Examples with Policies org.apache.pulsar.common.policies.data.Policies used on opensource projects

Example 61 with Policies

use of org.apache.pulsar.common.policies.data.Policies in project incubator-pulsar by apache.

the class PersistentTopicsBase method internalRevokePermissionsOnTopic.

protected void internalRevokePermissionsOnTopic(String role) {
    // This operation should be reading from zookeeper and it should be allowed without having admin privileges
    validateAdminAccessOnProperty(namespaceName.getProperty());
    validatePoliciesReadOnlyAccess();
    String topicUri = topicName.toString();
    Stat nodeStat = new Stat();
    Policies policies;
    try {
        byte[] content = globalZk().getData(path(POLICIES, namespaceName.toString()), null, nodeStat);
        policies = jsonMapper().readValue(content, Policies.class);
    } catch (KeeperException.NoNodeException e) {
        log.warn("[{}] Failed to revoke permissions on topic {}: Namespace does not exist", clientAppId(), topicUri);
        throw new RestException(Status.NOT_FOUND, "Namespace does not exist");
    } catch (Exception e) {
        log.error("[{}] Failed to revoke permissions for topic {}", clientAppId(), topicUri, e);
        throw new RestException(e);
    }
    if (!policies.auth_policies.destination_auth.containsKey(topicUri) || !policies.auth_policies.destination_auth.get(topicUri).containsKey(role)) {
        log.warn("[{}] Failed to revoke permission from role {} on topic: Not set at topic level", clientAppId(), role, topicUri);
        throw new RestException(Status.PRECONDITION_FAILED, "Permissions are not set at the topic level");
    }
    policies.auth_policies.destination_auth.get(topicUri).remove(role);
    try {
        // Write the new policies to zookeeper
        String namespacePath = path(POLICIES, namespaceName.toString());
        globalZk().setData(namespacePath, jsonMapper().writeValueAsBytes(policies), nodeStat.getVersion());
        // invalidate the local cache to force update
        policiesCache().invalidate(namespacePath);
        globalZkCache().invalidate(namespacePath);
        log.info("[{}] Successfully revoke access for role {} - topic {}", clientAppId(), role, topicUri);
    } catch (Exception e) {
        log.error("[{}] Failed to revoke permissions for topic {}", clientAppId(), topicUri, e);
        throw new RestException(e);
    }
}

Example 62 with Policies

use of org.apache.pulsar.common.policies.data.Policies in project incubator-pulsar by apache.

the class AdminResource method getNamespacePolicies.

protected Policies getNamespacePolicies(NamespaceName namespaceName) {
    try {
        Policies policies = policiesCache().get(AdminResource.path(POLICIES, namespaceName.toString())).orElseThrow(() -> new RestException(Status.NOT_FOUND, "Namespace does not exist"));
        // fetch bundles from LocalZK-policies
        NamespaceBundles bundles = pulsar().getNamespaceService().getNamespaceBundleFactory().getBundles(namespaceName);
        BundlesData bundleData = NamespaceBundleFactory.getBundlesData(bundles);
        policies.bundles = bundleData != null ? bundleData : policies.bundles;
        return policies;
    } catch (RestException re) {
        throw re;
    } catch (Exception e) {
        log.error("[{}] Failed to get namespace policies {}", clientAppId(), namespaceName, e);
        throw new RestException(e);
    }
}

Example 63 with Policies

use of org.apache.pulsar.common.policies.data.Policies in project incubator-pulsar by apache.

the class ResourceQuotasBase method internalGetNamespaceBundleResourceQuota.

@SuppressWarnings("deprecation")
protected ResourceQuota internalGetNamespaceBundleResourceQuota(String bundleRange) {
    validateSuperUserAccess();
    Policies policies = getNamespacePolicies(namespaceName);
    if (!namespaceName.isGlobal()) {
        validateClusterOwnership(namespaceName.getCluster());
        validateClusterForProperty(namespaceName.getProperty(), namespaceName.getCluster());
    }
    NamespaceBundle nsBundle = validateNamespaceBundleRange(namespaceName, policies.bundles, bundleRange);
    try {
        return pulsar().getLocalZkCacheService().getResourceQuotaCache().getQuota(nsBundle);
    } catch (Exception e) {
        log.error("[{}] Failed to get resource quota for namespace bundle {}", clientAppId(), nsBundle.toString());
        throw new RestException(e);
    }
}

Example 64 with Policies

use of org.apache.pulsar.common.policies.data.Policies in project incubator-pulsar by apache.

the class ResourceQuotasBase method internalRemoveNamespaceBundleResourceQuota.

@SuppressWarnings("deprecation")
protected void internalRemoveNamespaceBundleResourceQuota(String bundleRange) {
    validateSuperUserAccess();
    validatePoliciesReadOnlyAccess();
    Policies policies = getNamespacePolicies(namespaceName);
    if (!namespaceName.isGlobal()) {
        validateClusterOwnership(namespaceName.getCluster());
        validateClusterForProperty(namespaceName.getProperty(), namespaceName.getCluster());
    }
    NamespaceBundle nsBundle = validateNamespaceBundleRange(namespaceName, policies.bundles, bundleRange);
    try {
        pulsar().getLocalZkCacheService().getResourceQuotaCache().unsetQuota(nsBundle);
        log.info("[{}] Successfully unset resource quota for namespace bundle {}", clientAppId(), nsBundle.toString());
    } catch (KeeperException.NoNodeException e) {
        log.warn("[{}] Failed to unset resource quota for namespace bundle {}: concurrent modification", clientAppId(), nsBundle.toString());
        throw new RestException(Status.CONFLICT, "Cuncurrent modification on namespace bundle quota");
    } catch (Exception e) {
        log.error("[{}] Failed to unset resource quota for namespace bundle {}", clientAppId(), nsBundle.toString());
        throw new RestException(e);
    }
}

Example 65 with Policies

use of org.apache.pulsar.common.policies.data.Policies in project incubator-pulsar by apache.

the class Namespaces method getPermissions.

@GET
@Path("/{property}/{cluster}/{namespace}/permissions")
@ApiOperation(hidden = true, value = "Retrieve the permissions for a namespace.")
@ApiResponses(value = { @ApiResponse(code = 403, message = "Don't have admin permission"), @ApiResponse(code = 404, message = "Property or cluster or namespace doesn't exist"), @ApiResponse(code = 409, message = "Namespace is not empty") })
public Map<String, Set<AuthAction>> getPermissions(@PathParam("property") String property, @PathParam("cluster") String cluster, @PathParam("namespace") String namespace) {
    validateAdminAccessOnProperty(property);
    validateNamespaceName(property, cluster, namespace);
    Policies policies = getNamespacePolicies(namespaceName);
    return policies.auth_policies.namespace_auth;
}