mirror of https://github.com/apache/lucene.git
SOLR-7838: An authorizationPlugin interface where the access control rules are stored/managed in ZooKeeper
git-svn-id: https://svn.apache.org/repos/asf/lucene/dev/trunk@1694553 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Noble Paul
parent
db2ccb1d41
commit
d841e40a7e
|
|
@ -0,0 +1,449 @@
|
||||||
|
package org.apache.solr.security;
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Licensed to the Apache Software Foundation (ASF) under one or more
|
||||||
|
* contributor license agreements. See the NOTICE file distributed with
|
||||||
|
* this work for additional information regarding copyright ownership.
|
||||||
|
* The ASF licenses this file to You under the Apache License, Version 2.0
|
||||||
|
* (the "License"); you may not use this file except in compliance with
|
||||||
|
* the License. You may obtain a copy of the License at
|
||||||
|
*
|
||||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
*
|
||||||
|
* Unless required by applicable law or agreed to in writing, software
|
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
* See the License for the specific language governing permissions and
|
||||||
|
* limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
import java.io.IOException;
|
||||||
|
import java.security.Principal;
|
||||||
|
import java.util.ArrayList;
|
||||||
|
import java.util.Collection;
|
||||||
|
import java.util.Collections;
|
||||||
|
import java.util.HashMap;
|
||||||
|
import java.util.HashSet;
|
||||||
|
import java.util.LinkedHashMap;
|
||||||
|
import java.util.List;
|
||||||
|
import java.util.Map;
|
||||||
|
import java.util.Objects;
|
||||||
|
import java.util.Set;
|
||||||
|
import java.util.function.Predicate;
|
||||||
|
|
||||||
|
import com.google.common.collect.ImmutableSet;
|
||||||
|
import org.apache.solr.common.SolrException;
|
||||||
|
import org.apache.solr.common.params.CollectionParams;
|
||||||
|
import org.apache.solr.common.util.Utils;
|
||||||
|
import org.apache.solr.util.CommandOperation;
|
||||||
|
import org.slf4j.Logger;
|
||||||
|
import org.slf4j.LoggerFactory;
|
||||||
|
|
||||||
|
import static org.apache.solr.handler.admin.SecurityConfHandler.getMapValue;
|
||||||
|
import static org.apache.solr.common.params.CommonParams.NAME;
|
||||||
|
import static org.apache.solr.common.util.Utils.getDeepCopy;
|
||||||
|
|
||||||
|
|
||||||
|
public class RuleBasedAuthorizationPlugin implements AuthorizationPlugin, ConfigEditablePlugin {
|
||||||
|
static final Logger log = LoggerFactory.getLogger(RuleBasedAuthorizationPlugin.class);
|
||||||
|
|
||||||
|
private final Map<String, Set<String>> usersVsRoles = new HashMap<>();
|
||||||
|
private final Map<String, WildCardSupportMap> mapping = new HashMap<>();
|
||||||
|
private final List<Permission> permissions = new ArrayList<>();
|
||||||
|
|
||||||
|
|
||||||
|
private static class WildCardSupportMap extends HashMap<String, List<Permission>> {
|
||||||
|
final Set<String> wildcardPrefixes = new HashSet<>();
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public List<Permission> put(String key, List<Permission> value) {
|
||||||
|
if (key != null && key.endsWith("/*")) {
|
||||||
|
key = key.substring(0, key.length() - 2);
|
||||||
|
wildcardPrefixes.add(key);
|
||||||
|
}
|
||||||
|
return super.put(key, value);
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public List<Permission> get(Object key) {
|
||||||
|
List<Permission> result = super.get(key);
|
||||||
|
if (key == null || result != null) return result;
|
||||||
|
if (!wildcardPrefixes.isEmpty()) {
|
||||||
|
for (String s : wildcardPrefixes) {
|
||||||
|
if (key.toString().startsWith(s)) {
|
||||||
|
List<Permission> l = super.get(s);
|
||||||
|
if (l != null) {
|
||||||
|
result = result == null ? new ArrayList<>() : new ArrayList<>(result);
|
||||||
|
result.addAll(l);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public AuthorizationResponse authorize(AuthorizationContext context) {
|
||||||
|
List<AuthorizationContext.CollectionRequest> collectionRequests = context.getCollectionRequests();
|
||||||
|
if (collectionRequests != null) {
|
||||||
|
for (AuthorizationContext.CollectionRequest collreq : collectionRequests) {
|
||||||
|
//check permissions for each collection
|
||||||
|
MatchStatus flag = checkCollPerm(mapping.get(collreq.collectionName), context);
|
||||||
|
if (flag != MatchStatus.NO_PERMISSIONS_FOUND) return flag.rsp;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
//check global permissions.
|
||||||
|
MatchStatus flag = checkCollPerm(mapping.get(null), context);
|
||||||
|
return flag.rsp;
|
||||||
|
}
|
||||||
|
|
||||||
|
private MatchStatus checkCollPerm(Map<String, List<Permission>> pathVsPerms,
|
||||||
|
AuthorizationContext context) {
|
||||||
|
if (pathVsPerms == null) return MatchStatus.NO_PERMISSIONS_FOUND;
|
||||||
|
|
||||||
|
String path = context.getResource();
|
||||||
|
MatchStatus flag = checkPathPerm(pathVsPerms.get(path), context);
|
||||||
|
if (flag != MatchStatus.NO_PERMISSIONS_FOUND) return flag;
|
||||||
|
return checkPathPerm(pathVsPerms.get(null), context);
|
||||||
|
}
|
||||||
|
|
||||||
|
private MatchStatus checkPathPerm(List<Permission> permissions, AuthorizationContext context) {
|
||||||
|
if (permissions == null || permissions.isEmpty()) return MatchStatus.NO_PERMISSIONS_FOUND;
|
||||||
|
Principal principal = context.getUserPrincipal();
|
||||||
|
loopPermissions:
|
||||||
|
for (int i = 0; i < permissions.size(); i++) {
|
||||||
|
Permission permission = permissions.get(i);
|
||||||
|
if (permission.method != null && !permission.method.contains(context.getHttpMethod())) {
|
||||||
|
//this permissions HTTP method does not match this rule. try other rules
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
if(permission.predicate != null){
|
||||||
|
if(!permission.predicate.test(context)) continue ;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (permission.params != null) {
|
||||||
|
for (Map.Entry<String, Object> e : permission.params.entrySet()) {
|
||||||
|
String paramVal = context.getParams().get(e.getKey());
|
||||||
|
Object val = e.getValue();
|
||||||
|
if (val instanceof List) {
|
||||||
|
if (!((List) val).contains(paramVal)) continue loopPermissions;
|
||||||
|
} else if (!Objects.equals(val, paramVal)) continue loopPermissions;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if (permission.role == null) {
|
||||||
|
//no role is assigned permission.That means everybody is allowed to access
|
||||||
|
return MatchStatus.PERMITTED;
|
||||||
|
}
|
||||||
|
if (principal == null) {
|
||||||
|
//this resource needs a principal but the request has come without
|
||||||
|
//any credential.
|
||||||
|
return MatchStatus.USER_REQUIRED;
|
||||||
|
}
|
||||||
|
|
||||||
|
for (String role : permission.role) {
|
||||||
|
Set<String> userRoles = usersVsRoles.get(principal.getName());
|
||||||
|
if (userRoles != null && userRoles.contains(role)) return MatchStatus.PERMITTED;
|
||||||
|
}
|
||||||
|
return MatchStatus.FORBIDDEN;
|
||||||
|
}
|
||||||
|
return MatchStatus.NO_PERMISSIONS_FOUND;
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public void init(Map<String, Object> initInfo) {
|
||||||
|
mapping.put(null, new WildCardSupportMap());
|
||||||
|
Map<String, Object> map = getMapValue(initInfo, "user-role");
|
||||||
|
for (Object o : map.entrySet()) {
|
||||||
|
Map.Entry e = (Map.Entry) o;
|
||||||
|
String roleName = (String) e.getKey();
|
||||||
|
usersVsRoles.put(roleName, readValueAsSet(map, roleName));
|
||||||
|
}
|
||||||
|
map = getMapValue(initInfo, "permissions");
|
||||||
|
for (Object o : map.entrySet()) {
|
||||||
|
Map.Entry e = (Map.Entry) o;
|
||||||
|
Permission p;
|
||||||
|
try {
|
||||||
|
p = Permission.load((String) e.getKey(), (Map) e.getValue());
|
||||||
|
} catch (Exception exp) {
|
||||||
|
log.error("Invalid permission ", exp);
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
permissions.add(p);
|
||||||
|
add2Mapping(p);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
private void add2Mapping(Permission permission) {
|
||||||
|
//this is to do optimized lookup of permissions for a given collection/path
|
||||||
|
for (String c : permission.collections) {
|
||||||
|
WildCardSupportMap m = mapping.get(c);
|
||||||
|
if (m == null) mapping.put(c, m = new WildCardSupportMap());
|
||||||
|
for (String path : permission.path) {
|
||||||
|
List<Permission> perms = m.get(path);
|
||||||
|
if (perms == null) m.put(path, perms = new ArrayList<>());
|
||||||
|
perms.add(permission);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* read a key value as a set. if the value is a single string ,
|
||||||
|
* return a singleton set
|
||||||
|
*
|
||||||
|
* @param m the map from which to lookup
|
||||||
|
* @param key the key with which to do lookup
|
||||||
|
*/
|
||||||
|
static Set<String> readValueAsSet(Map m, String key) {
|
||||||
|
Set<String> result = new HashSet<>();
|
||||||
|
Object val = m.get(key);
|
||||||
|
if (val == null) return null;
|
||||||
|
if (val instanceof Collection) {
|
||||||
|
Collection list = (Collection) val;
|
||||||
|
for (Object o : list) result.add(String.valueOf(o));
|
||||||
|
} else if (val instanceof String) {
|
||||||
|
result.add((String) val);
|
||||||
|
} else {
|
||||||
|
throw new RuntimeException("Bad value for : " + key);
|
||||||
|
}
|
||||||
|
return result.isEmpty() ? null : Collections.unmodifiableSet(result);
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public void close() throws IOException { }
|
||||||
|
|
||||||
|
static class Permission {
|
||||||
|
String name;
|
||||||
|
Set<String> path, role, collections, method;
|
||||||
|
Map<String, Object> params;
|
||||||
|
Predicate<AuthorizationContext> predicate;
|
||||||
|
|
||||||
|
private Permission() {
|
||||||
|
}
|
||||||
|
|
||||||
|
static Permission load(String name, Map m) {
|
||||||
|
Permission p = new Permission();
|
||||||
|
if (!m.containsKey("role")) throw new SolrException(SolrException.ErrorCode.BAD_REQUEST, "role not specified");
|
||||||
|
p.role = readValueAsSet(m, "role");
|
||||||
|
if (well_known_permissions.containsKey(name)) {
|
||||||
|
HashSet<String> disAllowed = new HashSet<>(knownKeys);
|
||||||
|
disAllowed.remove("role");
|
||||||
|
for (String s : disAllowed) {
|
||||||
|
if (m.containsKey(s))
|
||||||
|
throw new SolrException(SolrException.ErrorCode.BAD_REQUEST, s + " is not a valid key for the permission : " + name);
|
||||||
|
}
|
||||||
|
p.predicate = (Predicate<AuthorizationContext>) ((Map) well_known_permissions.get(name)).get(Predicate.class.getName());
|
||||||
|
m = well_known_permissions.get(name);
|
||||||
|
}
|
||||||
|
p.name = name;
|
||||||
|
p.path = readSetSmart(name, m, "path");
|
||||||
|
p.collections = readSetSmart(name, m, "collection");
|
||||||
|
p.method = readSetSmart(name, m, "method");
|
||||||
|
p.params = (Map<String, Object>) m.get("params");
|
||||||
|
return p;
|
||||||
|
}
|
||||||
|
|
||||||
|
static final Set<String> knownKeys = ImmutableSet.of("collection", "role", "params", "path", "method");
|
||||||
|
}
|
||||||
|
|
||||||
|
enum MatchStatus {
|
||||||
|
USER_REQUIRED(AuthorizationResponse.PROMPT),
|
||||||
|
NO_PERMISSIONS_FOUND(AuthorizationResponse.OK),
|
||||||
|
PERMITTED(AuthorizationResponse.OK),
|
||||||
|
FORBIDDEN(AuthorizationResponse.FORBIDDEN);
|
||||||
|
|
||||||
|
final AuthorizationResponse rsp;
|
||||||
|
|
||||||
|
MatchStatus(AuthorizationResponse rsp) {
|
||||||
|
this.rsp = rsp;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* This checks for the defaults available other rules for the keys
|
||||||
|
*/
|
||||||
|
private static Set<String> readSetSmart(String permissionName, Map m, String key) {
|
||||||
|
Set<String> set = readValueAsSet(m, key);
|
||||||
|
if (set == null && well_known_permissions.containsKey(permissionName)) {
|
||||||
|
set = readValueAsSet((Map) well_known_permissions.get(permissionName), key);
|
||||||
|
}
|
||||||
|
if ("method".equals(key)) {
|
||||||
|
if (set != null) {
|
||||||
|
for (String s : set) if (!HTTP_METHODS.contains(s)) return null;
|
||||||
|
}
|
||||||
|
return set;
|
||||||
|
}
|
||||||
|
return set == null ? Collections.singleton(null) : set;
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public Map<String, Object> edit(Map<String, Object> latestConf, List<CommandOperation> commands) {
|
||||||
|
for (CommandOperation op : commands) {
|
||||||
|
OPERATION operation = null;
|
||||||
|
for (OPERATION o : OPERATION.values()) {
|
||||||
|
if (o.name.equals(op.name)) {
|
||||||
|
operation = o;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if (operation == null) {
|
||||||
|
op.unknownOperation();
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
latestConf = operation.edit(latestConf, op);
|
||||||
|
if (latestConf == null) return null;
|
||||||
|
|
||||||
|
}
|
||||||
|
return latestConf;
|
||||||
|
}
|
||||||
|
|
||||||
|
enum OPERATION {
|
||||||
|
SET_USER_ROLE("set-user-role") {
|
||||||
|
@Override
|
||||||
|
public Map<String, Object> edit(Map<String, Object> latestConf, CommandOperation op) {
|
||||||
|
Map<String, Object> roleMap = getMapValue(latestConf, "user-role");
|
||||||
|
Map<String, Object> map = op.getDataMap();
|
||||||
|
if (op.hasError()) return null;
|
||||||
|
for (Map.Entry<String, Object> e : map.entrySet()) {
|
||||||
|
if (e.getValue() == null) {
|
||||||
|
roleMap.remove(e.getKey());
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
if (e.getValue() instanceof String || e.getValue() instanceof List) {
|
||||||
|
roleMap.put(e.getKey(), e.getValue());
|
||||||
|
} else {
|
||||||
|
op.addError("Unexpected value ");
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return latestConf;
|
||||||
|
}
|
||||||
|
},
|
||||||
|
SET_PERMISSION("set-permission") {
|
||||||
|
@Override
|
||||||
|
public Map<String, Object> edit(Map<String, Object> latestConf, CommandOperation op) {
|
||||||
|
String name = op.getStr(NAME);
|
||||||
|
Map<String, Object> dataMap = op.getDataMap();
|
||||||
|
if (op.hasError()) return null;
|
||||||
|
dataMap = getDeepCopy(dataMap, 3);
|
||||||
|
dataMap.remove(NAME);
|
||||||
|
String before = (String) dataMap.remove("before");
|
||||||
|
for (String key : dataMap.keySet()) {
|
||||||
|
if (!Permission.knownKeys.contains(key)) op.addError("Unknown key, " + key);
|
||||||
|
}
|
||||||
|
try {
|
||||||
|
Permission.load(name, dataMap);
|
||||||
|
} catch (Exception e) {
|
||||||
|
op.addError(e.getMessage());
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
Map<String, Object> permissions = getMapValue(latestConf, "permissions");
|
||||||
|
if (before == null) {
|
||||||
|
permissions.put(name, dataMap);
|
||||||
|
} else {
|
||||||
|
Map<String, Object> permissionsCopy = new LinkedHashMap<>();
|
||||||
|
for (Map.Entry<String, Object> e : permissions.entrySet()) {
|
||||||
|
if (e.getKey().equals(before)) permissionsCopy.put(name, dataMap);
|
||||||
|
permissionsCopy.put(e.getKey(), e.getValue());
|
||||||
|
}
|
||||||
|
if (!permissionsCopy.containsKey(name)) {
|
||||||
|
op.addError("Invalid 'before' :" + before);
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
latestConf.put("permissions", permissionsCopy);
|
||||||
|
}
|
||||||
|
|
||||||
|
return latestConf;
|
||||||
|
}
|
||||||
|
},
|
||||||
|
DELETE_PERMISSION("delete-permission") {
|
||||||
|
@Override
|
||||||
|
public Map<String, Object> edit(Map<String, Object> latestConf, CommandOperation op) {
|
||||||
|
List<String> names = op.getStrs("");
|
||||||
|
if (names == null || names.isEmpty()) {
|
||||||
|
op.addError("Invalid command");
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
Map<String, Object> p = getMapValue(latestConf, "permissions");
|
||||||
|
for (String s : names) {
|
||||||
|
if (p.remove(s) == null) {
|
||||||
|
op.addError("Unknown permission : " + s);
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return latestConf;
|
||||||
|
}
|
||||||
|
};
|
||||||
|
|
||||||
|
public abstract Map<String, Object> edit(Map<String, Object> latestConf, CommandOperation op);
|
||||||
|
|
||||||
|
public final String name;
|
||||||
|
|
||||||
|
OPERATION(String s) {
|
||||||
|
this.name = s;
|
||||||
|
}
|
||||||
|
|
||||||
|
public static OPERATION get(String name) {
|
||||||
|
for (OPERATION o : values()) if (o.name.equals(name)) return o;
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
public static final Set<String> HTTP_METHODS = ImmutableSet.of("GET", "POST", "DELETE", "PUT", "HEAD");
|
||||||
|
|
||||||
|
private static final Map<String, Map<String,Object>> well_known_permissions = (Map) Utils.fromJSONString(
|
||||||
|
" { " +
|
||||||
|
" security-edit :{" +
|
||||||
|
" path:['/admin/authentication','/admin/authorization']," +
|
||||||
|
" method:POST }," +
|
||||||
|
" security-read :{" +
|
||||||
|
" path:['/admin/authentication','/admin/authorization']," +
|
||||||
|
" method:GET }," +
|
||||||
|
" schema-edit :{" +
|
||||||
|
" method:POST," +
|
||||||
|
" path:'/schema/*'}," +
|
||||||
|
" collection-admin-edit :{" +
|
||||||
|
" path:'/admin/collections'}," +
|
||||||
|
" collection-admin-read :{" +
|
||||||
|
" path:'/admin/collections'}," +
|
||||||
|
" schema-read :{" +
|
||||||
|
" method:GET," +
|
||||||
|
" path:'/schema/*'}," +
|
||||||
|
" config-read :{" +
|
||||||
|
" method:GET," +
|
||||||
|
" path:'/config/*'}," +
|
||||||
|
" update :{" +
|
||||||
|
" path:'/update/*'}," +
|
||||||
|
" read :{" +
|
||||||
|
" path:['/update/*', '/get']}," +
|
||||||
|
" config-edit:{" +
|
||||||
|
" method:POST," +
|
||||||
|
" path:'/config/*'}}");
|
||||||
|
|
||||||
|
static {
|
||||||
|
((Map) well_known_permissions.get("collection-admin-edit")).put(Predicate.class.getName(), getPredicate(true));
|
||||||
|
((Map) well_known_permissions.get("collection-admin-read")).put(Predicate.class.getName(), getPredicate(false));
|
||||||
|
}
|
||||||
|
|
||||||
|
private static Predicate<AuthorizationContext> getPredicate(final boolean isEdit) {
|
||||||
|
return new Predicate<AuthorizationContext>() {
|
||||||
|
@Override
|
||||||
|
public boolean test(AuthorizationContext context) {
|
||||||
|
String action = context.getParams().get("action");
|
||||||
|
if (action == null) return false;
|
||||||
|
CollectionParams.CollectionAction collectionAction = CollectionParams.CollectionAction.get(action);
|
||||||
|
if (collectionAction == null) return false;
|
||||||
|
return isEdit ? collectionAction.isWrite : !collectionAction.isWrite;
|
||||||
|
}
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
public static void main(String[] args) {
|
||||||
|
System.out.println(Utils.toJSONString(well_known_permissions));
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,183 @@
|
||||||
|
package org.apache.solr.security;
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Licensed to the Apache Software Foundation (ASF) under one or more
|
||||||
|
* contributor license agreements. See the NOTICE file distributed with
|
||||||
|
* this work for additional information regarding copyright ownership.
|
||||||
|
* The ASF licenses this file to You under the Apache License, Version 2.0
|
||||||
|
* (the "License"); you may not use this file except in compliance with
|
||||||
|
* the License. You may obtain a copy of the License at
|
||||||
|
*
|
||||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
*
|
||||||
|
* Unless required by applicable law or agreed to in writing, software
|
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
* See the License for the specific language governing permissions and
|
||||||
|
* limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
import java.nio.charset.StandardCharsets;
|
||||||
|
import java.security.Principal;
|
||||||
|
import java.util.Collections;
|
||||||
|
import java.util.Enumeration;
|
||||||
|
import java.util.List;
|
||||||
|
import java.util.Map;
|
||||||
|
|
||||||
|
import org.apache.http.auth.BasicUserPrincipal;
|
||||||
|
import org.apache.solr.SolrTestCaseJ4;
|
||||||
|
import org.apache.solr.common.params.MapSolrParams;
|
||||||
|
import org.apache.solr.common.params.SolrParams;
|
||||||
|
import org.apache.solr.common.util.Utils;
|
||||||
|
|
||||||
|
public class TestRuleBasedAuthorizationPlugin extends SolrTestCaseJ4 {
|
||||||
|
|
||||||
|
public void testBasicPermissions() {
|
||||||
|
int STATUS_OK = 200;
|
||||||
|
int FORBIDDEN = 403;
|
||||||
|
int PROMPT_FOR_CREDENTIALS = 401;
|
||||||
|
|
||||||
|
String jsonRules= "{" +
|
||||||
|
" user-role : {" +
|
||||||
|
" steve: [dev,user]," +
|
||||||
|
" tim: [dev,admin]," +
|
||||||
|
" joe: [user]," +
|
||||||
|
" noble:[dev,user]" +
|
||||||
|
" }," +
|
||||||
|
" permissions : {" +
|
||||||
|
" schema-edit :{" +
|
||||||
|
" role:admin" +
|
||||||
|
" }," +
|
||||||
|
" collection-admin-read :{" +
|
||||||
|
" role:null" +
|
||||||
|
" }," +
|
||||||
|
" collection-admin-edit :{" +
|
||||||
|
" role:admin" +
|
||||||
|
" }," +
|
||||||
|
" mycoll_update: {" +
|
||||||
|
" collection:mycoll," +
|
||||||
|
" path:'/update/*'," +
|
||||||
|
" role:[dev,admin]" +
|
||||||
|
" }}}" ;
|
||||||
|
Map initConfig = (Map) Utils.fromJSON(jsonRules.getBytes(StandardCharsets.UTF_8));
|
||||||
|
|
||||||
|
RuleBasedAuthorizationPlugin plugin= new RuleBasedAuthorizationPlugin();
|
||||||
|
plugin.init(initConfig);
|
||||||
|
|
||||||
|
Map<String, Object> values = Utils.makeMap(
|
||||||
|
"resource", "/update/json/docs",
|
||||||
|
"httpMethod", "POST",
|
||||||
|
"collectionRequests", Collections.singletonList(new AuthorizationContext.CollectionRequest("mycoll")),
|
||||||
|
"userPrincipal", new BasicUserPrincipal("tim"));
|
||||||
|
AuthorizationContext context = new MockAuthorizationContext(values);
|
||||||
|
|
||||||
|
AuthorizationResponse authResp = plugin.authorize(context);
|
||||||
|
assertEquals(STATUS_OK, authResp.statusCode);
|
||||||
|
|
||||||
|
values.remove("userPrincipal");
|
||||||
|
authResp = plugin.authorize(context);
|
||||||
|
assertEquals(PROMPT_FOR_CREDENTIALS,authResp.statusCode);
|
||||||
|
|
||||||
|
values.put("userPrincipal", new BasicUserPrincipal("somebody"));
|
||||||
|
authResp = plugin.authorize(context);
|
||||||
|
assertEquals(FORBIDDEN,authResp.statusCode);
|
||||||
|
|
||||||
|
values.put("httpMethod","GET");
|
||||||
|
values.put("resource","/schema");
|
||||||
|
authResp = plugin.authorize(context);
|
||||||
|
assertEquals(STATUS_OK,authResp.statusCode);
|
||||||
|
|
||||||
|
values.put("resource","/schema/fields");
|
||||||
|
authResp = plugin.authorize(context);
|
||||||
|
assertEquals(STATUS_OK,authResp.statusCode);
|
||||||
|
|
||||||
|
values.put("resource","/schema");
|
||||||
|
values.put("httpMethod","POST");
|
||||||
|
authResp = plugin.authorize(context);
|
||||||
|
assertEquals(FORBIDDEN,authResp.statusCode);
|
||||||
|
|
||||||
|
values.put("resource","/admin/collections");
|
||||||
|
values.put("params", new MapSolrParams(Collections.singletonMap("action", "LIST")));
|
||||||
|
values.put("httpMethod","GET");
|
||||||
|
authResp = plugin.authorize(context);
|
||||||
|
assertEquals(STATUS_OK,authResp.statusCode);
|
||||||
|
|
||||||
|
values.remove("userPrincipal");
|
||||||
|
authResp = plugin.authorize(context);
|
||||||
|
assertEquals(STATUS_OK,authResp.statusCode);
|
||||||
|
|
||||||
|
values.put("params", new MapSolrParams(Collections.singletonMap("action", "CREATE")));
|
||||||
|
authResp = plugin.authorize(context);
|
||||||
|
assertEquals(PROMPT_FOR_CREDENTIALS, authResp.statusCode);
|
||||||
|
|
||||||
|
values.put("userPrincipal", new BasicUserPrincipal("somebody"));
|
||||||
|
authResp = plugin.authorize(context);
|
||||||
|
assertEquals(FORBIDDEN,authResp.statusCode);
|
||||||
|
|
||||||
|
values.put("userPrincipal", new BasicUserPrincipal("tim"));
|
||||||
|
authResp = plugin.authorize(context);
|
||||||
|
assertEquals(STATUS_OK,authResp.statusCode);
|
||||||
|
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
private static class MockAuthorizationContext extends AuthorizationContext {
|
||||||
|
private final Map<String,Object> values;
|
||||||
|
|
||||||
|
private MockAuthorizationContext(Map<String, Object> values) {
|
||||||
|
this.values = values;
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public SolrParams getParams() {
|
||||||
|
return (SolrParams) values.get("params");
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public Principal getUserPrincipal() {
|
||||||
|
return (Principal) values.get("userPrincipal");
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public String getHttpHeader(String header) {
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public Enumeration getHeaderNames() {
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public String getRemoteAddr() {
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public String getRemoteHost() {
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public List<CollectionRequest> getCollectionRequests() {
|
||||||
|
return (List<CollectionRequest>) values.get("collectionRequests");
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public RequestType getRequestType() {
|
||||||
|
return (RequestType) values.get("requestType");
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public String getHttpMethod() {
|
||||||
|
return (String) values.get("httpMethod");
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public String getResource() {
|
||||||
|
return (String) values.get("resource");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue