-
Notifications
You must be signed in to change notification settings - Fork 36
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Co-authored-by: Raymond Welgosh <[email protected]> Co-authored-by: Saranya Krishnakumar <[email protected]>
- Loading branch information
Showing
90 changed files
with
4,051 additions
and
250 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
40 changes: 40 additions & 0 deletions
40
server/src/main/java/org/apache/cassandra/sidecar/acl/authorization/Action.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one | ||
| * or more contributor license agreements. See the NOTICE file | ||
| * distributed with this work for additional information | ||
| * regarding copyright ownership. The ASF licenses this file | ||
| * to you under the Apache License, Version 2.0 (the | ||
| * "License"); you may not use this file except in compliance | ||
| * with the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package org.apache.cassandra.sidecar.acl.authorization; | ||
|
|
||
| import io.vertx.ext.auth.authorization.Authorization; | ||
|
|
||
| /** | ||
| * Represents an action that can be granted to a user on a resource or across resources. | ||
| */ | ||
| public interface Action | ||
| { | ||
| /** | ||
| * @return {@link Authorization}. | ||
| */ | ||
| default Authorization toAuthorization() | ||
| { | ||
| return toAuthorization(null); | ||
| } | ||
|
|
||
| /** | ||
| * @return {@link Authorization} created for a resource | ||
| */ | ||
| Authorization toAuthorization(String resource); | ||
| } |
60 changes: 60 additions & 0 deletions
60
...r/src/main/java/org/apache/cassandra/sidecar/acl/authorization/AdminIdentityResolver.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one | ||
| * or more contributor license agreements. See the NOTICE file | ||
| * distributed with this work for additional information | ||
| * regarding copyright ownership. The ASF licenses this file | ||
| * to you under the Apache License, Version 2.0 (the | ||
| * "License"); you may not use this file except in compliance | ||
| * with the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package org.apache.cassandra.sidecar.acl.authorization; | ||
|
|
||
| import java.util.Set; | ||
|
|
||
| import com.google.inject.Inject; | ||
| import com.google.inject.Singleton; | ||
| import io.netty.handler.codec.http.HttpResponseStatus; | ||
| import io.vertx.ext.web.handler.HttpException; | ||
| import org.apache.cassandra.sidecar.acl.IdentityToRoleCache; | ||
| import org.apache.cassandra.sidecar.config.SidecarConfiguration; | ||
|
|
||
| /** | ||
| * Evaluates if provided identity is an admin identity. | ||
| */ | ||
| @Singleton | ||
| public class AdminIdentityResolver | ||
| { | ||
| private final IdentityToRoleCache identityToRoleCache; | ||
| private final SuperUserCache superUserCache; | ||
| private final Set<String> adminIdentities; | ||
|
|
||
| @Inject | ||
| public AdminIdentityResolver(IdentityToRoleCache identityToRoleCache, | ||
| SuperUserCache superUserCache, | ||
| SidecarConfiguration sidecarConfiguration) | ||
| { | ||
| this.identityToRoleCache = identityToRoleCache; | ||
| this.superUserCache = superUserCache; | ||
| this.adminIdentities = sidecarConfiguration.accessControlConfiguration().adminIdentities(); | ||
| } | ||
|
|
||
| public boolean isAdmin(String identity) | ||
| { | ||
| String role = identityToRoleCache.get(identity); | ||
| if (role == null) | ||
| { | ||
| throw new HttpException(HttpResponseStatus.FORBIDDEN.code(), "No matching Cassandra role found"); | ||
| } | ||
| // Sidecar configured and Cassandra superusers have admin privileges | ||
| return adminIdentities.contains(identity) || superUserCache.isSuperUser(role); | ||
| } | ||
| } |
53 changes: 53 additions & 0 deletions
53
...r/src/main/java/org/apache/cassandra/sidecar/acl/authorization/AllowAllAuthorization.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one | ||
| * or more contributor license agreements. See the NOTICE file | ||
| * distributed with this work for additional information | ||
| * regarding copyright ownership. The ASF licenses this file | ||
| * to you under the Apache License, Version 2.0 (the | ||
| * "License"); you may not use this file except in compliance | ||
| * with the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package org.apache.cassandra.sidecar.acl.authorization; | ||
|
|
||
| import io.vertx.ext.auth.authorization.Authorization; | ||
| import io.vertx.ext.auth.authorization.AuthorizationContext; | ||
|
|
||
| /** | ||
| * {@code Authorization} implementation to allow access for all users regardless of their authorizations. | ||
| */ | ||
| public class AllowAllAuthorization implements Authorization | ||
| { | ||
| public static final AllowAllAuthorization INSTANCE = new AllowAllAuthorization(); | ||
|
|
||
| // use static INSTANCE | ||
| private AllowAllAuthorization() | ||
| { | ||
| } | ||
|
|
||
| /** | ||
| * Marks match as true regardless of the {@link AuthorizationContext} shared | ||
| */ | ||
| @Override | ||
| public boolean match(AuthorizationContext context) | ||
| { | ||
| return true; | ||
| } | ||
|
|
||
| /** | ||
| * Allows access regardless of {@link Authorization} shared. | ||
| */ | ||
| @Override | ||
| public boolean verify(Authorization authorization) | ||
| { | ||
| return true; | ||
| } | ||
| } |
65 changes: 65 additions & 0 deletions
65
...in/java/org/apache/cassandra/sidecar/acl/authorization/AllowAllAuthorizationProvider.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one | ||
| * or more contributor license agreements. See the NOTICE file | ||
| * distributed with this work for additional information | ||
| * regarding copyright ownership. The ASF licenses this file | ||
| * to you under the Apache License, Version 2.0 (the | ||
| * "License"); you may not use this file except in compliance | ||
| * with the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package org.apache.cassandra.sidecar.acl.authorization; | ||
|
|
||
| import io.vertx.core.AsyncResult; | ||
| import io.vertx.core.Future; | ||
| import io.vertx.core.Handler; | ||
| import io.vertx.ext.auth.User; | ||
| import io.vertx.ext.auth.authorization.AuthorizationProvider; | ||
|
|
||
| /** | ||
| * {@link AuthorizationProvider} implementation to allow all requests regardless of authorizations user holds. | ||
| */ | ||
| public class AllowAllAuthorizationProvider implements AuthorizationProvider | ||
| { | ||
| public static final AllowAllAuthorizationProvider INSTANCE = new AllowAllAuthorizationProvider(); | ||
|
|
||
| // use static INSTANCE | ||
| private AllowAllAuthorizationProvider() | ||
| { | ||
| } | ||
|
|
||
| /** | ||
| * @return unique id representing {@code AllowAllAuthorizationProvider} | ||
| */ | ||
| @Override | ||
| public String getId() | ||
| { | ||
| return "AllowAll"; | ||
| } | ||
|
|
||
| @Override | ||
| public void getAuthorizations(User user, Handler<AsyncResult<Void>> handler) | ||
| { | ||
| getAuthorizations(user).onComplete(handler); | ||
| } | ||
|
|
||
| @Override | ||
| public Future<Void> getAuthorizations(User user) | ||
| { | ||
| if (user == null) | ||
| { | ||
| return Future.failedFuture("User cannot be null"); | ||
| } | ||
|
|
||
| user.authorizations().add(getId(), AllowAllAuthorization.INSTANCE); | ||
| return Future.succeededFuture(); | ||
| } | ||
| } |
Oops, something went wrong.