Repository: kylin
Updated Branches:
  refs/heads/ranger 312810744 -> 5aa9837de


KYLIN-2703 Refactor ExternalAclProvider for ranger


Project: http://git-wip-us.apache.org/repos/asf/kylin/repo
Commit: http://git-wip-us.apache.org/repos/asf/kylin/commit/5aa9837d
Tree: http://git-wip-us.apache.org/repos/asf/kylin/tree/5aa9837d
Diff: http://git-wip-us.apache.org/repos/asf/kylin/diff/5aa9837d

Branch: refs/heads/ranger
Commit: 5aa9837dec11d9b4db29d20df9c704a85c58a68a
Parents: 3128107
Author: Li Yang <[email protected]>
Authored: Fri Sep 8 21:43:41 2017 +0800
Committer: Li Yang <[email protected]>
Committed: Fri Sep 8 21:43:41 2017 +0800

----------------------------------------------------------------------
 .../apache/kylin/common/KylinConfigBase.java    | 15 +---
 .../security/KylinAuthorizationProvider.java    | 47 ----------
 .../kylin/metadata/project/ProjectManager.java  |  9 --
 .../apache/kylin/rest/constant/Constant.java    |  6 --
 .../kylin/rest/controller/AccessController.java | 25 ++++--
 .../kylin/rest/security/AclEntityType.java      |  1 -
 .../kylin/rest/security/AclPermission.java      |  2 -
 .../rest/security/ExternalAclProvider.java      | 78 +++++++++++++++++
 .../security/ExternalAuthorizationProvider.java | 92 --------------------
 .../security/KylinAclPermissionEvaluator.java   | 91 ++++++-------------
 .../kylin/rest/security/KylinAuthorization.java | 35 --------
 .../apache/kylin/rest/service/JobService.java   |  2 -
 webapp/app/js/services/kylinProperties.js       | 10 +--
 13 files changed, 131 insertions(+), 282 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java
----------------------------------------------------------------------
diff --git 
a/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java 
b/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java
index 46bcfdb..5c2e743 100644
--- a/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java
+++ b/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java
@@ -1178,6 +1178,10 @@ abstract public class KylinConfigBase implements 
Serializable {
     public int getServerUserCacheMaxEntries() {
         return 
Integer.valueOf(this.getOptional("kylin.server.auth-user-cache.max-entries", 
"100"));
     }
+    
+    public String getExternalAclProvider() {
+        return getOptional("kylin.server.external-acl-provider", "");
+    }
 
     // 
============================================================================
     // WEB
@@ -1211,15 +1215,4 @@ abstract public class KylinConfigBase implements 
Serializable {
         return getOptional("kylin.metric.perf-logger.class", 
"org.apache.kylin.common.metrics.perflog.PerfLogger");
     }
 
-    public String getAuthorizationProvider() {
-        if (isRangerAclEnabled()) {
-            return getOptional("kylin.authorization.provider", 
"org.apache.kylin.rest.security.KylinAuthorization");
-        } else {
-            return "org.apache.kylin.rest.security.KylinAuthorization";
-        }
-    }
-
-    public boolean isRangerAclEnabled() {
-        return 
Boolean.parseBoolean(getOptional("kylin.authorization.ranger-acl-enabled", 
"false"));
-    }
 }

http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/core-common/src/main/java/org/apache/kylin/common/security/KylinAuthorizationProvider.java
----------------------------------------------------------------------
diff --git 
a/core-common/src/main/java/org/apache/kylin/common/security/KylinAuthorizationProvider.java
 
b/core-common/src/main/java/org/apache/kylin/common/security/KylinAuthorizationProvider.java
deleted file mode 100644
index 3bb08e8..0000000
--- 
a/core-common/src/main/java/org/apache/kylin/common/security/KylinAuthorizationProvider.java
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- * 
- *     http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
-*/
-
-package org.apache.kylin.common.security;
-
-import java.util.List;
-
-import org.apache.kylin.common.KylinConfig;
-import org.apache.kylin.common.util.ClassUtil;
-
-public abstract class KylinAuthorizationProvider {
-
-    private static KylinAuthorizationProvider authorizer;
-
-    public static KylinAuthorizationProvider getInstance(KylinConfig config) {
-
-        synchronized (KylinAuthorizationProvider.class) {
-            if (authorizer != null) {
-                return authorizer;
-            }
-
-            authorizer = (KylinAuthorizationProvider) 
ClassUtil.newInstance(config.getAuthorizationProvider());
-            authorizer.init();
-
-            return authorizer;
-        }
-    }
-
-    public abstract void init();
-
-    public abstract boolean checkPermission(String projectName, String 
cubeName, String user, List<String> userAuthorities, String permissions);
-}

http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java
----------------------------------------------------------------------
diff --git 
a/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java
 
b/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java
index baf3295..df5450c 100644
--- 
a/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java
+++ 
b/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java
@@ -447,15 +447,6 @@ public class ProjectManager {
         return projects;
     }
 
-    public ProjectInstance getProjectByUuid(String uuid) {
-        Collection<ProjectInstance> copy = new 
ArrayList<ProjectInstance>(projectMap.values());
-        for (ProjectInstance project : copy) {
-            if (uuid.equals(project.getUuid()))
-                return project;
-        }
-        return null;
-    }
-
     public ExternalFilterDesc getExternalFilterDesc(String project, String 
extFilter) {
         return l2Cache.getExternalFilterDesc(project, extFilter);
     }

http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java
----------------------------------------------------------------------
diff --git 
a/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java 
b/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java
index 4e320e8..05adef1 100644
--- a/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java
+++ b/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java
@@ -47,10 +47,4 @@ public class Constant {
     public final static String SERVER_MODE_QUERY = "query";
     public final static String SERVER_MODE_JOB = "job";
     public final static String SERVER_MODE_ALL = "all";
-
-    public final static String CUBE_ADMIN = "CUBE ADMIN";
-    public final static String CUBE_EDIT = "CUBE EDIT";
-    public final static String CUBE_OPERATION = "CUBE OPERATION";
-    public final static String CUBE_QUERY = "CUBE QUERY";
-
 }

http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java
----------------------------------------------------------------------
diff --git 
a/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java
 
b/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java
index ef36828..81153c2 100644
--- 
a/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java
+++ 
b/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java
@@ -19,18 +19,20 @@
 package org.apache.kylin.rest.controller;
 
 import java.io.IOException;
+import java.util.ArrayList;
 import java.util.List;
 
-import org.apache.kylin.common.KylinConfig;
 import org.apache.kylin.common.persistence.AclEntity;
+import org.apache.kylin.common.util.Pair;
 import org.apache.kylin.rest.request.AccessRequest;
 import org.apache.kylin.rest.response.AccessEntryResponse;
-import org.apache.kylin.rest.security.AclEntityType;
+import org.apache.kylin.rest.security.AclPermission;
 import org.apache.kylin.rest.security.AclPermissionFactory;
-import org.apache.kylin.rest.security.ExternalAuthorizationProvider;
+import org.apache.kylin.rest.security.ExternalAclProvider;
 import org.apache.kylin.rest.service.AccessService;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.security.acls.domain.PrincipalSid;
 import org.springframework.security.acls.model.Acl;
 import org.springframework.security.acls.model.Permission;
 import org.springframework.security.acls.model.Sid;
@@ -53,9 +55,6 @@ public class AccessController extends BasicController {
     @Qualifier("accessService")
     private AccessService accessService;
 
-    @Autowired
-    private ExternalAuthorizationProvider externalAuthorizationProvider;
-
     /**
      * Get access entry list of a domain object
      * 
@@ -66,8 +65,18 @@ public class AccessController extends BasicController {
     @RequestMapping(value = "/{type}/{uuid}", method = { RequestMethod.GET }, 
produces = { "application/json" })
     @ResponseBody
     public List<AccessEntryResponse> getAccessEntities(@PathVariable String 
type, @PathVariable String uuid) {
-        if (KylinConfig.getInstanceFromEnv().isRangerAclEnabled() && 
(AclEntityType.PROJECT_INSTANCE.equals(type) || 
AclEntityType.CUBE_INSTANCE.equals(type))) {
-            return externalAuthorizationProvider.getAcl(type, uuid);
+        ExternalAclProvider eap = ExternalAclProvider.getInstance();
+        
+        if (eap != null) {
+            List<AccessEntryResponse> ret = new ArrayList<>();
+            List<Pair<String, AclPermission>> acl = eap.getAcl(type, uuid);
+            if (acl != null) {
+                for (Pair<String, AclPermission> p : acl) {
+                    PrincipalSid sid = new PrincipalSid(p.getFirst());
+                    ret.add(new AccessEntryResponse(null, sid, p.getSecond(), 
true));
+                }
+            }
+            return ret;
         } else {
             AclEntity ae = accessService.getAclEntity(type, uuid);
             Acl acl = accessService.getAcl(ae);

http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/server-base/src/main/java/org/apache/kylin/rest/security/AclEntityType.java
----------------------------------------------------------------------
diff --git 
a/server-base/src/main/java/org/apache/kylin/rest/security/AclEntityType.java 
b/server-base/src/main/java/org/apache/kylin/rest/security/AclEntityType.java
index 69965f8..62ba5da 100644
--- 
a/server-base/src/main/java/org/apache/kylin/rest/security/AclEntityType.java
+++ 
b/server-base/src/main/java/org/apache/kylin/rest/security/AclEntityType.java
@@ -18,7 +18,6 @@
 package org.apache.kylin.rest.security;
 
 /**
- * Created by xiefan on 17-4-14.
  */
 public interface AclEntityType {
     static final String CUBE_INSTANCE = "CubeInstance";

http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/server-base/src/main/java/org/apache/kylin/rest/security/AclPermission.java
----------------------------------------------------------------------
diff --git 
a/server-base/src/main/java/org/apache/kylin/rest/security/AclPermission.java 
b/server-base/src/main/java/org/apache/kylin/rest/security/AclPermission.java
index 4e2e182..7d493d1 100644
--- 
a/server-base/src/main/java/org/apache/kylin/rest/security/AclPermission.java
+++ 
b/server-base/src/main/java/org/apache/kylin/rest/security/AclPermission.java
@@ -22,8 +22,6 @@ import 
org.springframework.security.acls.domain.BasePermission;
 import org.springframework.security.acls.model.Permission;
 
 /**
- * @author xduo
- * 
  */
 public class AclPermission extends BasePermission {
 

http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAclProvider.java
----------------------------------------------------------------------
diff --git 
a/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAclProvider.java
 
b/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAclProvider.java
new file mode 100644
index 0000000..b748c27
--- /dev/null
+++ 
b/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAclProvider.java
@@ -0,0 +1,78 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+*/
+package org.apache.kylin.rest.security;
+
+import java.util.List;
+
+import org.apache.kylin.common.KylinConfig;
+import org.apache.kylin.common.util.ClassUtil;
+import org.apache.kylin.common.util.Pair;
+
+/**
+ */
+abstract public class ExternalAclProvider {
+
+    private static boolean inited = false;
+    private static ExternalAclProvider singleton = null;
+
+    public static ExternalAclProvider getInstance() {
+        if (inited)
+            return singleton;
+
+        synchronized (ExternalAclProvider.class) {
+            if (inited)
+                return singleton;
+
+            String cls = 
KylinConfig.getInstanceFromEnv().getExternalAclProvider();
+            if (cls != null && cls.length() > 0) {
+                singleton = (ExternalAclProvider) ClassUtil.newInstance(cls);
+                singleton.init();
+            }
+
+            inited = true;
+            return singleton;
+        }
+    }
+
+    // 
============================================================================
+
+    abstract public void init();
+
+    /**
+     * Checks if a user has permission on an entity.
+     * @param user
+     * @param userRoles
+     * @param entityType String constants defined in AclEntityType 
+     * @param entityUuid
+     * @param permission
+     * 
+     * @return true if has permission
+     */
+    abstract public boolean checkPermission(String user, List<String> 
userRoles, //
+            String entityType, String entityUuid, AclPermission permission);
+
+    /**
+     * Returns all granted permissions on specified entity.
+     * 
+     * @param entityType String constants defined in AclEntityType
+     * @param entityUuid
+     * @return a list of (user/role, permission)
+     */
+    abstract public List<Pair<String, AclPermission>> getAcl(String 
entityType, String entityUuid);
+
+}

http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAuthorizationProvider.java
----------------------------------------------------------------------
diff --git 
a/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAuthorizationProvider.java
 
b/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAuthorizationProvider.java
deleted file mode 100644
index 73f4752..0000000
--- 
a/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAuthorizationProvider.java
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- * 
- *     http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
-*/
-
-package org.apache.kylin.rest.security;
-
-import java.util.ArrayList;
-import java.util.List;
-
-import org.apache.kylin.common.KylinConfig;
-import org.apache.kylin.common.persistence.AclEntity;
-import org.apache.kylin.cube.CubeManager;
-import org.apache.kylin.metadata.project.ProjectManager;
-import org.apache.kylin.rest.constant.Constant;
-import org.apache.kylin.rest.response.AccessEntryResponse;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.security.acls.domain.PrincipalSid;
-import org.springframework.security.acls.model.Permission;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.stereotype.Component;
-
-@Component("externalAuthorizationProvider")
-public class ExternalAuthorizationProvider {
-
-    @Autowired
-    private KylinAclPermissionEvaluator kylinAclPermissionEvaluator;
-
-    private final Permission[] allPermissions = { 
AclPermission.ADMINISTRATION, AclPermission.MANAGEMENT, 
AclPermission.OPERATION, AclPermission.READ };
-
-    public List<AccessEntryResponse> getAcl(String type, String uuid) {
-        List<AccessEntryResponse> result = new 
ArrayList<AccessEntryResponse>();
-        if (uuid == null) {
-            return result;
-        }
-
-        AclEntity ae = null;
-        KylinConfig config = KylinConfig.getInstanceFromEnv();
-        if (type.equals(AclEntityType.PROJECT_INSTANCE)) {
-            ae = ProjectManager.getInstance(config).getProjectByUuid(uuid);
-        } else if (type.equals(AclEntityType.CUBE_INSTANCE)) {
-            ae = CubeManager.getInstance(config).getCubeByUuid(uuid);
-        }
-
-        if (ae != null) {
-            Authentication authentication = 
SecurityContextHolder.getContext().getAuthentication();
-            Sid sid = new PrincipalSid(authentication.getName());
-            for (Permission permission : allPermissions) {
-                if (kylinAclPermissionEvaluator.hasPermission(authentication, 
ae, permission)) {
-                    String permString =  
kylinAclPermissionEvaluator.transformPermission(permission);
-                    result = generateAceResponses(permString, sid);
-                    break;
-                }
-            }
-        }
-
-        return result;
-    }
-
-    private List<AccessEntryResponse> generateAceResponses(String permission, 
Sid sid) {
-        List<AccessEntryResponse> result = new 
ArrayList<AccessEntryResponse>();
-        switch (permission) {
-        case Constant.CUBE_ADMIN:
-            result.add(new AccessEntryResponse(null, sid, 
AclPermission.ADMINISTRATION, true));
-        case Constant.CUBE_EDIT:
-            result.add(new AccessEntryResponse(null, sid, 
AclPermission.MANAGEMENT, true));
-        case Constant.CUBE_OPERATION:
-            result.add(new AccessEntryResponse(null, sid, 
AclPermission.OPERATION, true));
-        case Constant.CUBE_QUERY:
-            result.add(new AccessEntryResponse(null, sid, AclPermission.READ, 
true));
-        default:
-            break;
-        }
-        return result;
-    }
-
-}

http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/server-base/src/main/java/org/apache/kylin/rest/security/KylinAclPermissionEvaluator.java
----------------------------------------------------------------------
diff --git 
a/server-base/src/main/java/org/apache/kylin/rest/security/KylinAclPermissionEvaluator.java
 
b/server-base/src/main/java/org/apache/kylin/rest/security/KylinAclPermissionEvaluator.java
index 25d1976..1cdd511 100644
--- 
a/server-base/src/main/java/org/apache/kylin/rest/security/KylinAclPermissionEvaluator.java
+++ 
b/server-base/src/main/java/org/apache/kylin/rest/security/KylinAclPermissionEvaluator.java
@@ -23,14 +23,7 @@ import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
 
-import org.apache.commons.collections.CollectionUtils;
-import org.apache.kylin.common.KylinConfig;
-import org.apache.kylin.common.security.KylinAuthorizationProvider;
-import org.apache.kylin.cube.CubeInstance;
-import org.apache.kylin.metadata.project.ProjectInstance;
-import org.apache.kylin.metadata.project.ProjectManager;
-import org.apache.kylin.metadata.realization.RealizationType;
-import org.apache.kylin.rest.constant.Constant;
+import org.apache.kylin.common.persistence.AclEntity;
 import org.apache.kylin.rest.service.AclService;
 import org.springframework.security.acls.AclPermissionEvaluator;
 import org.springframework.security.acls.domain.PermissionFactory;
@@ -50,86 +43,52 @@ public class KylinAclPermissionEvaluator extends 
AclPermissionEvaluator {
 
     @Override
     public boolean hasPermission(Authentication authentication, Object 
targetDomainObject, Object permission) {
+        ExternalAclProvider eap = ExternalAclProvider.getInstance();
+        if (eap == null)
+            return super.hasPermission(authentication, targetDomainObject, 
permission);
+
         if (targetDomainObject == null) {
             return false;
         }
 
-        KylinConfig kylinConfig= KylinConfig.getInstanceFromEnv();
-        if (kylinConfig.isRangerAclEnabled()) {
-            String projectName = null;
-            String cubeName = null;
-            String owner = null;
-            String currentUser = authentication.getName();
-
-            if (targetDomainObject instanceof ProjectInstance) {
-                ProjectInstance projectInstance = (ProjectInstance) 
targetDomainObject;
-                projectName = projectInstance.getName();
-                owner = projectInstance.getOwner();
-            } else if (targetDomainObject instanceof CubeInstance) {
-                CubeInstance cubeInstance = (CubeInstance) targetDomainObject;
-                cubeName = cubeInstance.getName();
-                owner = cubeInstance.getOwner();
-
-                List<ProjectInstance> relatedProjectInstances = 
ProjectManager.getInstance(kylinConfig).findProjects(RealizationType.CUBE, 
cubeName);
-                if (!CollectionUtils.isEmpty(relatedProjectInstances)) {
-                    projectName = relatedProjectInstances.get(0).getName();
-                }
-            } else {
-                return super.hasPermission(authentication, targetDomainObject, 
permission);
-            }
+        AclEntity e = (AclEntity) targetDomainObject;
+        return checkExternalPermission(eap, authentication, 
e.getClass().getSimpleName(), e.getId(), permission);
+    }
 
-            if (owner != null && owner.equalsIgnoreCase(currentUser)) {
-                return true;
-            }
+    private boolean checkExternalPermission(ExternalAclProvider eap, 
Authentication authentication, String entityType,
+            String entityUuid, Object permission) {
 
-            List<Permission> permissions = resolveKylinPermission(permission);
-            List<String> authorities = getAuthorities(authentication);
-            for (Permission p : permissions) {
-                String permString = transformPermission(p);
-                if 
(KylinAuthorizationProvider.getInstance(kylinConfig).checkPermission(projectName,
 cubeName, currentUser, authorities, permString)) {
-                    return true;
-                }
-            }
-            return false;
-        }
+        String currentUser = authentication.getName();
+        List<String> authorities = getAuthorities(authentication);
+        List<Permission> kylinPermissions = resolveKylinPermission(permission);
 
-        return super.hasPermission(authentication, targetDomainObject, 
permission);
-    }
-
-    public String transformPermission(Permission p) {
-        String permString = null;
-        if (p.equals(AclPermission.ADMINISTRATION)) {
-            permString = Constant.CUBE_ADMIN;
-        } else if (p.equals(AclPermission.MANAGEMENT)) {
-            permString = Constant.CUBE_EDIT;
-        } else if (p.equals(AclPermission.OPERATION)) {
-            permString = Constant.CUBE_OPERATION;
-        } else if (p.equals(AclPermission.READ)) {
-            permString = (Constant.CUBE_QUERY);
+        for (Permission p : kylinPermissions) {
+            if (eap.checkPermission(currentUser, authorities, entityType, 
entityUuid, (AclPermission) p))
+                return true;
         }
-        return permString;
+        return false;
     }
 
     private List<Permission> resolveKylinPermission(Object permission) {
         if (permission instanceof Integer) {
-            return 
Arrays.asList(kylinPermissionFactory.buildFromMask(((Integer)permission).intValue()));
+            return 
Arrays.asList(kylinPermissionFactory.buildFromMask(((Integer) 
permission).intValue()));
         }
 
         if (permission instanceof Permission) {
-            return Arrays.asList((Permission)permission);
+            return Arrays.asList((Permission) permission);
         }
 
         if (permission instanceof Permission[]) {
-            return Arrays.asList((Permission[])permission);
+            return Arrays.asList((Permission[]) permission);
         }
 
         if (permission instanceof String) {
-            String permString = (String)permission;
+            String permString = (String) permission;
             Permission p;
 
             try {
                 p = kylinPermissionFactory.buildFromName(permString);
-            } catch(IllegalArgumentException notfound) {
+            } catch (IllegalArgumentException notfound) {
                 p = 
kylinPermissionFactory.buildFromName(permString.toUpperCase());
             }
 
@@ -154,6 +113,10 @@ public class KylinAclPermissionEvaluator extends 
AclPermissionEvaluator {
     @Override
     public boolean hasPermission(Authentication authentication, Serializable 
targetId, String targetType,
             Object permission) {
-        return super.hasPermission(authentication, targetId, targetType, 
permission);
+        ExternalAclProvider eap = ExternalAclProvider.getInstance();
+        if (eap == null)
+            return super.hasPermission(authentication, targetId, targetType, 
permission);
+        
+        return checkExternalPermission(eap, authentication, targetType, 
targetId.toString(), permission);
     }
 }

http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/server-base/src/main/java/org/apache/kylin/rest/security/KylinAuthorization.java
----------------------------------------------------------------------
diff --git 
a/server-base/src/main/java/org/apache/kylin/rest/security/KylinAuthorization.java
 
b/server-base/src/main/java/org/apache/kylin/rest/security/KylinAuthorization.java
deleted file mode 100644
index e5cd761..0000000
--- 
a/server-base/src/main/java/org/apache/kylin/rest/security/KylinAuthorization.java
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
-*/
-package org.apache.kylin.rest.security;
-
-import java.util.List;
-
-import org.apache.kylin.common.security.KylinAuthorizationProvider;
-
-public class KylinAuthorization extends KylinAuthorizationProvider {
-
-    @Override
-    public void init() {
-    }
-
-    @Override
-    public boolean checkPermission(String projectName, String cubeName, String 
user, List<String> userRole, String permissions) {
-        return false;
-    }
-
-}
\ No newline at end of file

http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/server-base/src/main/java/org/apache/kylin/rest/service/JobService.java
----------------------------------------------------------------------
diff --git 
a/server-base/src/main/java/org/apache/kylin/rest/service/JobService.java 
b/server-base/src/main/java/org/apache/kylin/rest/service/JobService.java
index 7aba9a8..d2180a7 100644
--- a/server-base/src/main/java/org/apache/kylin/rest/service/JobService.java
+++ b/server-base/src/main/java/org/apache/kylin/rest/service/JobService.java
@@ -33,7 +33,6 @@ import javax.annotation.Nullable;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.directory.api.util.Strings;
 import org.apache.kylin.common.KylinConfig;
-import org.apache.kylin.common.security.KylinAuthorizationProvider;
 import org.apache.kylin.common.util.ClassUtil;
 import org.apache.kylin.cube.CubeInstance;
 import org.apache.kylin.cube.CubeSegment;
@@ -119,7 +118,6 @@ public class JobService extends BasicService implements 
InitializingBean {
                 .scheduler(kylinConfig.getSchedulerType());
 
         jobLock = (JobLock) 
ClassUtil.newInstance(kylinConfig.getJobControllerLock());
-        KylinAuthorizationProvider.getInstance(kylinConfig);
 
         new Thread(new Runnable() {
             @Override

http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/webapp/app/js/services/kylinProperties.js
----------------------------------------------------------------------
diff --git a/webapp/app/js/services/kylinProperties.js 
b/webapp/app/js/services/kylinProperties.js
index 061a290..04e5cef 100644
--- a/webapp/app/js/services/kylinProperties.js
+++ b/webapp/app/js/services/kylinProperties.js
@@ -108,11 +108,11 @@ KylinApp.service('kylinConfig', function (AdminService, 
$log) {
   }
 
   this.isRangerAclEnabled = function() {
-    var status = 
this.getProperty("kylin.authorization.ranger-acl-enabled").trim();
-       if (status === 'true') {
-         return true;
-       }
-    return false;
+    var status = this.getProperty("kylin.server.external-acl-provider").trim();
+    if (status == '') {
+      return false;
+    }
+    return true;
   }
 
 });

Reply via email to