Examples with DataPolicy org.teiid.adminapi.DataPolicy used on opensource projects

Example 6 with DataPolicy

use of org.teiid.adminapi.DataPolicy in project teiid by teiid.

the class ColumnMaskingHelper method maskColumn.

private static Expression maskColumn(ElementSymbol col, GroupSymbol unaliased, QueryMetadataInterface metadata, ExpressionMappingVisitor emv, Map<String, DataPolicy> policies, CommandContext cc) throws TeiidComponentException, TeiidProcessingException {
    Object metadataID = col.getMetadataID();
    String fullName = metadata.getFullName(metadataID);
    final GroupSymbol group = col.getGroupSymbol();
    String elementType = metadata.getElementRuntimeTypeName(col.getMetadataID());
    Class<?> expectedType = DataTypeManager.getDataTypeClass(elementType);
    List<WhenThen> cases = null;
    Collection<GroupSymbol> groups = Arrays.asList(unaliased);
    for (Map.Entry<String, DataPolicy> entry : policies.entrySet()) {
        DataPolicyMetadata dpm = (DataPolicyMetadata) entry.getValue();
        PermissionMetaData pmd = dpm.getPermissionMap().get(fullName);
        if (pmd == null) {
            continue;
        }
        String maskString = pmd.getMask();
        if (maskString == null) {
            continue;
        }
        Criteria condition = null;
        if (pmd.getCondition() != null) {
            condition = RowBasedSecurityHelper.resolveCondition(metadata, group, metadata.getFullName(group.getMetadataID()), entry, pmd, pmd.getCondition());
        } else {
            condition = QueryRewriter.TRUE_CRITERIA;
        }
        Expression mask = (Expression) pmd.getResolvedMask();
        if (mask == null) {
            try {
                mask = QueryParser.getQueryParser().parseExpression(pmd.getMask());
                for (SubqueryContainer container : ValueIteratorProviderCollectorVisitor.getValueIteratorProviders(mask)) {
                    container.getCommand().pushNewResolvingContext(groups);
                    QueryResolver.resolveCommand(container.getCommand(), metadata, false);
                }
                ResolverVisitor.resolveLanguageObject(mask, groups, metadata);
                ValidatorReport report = Validator.validate(mask, metadata, new ValidationVisitor());
                if (report.hasItems()) {
                    ValidatorFailure firstFailure = report.getItems().iterator().next();
                    // $NON-NLS-1$
                    throw new QueryMetadataException(QueryPlugin.Event.TEIID31139, QueryPlugin.Util.gs(QueryPlugin.Event.TEIID31139, dpm.getName(), fullName) + " " + firstFailure);
                }
                if (mask.getType() != expectedType) {
                    mask = ResolverUtil.convertExpression(mask, elementType, metadata);
                }
                pmd.setResolvedMask(mask.clone());
                if (!dpm.isAnyAuthenticated()) {
                    // we treat this as user deterministic since the data roles won't change.  this may change if the logic becomes dynamic
                    // TODO: this condition may not even be used
                    cc.setDeterminismLevel(Determinism.USER_DETERMINISTIC);
                }
            } catch (QueryMetadataException e) {
                throw e;
            } catch (TeiidException e) {
                throw new QueryMetadataException(QueryPlugin.Event.TEIID31129, e, QueryPlugin.Util.gs(QueryPlugin.Event.TEIID31129, dpm.getName(), fullName));
            }
        } else {
            mask = (Expression) mask.clone();
        }
        if (group.getDefinition() != null) {
            PreOrPostOrderNavigator.doVisit(mask, emv, PreOrPostOrderNavigator.PRE_ORDER, true);
        }
        if (cases == null) {
            cases = new ArrayList<ColumnMaskingHelper.WhenThen>();
        }
        cases.add(new WhenThen(pmd.getOrder(), condition, mask));
    }
    if (cases == null) {
        return col;
    }
    Collections.sort(cases);
    List<Criteria> whens = new ArrayList<Criteria>();
    List<Expression> thens = new ArrayList<Expression>();
    for (WhenThen whenThen : cases) {
        whens.add(whenThen.when);
        thens.add(whenThen.then);
    }
    SearchedCaseExpression sce = new SearchedCaseExpression(whens, thens);
    sce.setElseExpression(col);
    sce.setType(expectedType);
    Expression mask = QueryRewriter.rewriteExpression(sce, cc, metadata, true);
    return mask;
}

Example 7 with DataPolicy

use of org.teiid.adminapi.DataPolicy in project teiid by teiid.

the class RowBasedSecurityHelper method applyRowSecurity.

public static boolean applyRowSecurity(QueryMetadataInterface metadata, final GroupSymbol group, CommandContext cc) throws QueryMetadataException, TeiidComponentException {
    Map<String, DataPolicy> policies = cc.getAllowedDataPolicies();
    if (policies == null || policies.isEmpty()) {
        return false;
    }
    String fullName = metadata.getFullName(group.getMetadataID());
    for (Map.Entry<String, DataPolicy> entry : policies.entrySet()) {
        DataPolicyMetadata dpm = (DataPolicyMetadata) entry.getValue();
        if (dpm.hasRowSecurity(fullName)) {
            return true;
        }
    }
    return false;
}

Example 8 with DataPolicy

use of org.teiid.adminapi.DataPolicy in project teiid by teiid.

the class TestDQPCore method setUp.

@Before
public void setUp() throws Exception {
    agds = new AutoGenDataService();
    DQPWorkContext context = RealMetadataFactory.buildWorkContext(RealMetadataFactory.createTransformationMetadata(RealMetadataFactory.exampleBQTCached().getMetadataStore(), "bqt"));
    // $NON-NLS-1$
    context.getVDB().getModel("BQT3").setVisible(false);
    // $NON-NLS-1$
    context.getVDB().getModel("VQT").setVisible(false);
    HashMap<String, DataPolicy> policies = new HashMap<String, DataPolicy>();
    policies.put("foo", new DataPolicyMetadata());
    context.setPolicies(policies);
    ConnectorManagerRepository repo = Mockito.mock(ConnectorManagerRepository.class);
    context.getVDB().addAttchment(ConnectorManagerRepository.class, repo);
    Mockito.stub(repo.getConnectorManager(Mockito.anyString())).toReturn(agds);
    BufferManagerImpl bm = BufferManagerFactory.createBufferManager();
    bm.setInlineLobs(false);
    FakeBufferService bs = new FakeBufferService(bm, bm);
    core = new DQPCore();
    core.setBufferManager(bs.getBufferManager());
    core.setResultsetCache(new SessionAwareCache<CachedResults>("resultset", new DefaultCacheFactory(new CacheConfiguration()), SessionAwareCache.Type.RESULTSET, 0));
    core.setPreparedPlanCache(new SessionAwareCache<PreparedPlan>("preparedplan", new DefaultCacheFactory(new CacheConfiguration()), SessionAwareCache.Type.PREPAREDPLAN, 0));
    core.setTransactionService(new FakeTransactionService());
    config = new DQPConfiguration();
    config.setMaxActivePlans(1);
    config.setUserRequestSourceConcurrency(2);
    DefaultAuthorizationValidator daa = new DefaultAuthorizationValidator();
    daa.setPolicyDecider(new DataRolePolicyDecider());
    config.setAuthorizationValidator(daa);
    core.start(config);
    core.getPrepPlanCache().setModTime(1);
    core.getRsCache().setTupleBufferCache(bs.getBufferManager());
}

Example 9 with DataPolicy

use of org.teiid.adminapi.DataPolicy in project teiid by teiid.

the class TestDQPWorkContext method testAnyAuthenticated.

@Test
public void testAnyAuthenticated() {
    DQPWorkContext message = new DQPWorkContext();
    SessionMetadata mock = Mockito.mock(SessionMetadata.class);
    message.setSession(mock);
    VDBMetaData vdb = new VDBMetaData();
    DataPolicyMetadata dpm = new DataPolicyMetadata();
    dpm.setAnyAuthenticated(true);
    vdb.addDataPolicy(dpm);
    Mockito.stub(mock.getVdb()).toReturn(vdb);
    // unauthenticated
    Map<String, DataPolicy> map = message.getAllowedDataPolicies();
    assertEquals(0, map.size());
    // authenticated
    message = new DQPWorkContext();
    Mockito.stub(mock.getSubject()).toReturn(new Subject());
    message.setSession(mock);
    map = message.getAllowedDataPolicies();
    assertEquals(1, map.size());
}

Example 10 with DataPolicy

use of org.teiid.adminapi.DataPolicy in project teiid by teiid.

the class TestDQPWorkContext method testClearPolicies.

@Test
public void testClearPolicies() {
    DQPWorkContext message = new DQPWorkContext();
    message.setSession(Mockito.mock(SessionMetadata.class));
    Mockito.stub(message.getSession().getVdb()).toReturn(new VDBMetaData());
    Map<String, DataPolicy> map = message.getAllowedDataPolicies();
    // $NON-NLS-1$
    map.put("role", Mockito.mock(DataPolicy.class));
    assertFalse(map.isEmpty());
    message.setSession(Mockito.mock(SessionMetadata.class));
    Mockito.stub(message.getSession().getVdb()).toReturn(new VDBMetaData());
    map = message.getAllowedDataPolicies();
    assertTrue(map.isEmpty());
}