Examples with Authorizable org.apache.nifi.authorization.resource.Authorizable used on opensource projects

Example 76 with Authorizable

use of org.apache.nifi.authorization.resource.Authorizable in project nifi by apache.

the class StandardNiFiServiceFacade method createAffectedComponentEntity.

private AffectedComponentEntity createAffectedComponentEntity(final Connectable connectable, final NiFiUser user) {
    final AffectedComponentEntity entity = new AffectedComponentEntity();
    entity.setRevision(dtoFactory.createRevisionDTO(revisionManager.getRevision(connectable.getIdentifier())));
    entity.setId(connectable.getIdentifier());
    final Authorizable authorizable = getAuthorizable(connectable);
    final PermissionsDTO permissionsDto = dtoFactory.createPermissionsDto(authorizable, user);
    entity.setPermissions(permissionsDto);
    final AffectedComponentDTO dto = new AffectedComponentDTO();
    dto.setId(connectable.getIdentifier());
    dto.setReferenceType(connectable.getConnectableType().name());
    dto.setState(connectable.getScheduledState().name());
    final String groupId = connectable instanceof RemoteGroupPort ? ((RemoteGroupPort) connectable).getRemoteProcessGroup().getIdentifier() : connectable.getProcessGroupIdentifier();
    dto.setProcessGroupId(groupId);
    entity.setComponent(dto);
    return entity;
}

Example 77 with Authorizable

use of org.apache.nifi.authorization.resource.Authorizable in project nifi by apache.

the class StandardRootGroupPort method checkUserAuthorization.

@Override
public PortAuthorizationResult checkUserAuthorization(NiFiUser user) {
    if (!secure) {
        return new StandardPortAuthorizationResult(true, "Site-to-Site is not Secure");
    }
    if (user == null) {
        final String message = String.format("%s authorization failed because the user is unknown", this, user);
        logger.warn(message);
        eventReporter.reportEvent(Severity.WARNING, CATEGORY, message);
        return new StandardPortAuthorizationResult(false, "User is not known");
    }
    // perform the authorization
    final Authorizable dataTransferAuthorizable = new DataTransferAuthorizable(this);
    final AuthorizationResult result = dataTransferAuthorizable.checkAuthorization(authorizer, RequestAction.WRITE, user);
    if (!Result.Approved.equals(result.getResult())) {
        final String message = String.format("%s authorization failed for user %s because %s", this, user.getIdentity(), result.getExplanation());
        logger.warn(message);
        eventReporter.reportEvent(Severity.WARNING, CATEGORY, message);
        return new StandardPortAuthorizationResult(false, message);
    }
    return new StandardPortAuthorizationResult(true, "User is Authorized");
}

Example 78 with Authorizable

use of org.apache.nifi.authorization.resource.Authorizable in project nifi by apache.

the class AuthorizeControllerServiceReference method authorizeControllerServiceReferences.

/**
 * Authorizes the proposed properties for the specified authorizable.
 *
 * @param proposedProperties proposed properties
 * @param authorizable authorizable that may reference a controller service
 * @param authorizer authorizer
 * @param lookup lookup
 */
public static void authorizeControllerServiceReferences(final Map<String, String> proposedProperties, final ComponentAuthorizable authorizable, final Authorizer authorizer, final AuthorizableLookup lookup) {
    // only attempt to authorize if properties are changing
    if (proposedProperties != null) {
        final NiFiUser user = NiFiUserUtils.getNiFiUser();
        for (final Map.Entry<String, String> entry : proposedProperties.entrySet()) {
            final String propertyName = entry.getKey();
            final PropertyDescriptor propertyDescriptor = authorizable.getPropertyDescriptor(propertyName);
            // if this descriptor identifies a controller service
            if (propertyDescriptor.getControllerServiceDefinition() != null) {
                final String currentValue = authorizable.getValue(propertyDescriptor);
                final String proposedValue = entry.getValue();
                // if the value is changing
                if (!Objects.equals(currentValue, proposedValue)) {
                    // ensure access to the old service
                    if (currentValue != null) {
                        try {
                            final Authorizable currentServiceAuthorizable = lookup.getControllerService(currentValue).getAuthorizable();
                            currentServiceAuthorizable.authorize(authorizer, RequestAction.READ, user);
                        } catch (ResourceNotFoundException e) {
                        // ignore if the resource is not found, if currentValue was previously deleted, it should not stop assignment of proposedValue
                        }
                    }
                    // ensure access to the new service
                    if (proposedValue != null) {
                        final Authorizable newServiceAuthorizable = lookup.getControllerService(proposedValue).getAuthorizable();
                        newServiceAuthorizable.authorize(authorizer, RequestAction.READ, user);
                    }
                }
            }
        }
    }
}

Example 79 with Authorizable

use of org.apache.nifi.authorization.resource.Authorizable in project nifi by apache.

the class StandardAuthorizableLookup method getSnippet.

@Override
public SnippetAuthorizable getSnippet(final String id) {
    final Snippet snippet = snippetDAO.getSnippet(id);
    final ProcessGroup processGroup = processGroupDAO.getProcessGroup(snippet.getParentGroupId());
    return new SnippetAuthorizable() {

        @Override
        public Authorizable getParentProcessGroup() {
            return processGroup;
        }

        @Override
        public Set<ComponentAuthorizable> getSelectedProcessors() {
            return processGroup.getProcessors().stream().filter(processor -> snippet.getProcessors().containsKey(processor.getIdentifier())).map(processor -> getProcessor(processor.getIdentifier())).collect(Collectors.toSet());
        }

        @Override
        public Set<ConnectionAuthorizable> getSelectedConnections() {
            return processGroup.getConnections().stream().filter(connection -> snippet.getConnections().containsKey(connection.getIdentifier())).map(connection -> getConnection(connection.getIdentifier())).collect(Collectors.toSet());
        }

        @Override
        public Set<Authorizable> getSelectedInputPorts() {
            return processGroup.getInputPorts().stream().filter(inputPort -> snippet.getInputPorts().containsKey(inputPort.getIdentifier())).map(inputPort -> getInputPort(inputPort.getIdentifier())).collect(Collectors.toSet());
        }

        @Override
        public Set<Authorizable> getSelectedOutputPorts() {
            return processGroup.getOutputPorts().stream().filter(outputPort -> snippet.getOutputPorts().containsKey(outputPort.getIdentifier())).map(outputPort -> getOutputPort(outputPort.getIdentifier())).collect(Collectors.toSet());
        }

        @Override
        public Set<Authorizable> getSelectedFunnels() {
            return processGroup.getFunnels().stream().filter(funnel -> snippet.getFunnels().containsKey(funnel.getIdentifier())).map(funnel -> getFunnel(funnel.getIdentifier())).collect(Collectors.toSet());
        }

        @Override
        public Set<Authorizable> getSelectedLabels() {
            return processGroup.getLabels().stream().filter(label -> snippet.getLabels().containsKey(label.getIdentifier())).map(label -> getLabel(label.getIdentifier())).collect(Collectors.toSet());
        }

        @Override
        public Set<ProcessGroupAuthorizable> getSelectedProcessGroups() {
            return processGroup.getProcessGroups().stream().filter(processGroup -> snippet.getProcessGroups().containsKey(processGroup.getIdentifier())).map(processGroup -> getProcessGroup(processGroup.getIdentifier())).collect(Collectors.toSet());
        }

        @Override
        public Set<Authorizable> getSelectedRemoteProcessGroups() {
            return processGroup.getRemoteProcessGroups().stream().filter(remoteProcessGroup -> snippet.getRemoteProcessGroups().containsKey(remoteProcessGroup.getIdentifier())).map(remoteProcessGroup -> getRemoteProcessGroup(remoteProcessGroup.getIdentifier())).collect(Collectors.toSet());
        }
    };
}

Example 80 with Authorizable

use of org.apache.nifi.authorization.resource.Authorizable in project nifi by apache.

the class StandardConnection method getSourceAuthorizable.

@Override
public Authorizable getSourceAuthorizable() {
    final Connectable sourceConnectable = getSource();
    final Authorizable sourceAuthorizable;
    // if the source is a remote group port, authorize according to the RPG
    if (sourceConnectable instanceof RemoteGroupPort) {
        sourceAuthorizable = ((RemoteGroupPort) sourceConnectable).getRemoteProcessGroup();
    } else {
        sourceAuthorizable = sourceConnectable;
    }
    return sourceAuthorizable;
}