Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Druid authentication/authorization on router's side #73

Open
wants to merge 7 commits into
base: 0.12.1-mmx
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,8 @@

/**
* Basic authentication storage/cache/resource handler config.
* The config is an option to specify classes of user/role managers, caches and notifiers.
* If a config field is specified then the corresponding class is instantiated
* BasicAuthClassCompositionConfig provides options to specify authenticator/authorizer classes.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I intended that "of user/role managers, caches and notifiers" is retained - please fix the upstream PR.

* If a field in this class is non-null then the corresponding class is instantiated
* regardless of what type of Druid component runs it (see {@link BasicSecurityDruidModule}).
* Hence every Druid component might be a user/role manager and notify others by sending notifications.
* Every field must be a valid class name (appropriate for the corresponding goal) or null.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -219,7 +219,7 @@ public List<? extends Module> getJacksonModules()
public static <T> T getInstance(
Injector injector,
String configClassName,
Class<? extends T> isCoordClass,
Class<? extends T> classRunByCoordinator,
Class<? extends T> defaultClass
) throws ClassNotFoundException
{
Expand All @@ -229,8 +229,8 @@ public static <T> T getInstance(
final T instance = (T) injector.getInstance(Class.forName(configClassName));

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we exposing too much internals in configs propagating the class names for each sub-component. In fact, we would like a switch like ...authorization.management.enabled=true/false which can effectively select required classes for us.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will require refactoring current DI of the module

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That works for testing, but it's awkward for production.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agree, this might be improved

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's add it to the issue we create for #73 (comment)

return instance;
}
if (isCoordClass != null && isCoordinator(injector)) {
return injector.getInstance(isCoordClass);
if (classRunByCoordinator != null && isCoordinator(injector)) {
return injector.getInstance(classRunByCoordinator);
}
if (defaultClass != null) {
return injector.getInstance(defaultClass);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@

/**
* Noop basic authenticator cache notifier.
* No notification is sent on user udpate.
* Might be used as a config option to override default authenticator cache notifier.
*/
public class NoopBasicAuthenticatorCacheNotifier implements BasicAuthenticatorCacheNotifier

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why this class is needed? It's not used in this PR.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is needed on a config level
https://github.com/metamx/druid-config/pull/99

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would be nice to specify whether "noop" means "no auth" or "always rejecting auth".

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@

/**
* Noop basic authorizer cache notifier.
* No notification is sent on user/role udpate.
* Might be used as a config option to override default authorizer cache notifier.
*/
public class NoopBasicAuthorizerCacheNotifier implements BasicAuthorizerCacheNotifier

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I also removed the same classes from test scope so this class is used in tests now

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same

Expand Down