Examples with NiFiUser org.apache.nifi.authorization.user.NiFiUser used on opensource projects

Example 91 with NiFiUser

use of org.apache.nifi.authorization.user.NiFiUser in project nifi by apache.

the class AuthorizeControllerServiceReference method authorizeControllerServiceReferences.

/**
 * Authorizes the proposed properties for the specified authorizable.
 *
 * @param proposedProperties proposed properties
 * @param authorizable authorizable that may reference a controller service
 * @param authorizer authorizer
 * @param lookup lookup
 */
public static void authorizeControllerServiceReferences(final Map<String, String> proposedProperties, final ComponentAuthorizable authorizable, final Authorizer authorizer, final AuthorizableLookup lookup) {
    // only attempt to authorize if properties are changing
    if (proposedProperties != null) {
        final NiFiUser user = NiFiUserUtils.getNiFiUser();
        for (final Map.Entry<String, String> entry : proposedProperties.entrySet()) {
            final String propertyName = entry.getKey();
            final PropertyDescriptor propertyDescriptor = authorizable.getPropertyDescriptor(propertyName);
            // if this descriptor identifies a controller service
            if (propertyDescriptor.getControllerServiceDefinition() != null) {
                final String currentValue = authorizable.getValue(propertyDescriptor);
                final String proposedValue = entry.getValue();
                // if the value is changing
                if (!Objects.equals(currentValue, proposedValue)) {
                    // ensure access to the old service
                    if (currentValue != null) {
                        try {
                            final Authorizable currentServiceAuthorizable = lookup.getControllerService(currentValue).getAuthorizable();
                            currentServiceAuthorizable.authorize(authorizer, RequestAction.READ, user);
                        } catch (ResourceNotFoundException e) {
                        // ignore if the resource is not found, if currentValue was previously deleted, it should not stop assignment of proposedValue
                        }
                    }
                    // ensure access to the new service
                    if (proposedValue != null) {
                        final Authorizable newServiceAuthorizable = lookup.getControllerService(proposedValue).getAuthorizable();
                        newServiceAuthorizable.authorize(authorizer, RequestAction.READ, user);
                    }
                }
            }
        }
    }
}

Example 92 with NiFiUser

use of org.apache.nifi.authorization.user.NiFiUser in project nifi by apache.

the class StandardAuthorizableLookup method getRootGroupOutputPort.

@Override
public RootGroupPortAuthorizable getRootGroupOutputPort(String id) {
    final Port outputPort = outputPortDAO.getPort(id);
    if (!(outputPort instanceof RootGroupPort)) {
        throw new IllegalArgumentException(String.format("The specified id '%s' does not represent an output port in the root group.", id));
    }
    final DataTransferAuthorizable baseAuthorizable = new DataTransferAuthorizable(outputPort);
    return new RootGroupPortAuthorizable() {

        @Override
        public Authorizable getAuthorizable() {
            return baseAuthorizable;
        }

        @Override
        public AuthorizationResult checkAuthorization(NiFiUser user) {
            // perform the authorization of the user by using the underlying component, ensures consistent authorization with raw s2s
            final PortAuthorizationResult authorizationResult = ((RootGroupPort) outputPort).checkUserAuthorization(user);
            if (authorizationResult.isAuthorized()) {
                return AuthorizationResult.approved();
            } else {
                return AuthorizationResult.denied(authorizationResult.getExplanation());
            }
        }
    };
}

Example 93 with NiFiUser

use of org.apache.nifi.authorization.user.NiFiUser in project nifi by apache.

the class DataAuthorizable method authorize.

@Override
public void authorize(Authorizer authorizer, RequestAction action, NiFiUser user, Map<String, String> resourceContext) throws AccessDeniedException {
    if (user == null) {
        throw new AccessDeniedException("Unknown user.");
    }
    // authorize each element in the chain
    NiFiUser chainedUser = user;
    do {
        try {
            // perform the current user authorization
            Authorizable.super.authorize(authorizer, action, chainedUser, resourceContext);
            // go to the next user in the chain
            chainedUser = chainedUser.getChain();
        } catch (final ResourceNotFoundException e) {
            throw new AccessDeniedException("Unknown source component.");
        }
    } while (chainedUser != null);
}

Example 94 with NiFiUser

use of org.apache.nifi.authorization.user.NiFiUser in project nifi by apache.

the class TestPersistentProvenanceRepository method testNotAuthorizedGetSpecificEvent.

@Test
public void testNotAuthorizedGetSpecificEvent() throws IOException {
    assumeFalse(isWindowsEnvironment());
    final RepositoryConfiguration config = createConfiguration();
    config.setMaxRecordLife(5, TimeUnit.MINUTES);
    config.setMaxStorageCapacity(1024L * 1024L);
    config.setMaxEventFileLife(500, TimeUnit.MILLISECONDS);
    config.setMaxEventFileCapacity(1024L * 1024L);
    config.setSearchableFields(new ArrayList<>(SearchableFields.getStandardFields()));
    // force new index to be created for each rollover
    config.setDesiredIndexSize(10);
    final AccessDeniedException expectedException = new AccessDeniedException("Unit Test - Intentionally Thrown");
    repo = new PersistentProvenanceRepository(config, DEFAULT_ROLLOVER_MILLIS) {

        @Override
        public void authorize(ProvenanceEventRecord event, NiFiUser user) {
            throw expectedException;
        }
    };
    repo.initialize(getEventReporter(), null, null, IdentifierLookup.EMPTY);
    final String uuid = "00000000-0000-0000-0000-000000000000";
    final Map<String, String> attributes = new HashMap<>();
    attributes.put("abc", "xyz");
    attributes.put("xyz", "abc");
    attributes.put("filename", "file-" + uuid);
    final ProvenanceEventBuilder builder = new StandardProvenanceEventRecord.Builder();
    builder.setEventTime(System.currentTimeMillis());
    builder.setEventType(ProvenanceEventType.RECEIVE);
    builder.setTransitUri("nifi://unit-test");
    builder.fromFlowFile(createFlowFile(3L, 3000L, attributes));
    builder.setComponentId("1234");
    builder.setComponentType("dummy processor");
    for (int i = 0; i < 10; i++) {
        attributes.put("uuid", "00000000-0000-0000-0000-00000000000" + i);
        builder.fromFlowFile(createFlowFile(i, 3000L, attributes));
        // make sure the events are destroyed when we call purge
        builder.setEventTime(10L);
        repo.registerEvent(builder.build());
    }
    repo.waitForRollover();
    try {
        repo.getEvent(0L, null);
        Assert.fail("getEvent() did not throw an Exception");
    } catch (final Exception e) {
        Assert.assertSame(expectedException, e);
    }
}

Example 95 with NiFiUser

use of org.apache.nifi.authorization.user.NiFiUser in project nifi by apache.

the class TestLuceneEventIndex method testUnauthorizedEventsGetPlaceholdersForExpandChildren.

@Test(timeout = 60000)
public void testUnauthorizedEventsGetPlaceholdersForExpandChildren() throws InterruptedException {
    assumeFalse(isWindowsEnvironment());
    final RepositoryConfiguration repoConfig = createConfig(1);
    repoConfig.setDesiredIndexSize(1L);
    final IndexManager indexManager = new SimpleIndexManager(repoConfig);
    final ArrayListEventStore eventStore = new ArrayListEventStore();
    final LuceneEventIndex index = new LuceneEventIndex(repoConfig, indexManager, 3, EventReporter.NO_OP);
    index.initialize(eventStore);
    final ProvenanceEventRecord firstEvent = createEvent("4444");
    final Map<String, String> previousAttributes = new HashMap<>();
    previousAttributes.put("uuid", "4444");
    final Map<String, String> updatedAttributes = new HashMap<>();
    updatedAttributes.put("updated", "true");
    final ProvenanceEventRecord fork = new StandardProvenanceEventRecord.Builder().setEventType(ProvenanceEventType.FORK).setAttributes(previousAttributes, updatedAttributes).addChildFlowFile("1234").setComponentId("component-1").setComponentType("unit test").setEventId(idGenerator.getAndIncrement()).setEventTime(System.currentTimeMillis()).setFlowFileEntryDate(System.currentTimeMillis()).setFlowFileUUID("4444").setLineageStartDate(System.currentTimeMillis()).setCurrentContentClaim("container", "section", "unit-test-id", 0L, 1024L).build();
    index.addEvents(eventStore.addEvent(firstEvent).getStorageLocations());
    index.addEvents(eventStore.addEvent(fork).getStorageLocations());
    for (int i = 0; i < 3; i++) {
        final ProvenanceEventRecord event = createEvent("1234");
        final StorageResult storageResult = eventStore.addEvent(event);
        index.addEvents(storageResult.getStorageLocations());
    }
    final NiFiUser user = createUser();
    final EventAuthorizer allowForkEvents = new EventAuthorizer() {

        @Override
        public boolean isAuthorized(ProvenanceEventRecord event) {
            return event.getEventType() == ProvenanceEventType.FORK;
        }

        @Override
        public void authorize(ProvenanceEventRecord event) throws AccessDeniedException {
        }
    };
    List<LineageNode> nodes = Collections.emptyList();
    while (nodes.size() < 5) {
        final ComputeLineageSubmission submission = index.submitExpandChildren(1L, user, allowForkEvents);
        assertTrue(submission.getResult().awaitCompletion(5, TimeUnit.SECONDS));
        nodes = submission.getResult().getNodes();
        Thread.sleep(25L);
    }
    assertEquals(5, nodes.size());
    assertEquals(1L, nodes.stream().filter(n -> n.getNodeType() == LineageNodeType.FLOWFILE_NODE).count());
    assertEquals(4L, nodes.stream().filter(n -> n.getNodeType() == LineageNodeType.PROVENANCE_EVENT_NODE).count());
    final Map<ProvenanceEventType, List<LineageNode>> eventMap = nodes.stream().filter(n -> n.getNodeType() == LineageNodeType.PROVENANCE_EVENT_NODE).collect(Collectors.groupingBy(n -> ((ProvenanceEventLineageNode) n).getEventType()));
    assertEquals(2, eventMap.size());
    assertEquals(1, eventMap.get(ProvenanceEventType.FORK).size());
    assertEquals(3, eventMap.get(ProvenanceEventType.UNKNOWN).size());
}