Examples with AuthorizerCreationException org.apache.nifi.authorization.exception.AuthorizerCreationException used on opensource projects

Example 16 with AuthorizerCreationException

use of org.apache.nifi.authorization.exception.AuthorizerCreationException in project nifi by apache.

the class AuthorizerFactory method installIntegrityChecks.

public static Authorizer installIntegrityChecks(final Authorizer baseAuthorizer) {
    Authorizer authorizer;
    if (baseAuthorizer instanceof ManagedAuthorizer) {
        final ManagedAuthorizer baseManagedAuthorizer = (ManagedAuthorizer) baseAuthorizer;
        authorizer = new ManagedAuthorizer() {

            @Override
            public String getFingerprint() throws AuthorizationAccessException {
                return baseManagedAuthorizer.getFingerprint();
            }

            @Override
            public void inheritFingerprint(String fingerprint) throws AuthorizationAccessException {
                baseManagedAuthorizer.inheritFingerprint(fingerprint);
            }

            @Override
            public void checkInheritability(String proposedFingerprint) throws AuthorizationAccessException, UninheritableAuthorizationsException {
                baseManagedAuthorizer.checkInheritability(proposedFingerprint);
            }

            @Override
            public AccessPolicyProvider getAccessPolicyProvider() {
                final AccessPolicyProvider baseAccessPolicyProvider = baseManagedAuthorizer.getAccessPolicyProvider();
                if (baseAccessPolicyProvider instanceof ConfigurableAccessPolicyProvider) {
                    final ConfigurableAccessPolicyProvider baseConfigurableAccessPolicyProvider = (ConfigurableAccessPolicyProvider) baseAccessPolicyProvider;
                    return new ConfigurableAccessPolicyProvider() {

                        @Override
                        public String getFingerprint() throws AuthorizationAccessException {
                            return baseConfigurableAccessPolicyProvider.getFingerprint();
                        }

                        @Override
                        public void inheritFingerprint(String fingerprint) throws AuthorizationAccessException {
                            baseConfigurableAccessPolicyProvider.inheritFingerprint(fingerprint);
                        }

                        @Override
                        public void checkInheritability(String proposedFingerprint) throws AuthorizationAccessException, UninheritableAuthorizationsException {
                            baseConfigurableAccessPolicyProvider.checkInheritability(proposedFingerprint);
                        }

                        @Override
                        public AccessPolicy addAccessPolicy(AccessPolicy accessPolicy) throws AuthorizationAccessException {
                            if (policyExists(baseConfigurableAccessPolicyProvider, accessPolicy)) {
                                throw new IllegalStateException(String.format("Found multiple policies for '%s' with '%s'.", accessPolicy.getResource(), accessPolicy.getAction()));
                            }
                            return baseConfigurableAccessPolicyProvider.addAccessPolicy(accessPolicy);
                        }

                        @Override
                        public boolean isConfigurable(AccessPolicy accessPolicy) {
                            return baseConfigurableAccessPolicyProvider.isConfigurable(accessPolicy);
                        }

                        @Override
                        public AccessPolicy updateAccessPolicy(AccessPolicy accessPolicy) throws AuthorizationAccessException {
                            if (!baseConfigurableAccessPolicyProvider.isConfigurable(accessPolicy)) {
                                throw new IllegalArgumentException("The specified access policy is not support modification.");
                            }
                            return baseConfigurableAccessPolicyProvider.updateAccessPolicy(accessPolicy);
                        }

                        @Override
                        public AccessPolicy deleteAccessPolicy(AccessPolicy accessPolicy) throws AuthorizationAccessException {
                            if (!baseConfigurableAccessPolicyProvider.isConfigurable(accessPolicy)) {
                                throw new IllegalArgumentException("The specified access policy is not support modification.");
                            }
                            return baseConfigurableAccessPolicyProvider.deleteAccessPolicy(accessPolicy);
                        }

                        @Override
                        public Set<AccessPolicy> getAccessPolicies() throws AuthorizationAccessException {
                            return baseConfigurableAccessPolicyProvider.getAccessPolicies();
                        }

                        @Override
                        public AccessPolicy getAccessPolicy(String identifier) throws AuthorizationAccessException {
                            return baseConfigurableAccessPolicyProvider.getAccessPolicy(identifier);
                        }

                        @Override
                        public AccessPolicy getAccessPolicy(String resourceIdentifier, RequestAction action) throws AuthorizationAccessException {
                            return baseConfigurableAccessPolicyProvider.getAccessPolicy(resourceIdentifier, action);
                        }

                        @Override
                        public UserGroupProvider getUserGroupProvider() {
                            final UserGroupProvider baseUserGroupProvider = baseConfigurableAccessPolicyProvider.getUserGroupProvider();
                            if (baseUserGroupProvider instanceof ConfigurableUserGroupProvider) {
                                final ConfigurableUserGroupProvider baseConfigurableUserGroupProvider = (ConfigurableUserGroupProvider) baseUserGroupProvider;
                                return new ConfigurableUserGroupProvider() {

                                    @Override
                                    public String getFingerprint() throws AuthorizationAccessException {
                                        return baseConfigurableUserGroupProvider.getFingerprint();
                                    }

                                    @Override
                                    public void inheritFingerprint(String fingerprint) throws AuthorizationAccessException {
                                        baseConfigurableUserGroupProvider.inheritFingerprint(fingerprint);
                                    }

                                    @Override
                                    public void checkInheritability(String proposedFingerprint) throws AuthorizationAccessException, UninheritableAuthorizationsException {
                                        baseConfigurableUserGroupProvider.checkInheritability(proposedFingerprint);
                                    }

                                    @Override
                                    public User addUser(User user) throws AuthorizationAccessException {
                                        if (tenantExists(baseConfigurableUserGroupProvider, user.getIdentifier(), user.getIdentity())) {
                                            throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", user.getIdentity()));
                                        }
                                        return baseConfigurableUserGroupProvider.addUser(user);
                                    }

                                    @Override
                                    public boolean isConfigurable(User user) {
                                        return baseConfigurableUserGroupProvider.isConfigurable(user);
                                    }

                                    @Override
                                    public User updateUser(User user) throws AuthorizationAccessException {
                                        if (tenantExists(baseConfigurableUserGroupProvider, user.getIdentifier(), user.getIdentity())) {
                                            throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", user.getIdentity()));
                                        }
                                        if (!baseConfigurableUserGroupProvider.isConfigurable(user)) {
                                            throw new IllegalArgumentException("The specified user does not support modification.");
                                        }
                                        return baseConfigurableUserGroupProvider.updateUser(user);
                                    }

                                    @Override
                                    public User deleteUser(User user) throws AuthorizationAccessException {
                                        if (!baseConfigurableUserGroupProvider.isConfigurable(user)) {
                                            throw new IllegalArgumentException("The specified user does not support modification.");
                                        }
                                        return baseConfigurableUserGroupProvider.deleteUser(user);
                                    }

                                    @Override
                                    public Group addGroup(Group group) throws AuthorizationAccessException {
                                        if (tenantExists(baseConfigurableUserGroupProvider, group.getIdentifier(), group.getName())) {
                                            throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", group.getName()));
                                        }
                                        if (!allGroupUsersExist(baseConfigurableUserGroupProvider, group)) {
                                            throw new IllegalStateException(String.format("Cannot create group '%s' with users that don't exist.", group.getName()));
                                        }
                                        return baseConfigurableUserGroupProvider.addGroup(group);
                                    }

                                    @Override
                                    public boolean isConfigurable(Group group) {
                                        return baseConfigurableUserGroupProvider.isConfigurable(group);
                                    }

                                    @Override
                                    public Group updateGroup(Group group) throws AuthorizationAccessException {
                                        if (tenantExists(baseConfigurableUserGroupProvider, group.getIdentifier(), group.getName())) {
                                            throw new IllegalStateException(String.format("User/user group already exists with the identity '%s'.", group.getName()));
                                        }
                                        if (!allGroupUsersExist(baseConfigurableUserGroupProvider, group)) {
                                            throw new IllegalStateException(String.format("Cannot update group '%s' to add users that don't exist.", group.getName()));
                                        }
                                        if (!baseConfigurableUserGroupProvider.isConfigurable(group)) {
                                            throw new IllegalArgumentException("The specified group does not support modification.");
                                        }
                                        return baseConfigurableUserGroupProvider.updateGroup(group);
                                    }

                                    @Override
                                    public Group deleteGroup(Group group) throws AuthorizationAccessException {
                                        if (!baseConfigurableUserGroupProvider.isConfigurable(group)) {
                                            throw new IllegalArgumentException("The specified group does not support modification.");
                                        }
                                        return baseConfigurableUserGroupProvider.deleteGroup(group);
                                    }

                                    @Override
                                    public Set<User> getUsers() throws AuthorizationAccessException {
                                        return baseConfigurableUserGroupProvider.getUsers();
                                    }

                                    @Override
                                    public User getUser(String identifier) throws AuthorizationAccessException {
                                        return baseConfigurableUserGroupProvider.getUser(identifier);
                                    }

                                    @Override
                                    public User getUserByIdentity(String identity) throws AuthorizationAccessException {
                                        return baseConfigurableUserGroupProvider.getUserByIdentity(identity);
                                    }

                                    @Override
                                    public Set<Group> getGroups() throws AuthorizationAccessException {
                                        return baseConfigurableUserGroupProvider.getGroups();
                                    }

                                    @Override
                                    public Group getGroup(String identifier) throws AuthorizationAccessException {
                                        return baseConfigurableUserGroupProvider.getGroup(identifier);
                                    }

                                    @Override
                                    public UserAndGroups getUserAndGroups(String identity) throws AuthorizationAccessException {
                                        return baseConfigurableUserGroupProvider.getUserAndGroups(identity);
                                    }

                                    @Override
                                    public void initialize(UserGroupProviderInitializationContext initializationContext) throws AuthorizerCreationException {
                                        baseConfigurableUserGroupProvider.initialize(initializationContext);
                                    }

                                    @Override
                                    public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException {
                                        baseConfigurableUserGroupProvider.onConfigured(configurationContext);
                                    }

                                    @Override
                                    public void preDestruction() throws AuthorizerDestructionException {
                                        baseConfigurableUserGroupProvider.preDestruction();
                                    }
                                };
                            } else {
                                return baseUserGroupProvider;
                            }
                        }

                        @Override
                        public void initialize(AccessPolicyProviderInitializationContext initializationContext) throws AuthorizerCreationException {
                            baseConfigurableAccessPolicyProvider.initialize(initializationContext);
                        }

                        @Override
                        public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException {
                            baseConfigurableAccessPolicyProvider.onConfigured(configurationContext);
                        }

                        @Override
                        public void preDestruction() throws AuthorizerDestructionException {
                            baseConfigurableAccessPolicyProvider.preDestruction();
                        }
                    };
                } else {
                    return baseAccessPolicyProvider;
                }
            }

            @Override
            public AuthorizationResult authorize(AuthorizationRequest request) throws AuthorizationAccessException {
                final AuthorizationResult result = baseAuthorizer.authorize(request);
                // audit the authorization request
                audit(baseAuthorizer, request, result);
                return result;
            }

            @Override
            public void initialize(AuthorizerInitializationContext initializationContext) throws AuthorizerCreationException {
                baseManagedAuthorizer.initialize(initializationContext);
            }

            @Override
            public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException {
                baseManagedAuthorizer.onConfigured(configurationContext);
                final AccessPolicyProvider accessPolicyProvider = baseManagedAuthorizer.getAccessPolicyProvider();
                final UserGroupProvider userGroupProvider = accessPolicyProvider.getUserGroupProvider();
                // ensure that only one policy per resource-action exists
                for (AccessPolicy accessPolicy : accessPolicyProvider.getAccessPolicies()) {
                    if (policyExists(accessPolicyProvider, accessPolicy)) {
                        throw new AuthorizerCreationException(String.format("Found multiple policies for '%s' with '%s'.", accessPolicy.getResource(), accessPolicy.getAction()));
                    }
                }
                // ensure that only one group exists per identity
                for (User user : userGroupProvider.getUsers()) {
                    if (tenantExists(userGroupProvider, user.getIdentifier(), user.getIdentity())) {
                        throw new AuthorizerCreationException(String.format("Found multiple users/user groups with identity '%s'.", user.getIdentity()));
                    }
                }
                // ensure that only one group exists per identity
                for (Group group : userGroupProvider.getGroups()) {
                    if (tenantExists(userGroupProvider, group.getIdentifier(), group.getName())) {
                        throw new AuthorizerCreationException(String.format("Found multiple users/user groups with name '%s'.", group.getName()));
                    }
                }
            }

            @Override
            public void preDestruction() throws AuthorizerDestructionException {
                baseManagedAuthorizer.preDestruction();
            }
        };
    } else {
        authorizer = new Authorizer() {

            @Override
            public AuthorizationResult authorize(AuthorizationRequest request) throws AuthorizationAccessException {
                final AuthorizationResult result = baseAuthorizer.authorize(request);
                // audit the authorization request
                audit(baseAuthorizer, request, result);
                return result;
            }

            @Override
            public void initialize(AuthorizerInitializationContext initializationContext) throws AuthorizerCreationException {
                baseAuthorizer.initialize(initializationContext);
            }

            @Override
            public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException {
                baseAuthorizer.onConfigured(configurationContext);
            }

            @Override
            public void preDestruction() throws AuthorizerDestructionException {
                baseAuthorizer.preDestruction();
            }
        };
    }
    // conditionally add support for the audit methods
    if (baseAuthorizer instanceof AuthorizationAuditor) {
        final AuthorizationAuditorInvocationHandler invocationHandler = new AuthorizationAuditorInvocationHandler(authorizer, (AuthorizationAuditor) baseAuthorizer);
        final List<Class<?>> interfaceList = ClassUtils.getAllInterfaces(authorizer.getClass());
        interfaceList.add(AuthorizationAuditor.class);
        final Class<?>[] interfaces = interfaceList.toArray(new Class<?>[interfaceList.size()]);
        authorizer = (Authorizer) Proxy.newProxyInstance(authorizer.getClass().getClassLoader(), interfaces, invocationHandler);
    }
    return authorizer;
}

Example 17 with AuthorizerCreationException

use of org.apache.nifi.authorization.exception.AuthorizerCreationException in project nifi by apache.

the class TestRangerNiFiAuthorizer method testKerberosEnabledWithoutPrincipal.

@Test
public void testKerberosEnabledWithoutPrincipal() {
    when(configurationContext.getProperty(eq(RangerNiFiAuthorizer.RANGER_KERBEROS_ENABLED_PROP))).thenReturn(new MockPropertyValue("true"));
    nifiProperties = Mockito.mock(NiFiProperties.class);
    when(nifiProperties.getKerberosServiceKeytabLocation()).thenReturn("");
    authorizer = new MockRangerNiFiAuthorizer(rangerBasePlugin);
    authorizer.setNiFiProperties(nifiProperties);
    try {
        authorizer.onConfigured(configurationContext);
        Assert.fail("Should have thrown exception");
    } catch (AuthorizerCreationException e) {
        // want to make sure this exception is from our authorizer code
        verifyOnlyAuthorizeCreationExceptions(e);
    }
}

Example 18 with AuthorizerCreationException

use of org.apache.nifi.authorization.exception.AuthorizerCreationException in project nifi by apache.

the class TestRangerNiFiAuthorizer method testKerberosEnabled.

@Test
public void testKerberosEnabled() {
    when(configurationContext.getProperty(eq(RangerNiFiAuthorizer.RANGER_KERBEROS_ENABLED_PROP))).thenReturn(new MockPropertyValue("true"));
    nifiProperties = Mockito.mock(NiFiProperties.class);
    when(nifiProperties.getKerberosServiceKeytabLocation()).thenReturn("test");
    when(nifiProperties.getKerberosServicePrincipal()).thenReturn("test");
    authorizer = new MockRangerNiFiAuthorizer(rangerBasePlugin);
    authorizer.setNiFiProperties(nifiProperties);
    try {
        authorizer.onConfigured(configurationContext);
        Assert.fail("Should have thrown exception");
    } catch (AuthorizerCreationException e) {
        // getting a LoginException here means we attempted to login which is what we want
        boolean foundLoginException = false;
        Throwable cause = e.getCause();
        while (cause != null) {
            if (cause instanceof LoginException) {
                foundLoginException = true;
                break;
            }
            cause = cause.getCause();
        }
        assertTrue(foundLoginException);
    }
}

Example 19 with AuthorizerCreationException

use of org.apache.nifi.authorization.exception.AuthorizerCreationException in project nifi by apache.

the class LdapUserGroupProvider method getConfiguredSslContext.

private SSLContext getConfiguredSslContext(final AuthorizerConfigurationContext configurationContext) {
    final String rawKeystore = configurationContext.getProperty("TLS - Keystore").getValue();
    final String rawKeystorePassword = configurationContext.getProperty("TLS - Keystore Password").getValue();
    final String rawKeystoreType = configurationContext.getProperty("TLS - Keystore Type").getValue();
    final String rawTruststore = configurationContext.getProperty("TLS - Truststore").getValue();
    final String rawTruststorePassword = configurationContext.getProperty("TLS - Truststore Password").getValue();
    final String rawTruststoreType = configurationContext.getProperty("TLS - Truststore Type").getValue();
    final String rawClientAuth = configurationContext.getProperty("TLS - Client Auth").getValue();
    final String rawProtocol = configurationContext.getProperty("TLS - Protocol").getValue();
    // create the ssl context
    final SSLContext sslContext;
    try {
        if (StringUtils.isBlank(rawKeystore) && StringUtils.isBlank(rawTruststore)) {
            sslContext = null;
        } else {
            // ensure the protocol is specified
            if (StringUtils.isBlank(rawProtocol)) {
                throw new AuthorizerCreationException("TLS - Protocol must be specified.");
            }
            if (StringUtils.isBlank(rawKeystore)) {
                sslContext = SslContextFactory.createTrustSslContext(rawTruststore, rawTruststorePassword.toCharArray(), rawTruststoreType, rawProtocol);
            } else if (StringUtils.isBlank(rawTruststore)) {
                sslContext = SslContextFactory.createSslContext(rawKeystore, rawKeystorePassword.toCharArray(), rawKeystoreType, rawProtocol);
            } else {
                // determine the client auth if specified
                final ClientAuth clientAuth;
                if (StringUtils.isBlank(rawClientAuth)) {
                    clientAuth = ClientAuth.NONE;
                } else {
                    try {
                        clientAuth = ClientAuth.valueOf(rawClientAuth);
                    } catch (final IllegalArgumentException iae) {
                        throw new AuthorizerCreationException(String.format("Unrecognized client auth '%s'. Possible values are [%s]", rawClientAuth, StringUtils.join(ClientAuth.values(), ", ")));
                    }
                }
                sslContext = SslContextFactory.createSslContext(rawKeystore, rawKeystorePassword.toCharArray(), rawKeystoreType, rawTruststore, rawTruststorePassword.toCharArray(), rawTruststoreType, clientAuth, rawProtocol);
            }
        }
    } catch (final KeyStoreException | NoSuchAlgorithmException | CertificateException | UnrecoverableKeyException | KeyManagementException | IOException e) {
        throw new AuthorizerCreationException(e.getMessage(), e);
    }
    return sslContext;
}

Example 20 with AuthorizerCreationException

use of org.apache.nifi.authorization.exception.AuthorizerCreationException in project nifi-minifi by apache.

the class MiNiFiServer method start.

public void start() {
    try {
        logger.info("Loading Flow...");
        FlowFileEventRepository flowFileEventRepository = new RingBufferEventRepository(5);
        AuditService auditService = new StandardAuditService();
        Authorizer authorizer = new Authorizer() {

            @Override
            public AuthorizationResult authorize(AuthorizationRequest request) throws AuthorizationAccessException {
                return AuthorizationResult.approved();
            }

            @Override
            public void initialize(AuthorizerInitializationContext initializationContext) throws AuthorizerCreationException {
            // do nothing
            }

            @Override
            public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException {
            // do nothing
            }

            @Override
            public void preDestruction() throws AuthorizerDestructionException {
            // do nothing
            }
        };
        final String sensitivePropAlgorithmVal = props.getProperty(StringEncryptor.NF_SENSITIVE_PROPS_ALGORITHM);
        final String sensitivePropProviderVal = props.getProperty(StringEncryptor.NF_SENSITIVE_PROPS_PROVIDER);
        final String sensitivePropValueNifiPropVar = props.getProperty(StringEncryptor.NF_SENSITIVE_PROPS_KEY, DEFAULT_SENSITIVE_PROPS_KEY);
        StringEncryptor encryptor = StringEncryptor.createEncryptor(sensitivePropAlgorithmVal, sensitivePropProviderVal, sensitivePropValueNifiPropVar);
        VariableRegistry variableRegistry = new FileBasedVariableRegistry(props.getVariableRegistryPropertiesPaths());
        BulletinRepository bulletinRepository = new VolatileBulletinRepository();
        FlowController flowController = FlowController.createStandaloneInstance(flowFileEventRepository, props, authorizer, auditService, encryptor, bulletinRepository, variableRegistry, new StandardFlowRegistryClient());
        flowService = StandardFlowService.createStandaloneInstance(flowController, props, encryptor, // revision manager
        null, authorizer);
        // start and load the flow
        flowService.start();
        flowService.load(null);
        flowController.onFlowInitialized(true);
        flowController.getGroup(flowController.getRootGroupId()).startProcessing();
        this.flowController = flowController;
        logger.info("Flow loaded successfully.");
    } catch (Exception e) {
        // ensure the flow service is terminated
        if (flowService != null && flowService.isRunning()) {
            flowService.stop(false);
        }
        startUpFailure(new Exception("Unable to load flow due to: " + e, e));
    }
}