Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[fix][broker] support missing cluster level fine-granted permissions #23675

Merged
merged 6 commits into from
Dec 4, 2024
Merged

[fix][broker] support missing cluster level fine-granted permissions #23675

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
604e804
[fix][broker] Support missing cluster level fine-granted permissions
mattisonchao Dec 1, 2024
2891d15
add some tests
mattisonchao Dec 1, 2024
aecb435
add test & fix checkstyle
mattisonchao Dec 3, 2024
9ecad42
Merge branch 'master' into permissions.cluster
mattisonchao Dec 3, 2024
1c45e7b
fix typo
mattisonchao Dec 3, 2024
8c41d99
fix checkstyle
mattisonchao Dec 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions ...er-common/src/main/java/org/apache/pulsar/broker/authorization/AuthorizationProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@
import org.apache.pulsar.common.naming.TopicName;
import org.apache.pulsar.common.policies.data.AuthAction;
import org.apache.pulsar.common.policies.data.BrokerOperation;
import org.apache.pulsar.common.policies.data.ClusterOperation;
import org.apache.pulsar.common.policies.data.NamespaceOperation;
import org.apache.pulsar.common.policies.data.PolicyName;
import org.apache.pulsar.common.policies.data.PolicyOperation;
Expand Down Expand Up @@ -393,4 +394,23 @@ default CompletableFuture<Boolean> allowBrokerOperationAsync(String clusterName,
return FutureUtil.failedFuture(
new UnsupportedOperationException("allowBrokerOperationAsync is not supported yet."));
}


default CompletableFuture<Boolean> allowClusterOperationAsync(String clusterName,
ClusterOperation clusterOperation,
String role,
AuthenticationDataSource authData) {
return FutureUtil.failedFuture(
new UnsupportedOperationException("allowClusterOperationAsync is not supported yet."));
}

default CompletableFuture<Boolean> allowClusterPolicyOperationAsync(String clusterName,
String role,
PolicyName policy,
PolicyOperation operation,
AuthenticationDataSource authData) {
return FutureUtil.failedFuture(
new IllegalStateException("ClusterPolicyOperation [" + policy.name() + "/" + operation.name() + "] "
+ "is not supported by the Authorization provider you are using."));
}
}
45 changes: 45 additions & 0 deletions ...ker-common/src/main/java/org/apache/pulsar/broker/authorization/AuthorizationService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@
import org.apache.pulsar.common.naming.TopicName;
import org.apache.pulsar.common.policies.data.AuthAction;
import org.apache.pulsar.common.policies.data.BrokerOperation;
import org.apache.pulsar.common.policies.data.ClusterOperation;
import org.apache.pulsar.common.policies.data.NamespaceOperation;
import org.apache.pulsar.common.policies.data.PolicyName;
import org.apache.pulsar.common.policies.data.PolicyOperation;
Expand Down Expand Up @@ -567,6 +568,50 @@ public CompletableFuture<Boolean> allowBrokerOperationAsync(String clusterName,
}
}

public CompletableFuture<Boolean> allowClusterOperationAsync(String clusterName,
ClusterOperation clusterOperation,
String originalRole,
String role,
AuthenticationDataSource authData) {
if (!isValidOriginalPrincipal(role, originalRole, authData)) {
return CompletableFuture.completedFuture(false);
}

if (isProxyRole(role)) {
final var isRoleAuthorizedFuture = provider.allowClusterOperationAsync(clusterName,
clusterOperation, role, authData);
final var isOriginalAuthorizedFuture = provider.allowClusterOperationAsync(clusterName,
clusterOperation, originalRole, authData);
return isRoleAuthorizedFuture.thenCombine(isOriginalAuthorizedFuture,
(isRoleAuthorized, isOriginalAuthorized) -> isRoleAuthorized && isOriginalAuthorized);
} else {
return provider.allowClusterOperationAsync(clusterName, clusterOperation, role, authData);
}
}

public CompletableFuture<Boolean> allowClusterPolicyOperationAsync(String clusterName,
PolicyName policy,
PolicyOperation operation,
String originalRole,
String role,
AuthenticationDataSource authData) {
if (!isValidOriginalPrincipal(role, originalRole, authData)) {
return CompletableFuture.completedFuture(false);
}

if (isProxyRole(role)) {
final var isRoleAuthorizedFuture = provider.allowClusterPolicyOperationAsync(clusterName, role,
policy, operation, authData);
final var isOriginalAuthorizedFuture = provider.allowClusterPolicyOperationAsync(clusterName, originalRole,
policy, operation, authData);
return isRoleAuthorizedFuture.thenCombine(isOriginalAuthorizedFuture,
(isRoleAuthorized, isOriginalAuthorized) -> isRoleAuthorized && isOriginalAuthorized);
} else {
return provider.allowClusterPolicyOperationAsync(clusterName, role, policy, operation, authData);
}
}


/**
* @deprecated - will be removed after 2.12. Use async variant.
*/
Expand Down
15 changes: 15 additions & 0 deletions ...mon/src/main/java/org/apache/pulsar/broker/authorization/PulsarAuthorizationProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@
import org.apache.pulsar.common.policies.data.AuthAction;
import org.apache.pulsar.common.policies.data.AuthPolicies;
import org.apache.pulsar.common.policies.data.BrokerOperation;
import org.apache.pulsar.common.policies.data.ClusterOperation;
import org.apache.pulsar.common.policies.data.NamespaceOperation;
import org.apache.pulsar.common.policies.data.PolicyName;
import org.apache.pulsar.common.policies.data.PolicyOperation;
Expand Down Expand Up @@ -860,4 +861,18 @@ public CompletableFuture<Map<String, Set<AuthAction>>> getPermissionsAsync(Names
});
});
}

@Override
public CompletableFuture<Boolean> allowClusterOperationAsync(String clusterName, ClusterOperation clusterOperation,
String role, AuthenticationDataSource authData) {
return isSuperUser(role, authData, conf);
}

@Override
public CompletableFuture<Boolean> allowClusterPolicyOperationAsync(String clusterName, String role,
PolicyName policy,
PolicyOperation operation,
AuthenticationDataSource authData) {
return isSuperUser(role, authData, conf);
}
}
Loading
Loading