        final AuthorizationRequest request = invocation.getArgumentAt(0, AuthorizationRequest.class);
        AuthorizationResult result = AuthorizationResult.denied();
        if (request.getResource().getIdentifier().endsWith(PROCESSOR_ID_1)) {
            if (USER_1.equals(request.getIdentity())) {
                result = AuthorizationResult.approved();
            }
        } else if (request.getResource().equals(ResourceFactory.getControllerResource())) {
            if (USER_2.equals(request.getIdentity())) {
                result = AuthorizationResult.approved();
            }
        }
        return result;
    });
    // flow controller
    final FlowController controller = mock(FlowController.class);
    when(controller.getResource()).thenCallRealMethod();
    when(controller.getParentAuthorizable()).thenCallRealMethod();
    // controller facade
    final ControllerFacade controllerFacade = new ControllerFacade();
    controllerFacade.setFlowController(controller);
    serviceFacade = new StandardNiFiServiceFacade();
    serviceFacade.setAuditService(auditService);
    serviceFacade.setAuthorizableLookup(authorizableLookup);
    serviceFacade.setAuthorizer(authorizer);
    serviceFacade.setEntityFactory(new EntityFactory());
    serviceFacade.setDtoFactory(new DtoFactory());
    serviceFacade.setControllerFacade(controllerFacade);
}