Examples with AccessPolicy org.apache.nifi.registry.authorization.AccessPolicy used on opensource projects

Example 1 with AccessPolicy

use of org.apache.nifi.registry.authorization.AccessPolicy in project nifi-registry by apache.

the class AuthorizationService method deleteAccessPolicy.

public AccessPolicy deleteAccessPolicy(String identifier) {
    verifyAccessPolicyProviderIsConfigurable();
    writeLock.lock();
    try {
        AccessPolicy deletedAccessPolicyDTO = getAccessPolicy(identifier);
        if (deletedAccessPolicyDTO != null) {
            ((ConfigurableAccessPolicyProvider) accessPolicyProvider).deleteAccessPolicy(identifier);
        }
        return deletedAccessPolicyDTO;
    } finally {
        writeLock.unlock();
    }
}

Example 2 with AccessPolicy

use of org.apache.nifi.registry.authorization.AccessPolicy in project nifi-registry by apache.

the class SecureLdapIT method createAccessPoliciesSnapshot.

private List<AccessPolicy> createAccessPoliciesSnapshot() {
    final AccessPolicySummary[] policySummaries = client.target(createURL("policies")).request().header("Authorization", "Bearer " + adminAuthToken).get(AccessPolicySummary[].class);
    final List<AccessPolicy> policies = new ArrayList<>(policySummaries.length);
    for (AccessPolicySummary s : policySummaries) {
        AccessPolicy policy = client.target(createURL("policies/" + s.getIdentifier())).request().header("Authorization", "Bearer " + adminAuthToken).get(AccessPolicy.class);
        policies.add(policy);
    }
    return policies;
}

Example 3 with AccessPolicy

use of org.apache.nifi.registry.authorization.AccessPolicy in project nifi-registry by apache.

the class SecureLdapIT method getPolicyByResourceAction.

/**
 * A helper method to lookup access policies
 *
 * @return A string containing the identifier of the policy, or null if the policy identity is not found.
 */
private AccessPolicy getPolicyByResourceAction(String action, String resource) {
    final AccessPolicySummary[] policies = client.target(createURL("policies")).request().header("Authorization", "Bearer " + adminAuthToken).get(AccessPolicySummary[].class);
    final AccessPolicySummary matchedPolicy = Arrays.stream(policies).filter(p -> p.getAction().equalsIgnoreCase(action) && p.getResource().equalsIgnoreCase(resource)).findFirst().orElse(null);
    if (matchedPolicy == null) {
        return null;
    }
    String policyId = matchedPolicy.getIdentifier();
    final AccessPolicy policy = client.target(createURL("policies/" + policyId)).request().header("Authorization", "Bearer " + adminAuthToken).get(AccessPolicy.class);
    return policy;
}

Example 4 with AccessPolicy

use of org.apache.nifi.registry.authorization.AccessPolicy in project nifi-registry by apache.

the class SecureLdapIT method restoreAccessPoliciesSnapshot.

private void restoreAccessPoliciesSnapshot(List<AccessPolicy> accessPoliciesSnapshot) {
    List<AccessPolicy> currentAccessPolicies = createAccessPoliciesSnapshot();
    Set<String> policiesToRestore = accessPoliciesSnapshot.stream().map(AccessPolicy::getIdentifier).collect(Collectors.toSet());
    Set<String> policiesToDelete = currentAccessPolicies.stream().filter(p -> !policiesToRestore.contains(p.getIdentifier())).map(AccessPolicy::getIdentifier).collect(Collectors.toSet());
    for (AccessPolicy originalPolicy : accessPoliciesSnapshot) {
        Response getCurrentPolicy = client.target(createURL("policies/" + originalPolicy.getIdentifier())).request().header("Authorization", "Bearer " + adminAuthToken).get(Response.class);
        if (getCurrentPolicy.getStatus() == 200) {
            // update policy to match original
            client.target(createURL("policies/" + originalPolicy.getIdentifier())).request().header("Authorization", "Bearer " + adminAuthToken).put(Entity.entity(originalPolicy, MediaType.APPLICATION_JSON));
        } else {
            // post the original policy
            client.target(createURL("policies")).request().header("Authorization", "Bearer " + adminAuthToken).post(Entity.entity(originalPolicy, MediaType.APPLICATION_JSON));
        }
    }
    for (String id : policiesToDelete) {
        try {
            client.target(createURL("policies/" + id)).request().header("Authorization", "Bearer " + adminAuthToken).delete();
        } catch (Exception e) {
        // do nothing
        }
    }
}

Example 5 with AccessPolicy

use of org.apache.nifi.registry.authorization.AccessPolicy in project nifi-registry by apache.

the class AccessPolicyResource method removeAccessPolicy.

/**
 * Remove a specified access policy.
 *
 * @param httpServletRequest request
 * @param identifier         The id of the access policy to remove.
 * @return The deleted access policy
 */
@DELETE
@Consumes(MediaType.WILDCARD)
@Produces(MediaType.APPLICATION_JSON)
@Path("{id}")
@ApiOperation(value = "Deletes an access policy", response = AccessPolicy.class, extensions = { @Extension(name = "access-policy", properties = { @ExtensionProperty(name = "action", value = "delete"), @ExtensionProperty(name = "resource", value = "/policies") }) })
@ApiResponses({ @ApiResponse(code = 401, message = HttpStatusMessages.MESSAGE_401), @ApiResponse(code = 403, message = HttpStatusMessages.MESSAGE_403), @ApiResponse(code = 404, message = HttpStatusMessages.MESSAGE_404), @ApiResponse(code = 409, message = HttpStatusMessages.MESSAGE_409 + " The NiFi Registry might not be configured to use a ConfigurableAccessPolicyProvider.") })
public Response removeAccessPolicy(@Context final HttpServletRequest httpServletRequest, @ApiParam(value = "The access policy id.", required = true) @PathParam("id") final String identifier) {
    verifyAuthorizerSupportsConfigurablePolicies();
    authorizeAccess(RequestAction.DELETE);
    AccessPolicy deletedPolicy = authorizationService.deleteAccessPolicy(identifier);
    if (deletedPolicy == null) {
        logger.warn("The specified access policy id [{}] does not exist.", identifier);
        throw new ResourceNotFoundException("The specified policy does not exist in this registry.");
    }
    return generateOkResponse(deletedPolicy).build();
}