Examples with NiFiUser org.apache.nifi.authorization.user.NiFiUser used on opensource projects

Example 51 with NiFiUser

use of org.apache.nifi.authorization.user.NiFiUser in project nifi by apache.

the class KnoxAuthenticationProvider method authenticate.

@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    final KnoxAuthenticationRequestToken request = (KnoxAuthenticationRequestToken) authentication;
    try {
        final String jwtPrincipal = knoxService.getAuthenticationFromToken(request.getToken());
        final String mappedIdentity = mapIdentity(jwtPrincipal);
        final NiFiUser user = new Builder().identity(mappedIdentity).groups(getUserGroups(mappedIdentity)).clientAddress(request.getClientAddress()).build();
        return new NiFiAuthenticationToken(new NiFiUserDetails(user));
    } catch (ParseException | JOSEException e) {
        logger.info("Unable to validate the access token: " + e.getMessage(), e);
        throw new InvalidAuthenticationException("Unable to validate the access token.", e);
    }
}

Example 52 with NiFiUser

use of org.apache.nifi.authorization.user.NiFiUser in project nifi by apache.

the class X509AuthenticationProviderTest method testAnonymousProxyInChain.

@Test
public void testAnonymousProxyInChain() {
    final NiFiAuthenticationToken auth = (NiFiAuthenticationToken) x509AuthenticationProvider.authenticate(getX509Request(buildProxyChain(IDENTITY_1, ANONYMOUS), PROXY_1));
    final NiFiUser user = ((NiFiUserDetails) auth.getDetails()).getNiFiUser();
    assertNotNull(user);
    assertEquals(IDENTITY_1, user.getIdentity());
    assertFalse(user.isAnonymous());
    assertNotNull(user.getChain());
    assertEquals(StandardNiFiUser.ANONYMOUS_IDENTITY, user.getChain().getIdentity());
    assertTrue(user.getChain().isAnonymous());
    assertNotNull(user.getChain().getChain());
    assertEquals(PROXY_1, user.getChain().getChain().getIdentity());
    assertFalse(user.getChain().getChain().isAnonymous());
}

Example 53 with NiFiUser

use of org.apache.nifi.authorization.user.NiFiUser in project nifi by apache.

the class X509AuthenticationProviderTest method testAnonymousWithOneProxy.

@Test
public void testAnonymousWithOneProxy() {
    final NiFiAuthenticationToken auth = (NiFiAuthenticationToken) x509AuthenticationProvider.authenticate(getX509Request(buildProxyChain(ANONYMOUS), PROXY_1));
    final NiFiUser user = ((NiFiUserDetails) auth.getDetails()).getNiFiUser();
    assertNotNull(user);
    assertEquals(StandardNiFiUser.ANONYMOUS_IDENTITY, user.getIdentity());
    assertTrue(user.isAnonymous());
    assertNotNull(user.getChain());
    assertEquals(PROXY_1, user.getChain().getIdentity());
    assertFalse(user.getChain().isAnonymous());
}

Example 54 with NiFiUser

use of org.apache.nifi.authorization.user.NiFiUser in project nifi by apache.

the class RequestLogger method doFilter.

@Override
public void doFilter(final ServletRequest req, final ServletResponse resp, final FilterChain filterChain) throws IOException, ServletException {
    final HttpServletRequest request = (HttpServletRequest) req;
    // only log http requests has https requests are logged elsewhere
    if ("http".equalsIgnoreCase(request.getScheme())) {
        final NiFiUser user = NiFiUserUtils.getNiFiUser();
        // get the user details for the log message
        String identity = "<no user found>";
        if (user != null) {
            identity = user.getIdentity();
        }
        // log the request attempt - response details will be logged later
        logger.info(String.format("Attempting request for (%s) %s %s (source ip: %s)", identity, request.getMethod(), request.getRequestURL().toString(), request.getRemoteAddr()));
    }
    // continue the filter chain
    filterChain.doFilter(req, resp);
}

Example 55 with NiFiUser

use of org.apache.nifi.authorization.user.NiFiUser in project nifi by apache.

the class ClusterReplicationComponentLifecycle method activateControllerServices.

@Override
public Set<AffectedComponentEntity> activateControllerServices(final URI originalUri, final NiFiUser user, final String groupId, final Set<AffectedComponentEntity> affectedServices, final ControllerServiceState desiredState, final Pause pause) throws LifecycleManagementException {
    final Set<String> affectedServiceIds = affectedServices.stream().map(component -> component.getId()).collect(Collectors.toSet());
    final Map<String, Revision> serviceRevisionMap = getRevisions(groupId, affectedServiceIds);
    final Map<String, RevisionDTO> serviceRevisionDtoMap = serviceRevisionMap.entrySet().stream().collect(Collectors.toMap(Map.Entry::getKey, entry -> dtoFactory.createRevisionDTO(entry.getValue())));
    final ActivateControllerServicesEntity activateServicesEntity = new ActivateControllerServicesEntity();
    activateServicesEntity.setComponents(serviceRevisionDtoMap);
    activateServicesEntity.setId(groupId);
    activateServicesEntity.setState(desiredState.name());
    URI controllerServicesUri;
    try {
        controllerServicesUri = new URI(originalUri.getScheme(), originalUri.getUserInfo(), originalUri.getHost(), originalUri.getPort(), "/nifi-api/flow/process-groups/" + groupId + "/controller-services", null, originalUri.getFragment());
    } catch (URISyntaxException e) {
        throw new RuntimeException(e);
    }
    final Map<String, String> headers = new HashMap<>();
    headers.put("content-type", MediaType.APPLICATION_JSON);
    // Determine whether we should replicate only to the cluster coordinator, or if we should replicate directly to the cluster nodes themselves.
    try {
        final NodeResponse clusterResponse;
        if (getReplicationTarget() == ReplicationTarget.CLUSTER_NODES) {
            clusterResponse = getRequestReplicator().replicate(user, HttpMethod.PUT, controllerServicesUri, activateServicesEntity, headers).awaitMergedResponse();
        } else {
            clusterResponse = getRequestReplicator().forwardToCoordinator(getClusterCoordinatorNode(), user, HttpMethod.PUT, controllerServicesUri, activateServicesEntity, headers).awaitMergedResponse();
        }
        final int disableServicesStatus = clusterResponse.getStatus();
        if (disableServicesStatus != Status.OK.getStatusCode()) {
            final String explanation = getResponseEntity(clusterResponse, String.class);
            throw new LifecycleManagementException("Failed to update Controller Services to a state of " + desiredState + " due to " + explanation);
        }
        final boolean serviceTransitioned = waitForControllerServiceStatus(user, originalUri, groupId, affectedServiceIds, desiredState, pause);
        if (!serviceTransitioned) {
            throw new LifecycleManagementException("Failed while waiting for Controller Services to finish transitioning to a state of " + desiredState);
        }
    } catch (final InterruptedException ie) {
        Thread.currentThread().interrupt();
        throw new LifecycleManagementException("Interrupted while transitioning Controller Services to a state of " + desiredState);
    }
    return affectedServices.stream().map(componentEntity -> serviceFacade.getControllerService(componentEntity.getId(), user)).map(dtoFactory::createAffectedComponentEntity).collect(Collectors.toSet());
}