Repository: kylin Updated Branches: refs/heads/ranger 312810744 -> 5aa9837de
KYLIN-2703 Refactor ExternalAclProvider for ranger Project: http://git-wip-us.apache.org/repos/asf/kylin/repo Commit: http://git-wip-us.apache.org/repos/asf/kylin/commit/5aa9837d Tree: http://git-wip-us.apache.org/repos/asf/kylin/tree/5aa9837d Diff: http://git-wip-us.apache.org/repos/asf/kylin/diff/5aa9837d Branch: refs/heads/ranger Commit: 5aa9837dec11d9b4db29d20df9c704a85c58a68a Parents: 3128107 Author: Li Yang <[email protected]> Authored: Fri Sep 8 21:43:41 2017 +0800 Committer: Li Yang <[email protected]> Committed: Fri Sep 8 21:43:41 2017 +0800 ---------------------------------------------------------------------- .../apache/kylin/common/KylinConfigBase.java | 15 +--- .../security/KylinAuthorizationProvider.java | 47 ---------- .../kylin/metadata/project/ProjectManager.java | 9 -- .../apache/kylin/rest/constant/Constant.java | 6 -- .../kylin/rest/controller/AccessController.java | 25 ++++-- .../kylin/rest/security/AclEntityType.java | 1 - .../kylin/rest/security/AclPermission.java | 2 - .../rest/security/ExternalAclProvider.java | 78 +++++++++++++++++ .../security/ExternalAuthorizationProvider.java | 92 -------------------- .../security/KylinAclPermissionEvaluator.java | 91 ++++++------------- .../kylin/rest/security/KylinAuthorization.java | 35 -------- .../apache/kylin/rest/service/JobService.java | 2 - webapp/app/js/services/kylinProperties.js | 10 +-- 13 files changed, 131 insertions(+), 282 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java ---------------------------------------------------------------------- diff --git a/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java b/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java index 46bcfdb..5c2e743 100644 --- a/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java +++ b/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java @@ -1178,6 +1178,10 @@ abstract public class KylinConfigBase implements Serializable { public int getServerUserCacheMaxEntries() { return Integer.valueOf(this.getOptional("kylin.server.auth-user-cache.max-entries", "100")); } + + public String getExternalAclProvider() { + return getOptional("kylin.server.external-acl-provider", ""); + } // ============================================================================ // WEB @@ -1211,15 +1215,4 @@ abstract public class KylinConfigBase implements Serializable { return getOptional("kylin.metric.perf-logger.class", "org.apache.kylin.common.metrics.perflog.PerfLogger"); } - public String getAuthorizationProvider() { - if (isRangerAclEnabled()) { - return getOptional("kylin.authorization.provider", "org.apache.kylin.rest.security.KylinAuthorization"); - } else { - return "org.apache.kylin.rest.security.KylinAuthorization"; - } - } - - public boolean isRangerAclEnabled() { - return Boolean.parseBoolean(getOptional("kylin.authorization.ranger-acl-enabled", "false")); - } } http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/core-common/src/main/java/org/apache/kylin/common/security/KylinAuthorizationProvider.java ---------------------------------------------------------------------- diff --git a/core-common/src/main/java/org/apache/kylin/common/security/KylinAuthorizationProvider.java b/core-common/src/main/java/org/apache/kylin/common/security/KylinAuthorizationProvider.java deleted file mode 100644 index 3bb08e8..0000000 --- a/core-common/src/main/java/org/apache/kylin/common/security/KylinAuthorizationProvider.java +++ /dev/null @@ -1,47 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. -*/ - -package org.apache.kylin.common.security; - -import java.util.List; - -import org.apache.kylin.common.KylinConfig; -import org.apache.kylin.common.util.ClassUtil; - -public abstract class KylinAuthorizationProvider { - - private static KylinAuthorizationProvider authorizer; - - public static KylinAuthorizationProvider getInstance(KylinConfig config) { - - synchronized (KylinAuthorizationProvider.class) { - if (authorizer != null) { - return authorizer; - } - - authorizer = (KylinAuthorizationProvider) ClassUtil.newInstance(config.getAuthorizationProvider()); - authorizer.init(); - - return authorizer; - } - } - - public abstract void init(); - - public abstract boolean checkPermission(String projectName, String cubeName, String user, List<String> userAuthorities, String permissions); -} http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java ---------------------------------------------------------------------- diff --git a/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java b/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java index baf3295..df5450c 100644 --- a/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java +++ b/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java @@ -447,15 +447,6 @@ public class ProjectManager { return projects; } - public ProjectInstance getProjectByUuid(String uuid) { - Collection<ProjectInstance> copy = new ArrayList<ProjectInstance>(projectMap.values()); - for (ProjectInstance project : copy) { - if (uuid.equals(project.getUuid())) - return project; - } - return null; - } - public ExternalFilterDesc getExternalFilterDesc(String project, String extFilter) { return l2Cache.getExternalFilterDesc(project, extFilter); } http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java ---------------------------------------------------------------------- diff --git a/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java b/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java index 4e320e8..05adef1 100644 --- a/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java +++ b/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java @@ -47,10 +47,4 @@ public class Constant { public final static String SERVER_MODE_QUERY = "query"; public final static String SERVER_MODE_JOB = "job"; public final static String SERVER_MODE_ALL = "all"; - - public final static String CUBE_ADMIN = "CUBE ADMIN"; - public final static String CUBE_EDIT = "CUBE EDIT"; - public final static String CUBE_OPERATION = "CUBE OPERATION"; - public final static String CUBE_QUERY = "CUBE QUERY"; - } http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java ---------------------------------------------------------------------- diff --git a/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java b/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java index ef36828..81153c2 100644 --- a/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java +++ b/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java @@ -19,18 +19,20 @@ package org.apache.kylin.rest.controller; import java.io.IOException; +import java.util.ArrayList; import java.util.List; -import org.apache.kylin.common.KylinConfig; import org.apache.kylin.common.persistence.AclEntity; +import org.apache.kylin.common.util.Pair; import org.apache.kylin.rest.request.AccessRequest; import org.apache.kylin.rest.response.AccessEntryResponse; -import org.apache.kylin.rest.security.AclEntityType; +import org.apache.kylin.rest.security.AclPermission; import org.apache.kylin.rest.security.AclPermissionFactory; -import org.apache.kylin.rest.security.ExternalAuthorizationProvider; +import org.apache.kylin.rest.security.ExternalAclProvider; import org.apache.kylin.rest.service.AccessService; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Qualifier; +import org.springframework.security.acls.domain.PrincipalSid; import org.springframework.security.acls.model.Acl; import org.springframework.security.acls.model.Permission; import org.springframework.security.acls.model.Sid; @@ -53,9 +55,6 @@ public class AccessController extends BasicController { @Qualifier("accessService") private AccessService accessService; - @Autowired - private ExternalAuthorizationProvider externalAuthorizationProvider; - /** * Get access entry list of a domain object * @@ -66,8 +65,18 @@ public class AccessController extends BasicController { @RequestMapping(value = "/{type}/{uuid}", method = { RequestMethod.GET }, produces = { "application/json" }) @ResponseBody public List<AccessEntryResponse> getAccessEntities(@PathVariable String type, @PathVariable String uuid) { - if (KylinConfig.getInstanceFromEnv().isRangerAclEnabled() && (AclEntityType.PROJECT_INSTANCE.equals(type) || AclEntityType.CUBE_INSTANCE.equals(type))) { - return externalAuthorizationProvider.getAcl(type, uuid); + ExternalAclProvider eap = ExternalAclProvider.getInstance(); + + if (eap != null) { + List<AccessEntryResponse> ret = new ArrayList<>(); + List<Pair<String, AclPermission>> acl = eap.getAcl(type, uuid); + if (acl != null) { + for (Pair<String, AclPermission> p : acl) { + PrincipalSid sid = new PrincipalSid(p.getFirst()); + ret.add(new AccessEntryResponse(null, sid, p.getSecond(), true)); + } + } + return ret; } else { AclEntity ae = accessService.getAclEntity(type, uuid); Acl acl = accessService.getAcl(ae); http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/server-base/src/main/java/org/apache/kylin/rest/security/AclEntityType.java ---------------------------------------------------------------------- diff --git a/server-base/src/main/java/org/apache/kylin/rest/security/AclEntityType.java b/server-base/src/main/java/org/apache/kylin/rest/security/AclEntityType.java index 69965f8..62ba5da 100644 --- a/server-base/src/main/java/org/apache/kylin/rest/security/AclEntityType.java +++ b/server-base/src/main/java/org/apache/kylin/rest/security/AclEntityType.java @@ -18,7 +18,6 @@ package org.apache.kylin.rest.security; /** - * Created by xiefan on 17-4-14. */ public interface AclEntityType { static final String CUBE_INSTANCE = "CubeInstance"; http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/server-base/src/main/java/org/apache/kylin/rest/security/AclPermission.java ---------------------------------------------------------------------- diff --git a/server-base/src/main/java/org/apache/kylin/rest/security/AclPermission.java b/server-base/src/main/java/org/apache/kylin/rest/security/AclPermission.java index 4e2e182..7d493d1 100644 --- a/server-base/src/main/java/org/apache/kylin/rest/security/AclPermission.java +++ b/server-base/src/main/java/org/apache/kylin/rest/security/AclPermission.java @@ -22,8 +22,6 @@ import org.springframework.security.acls.domain.BasePermission; import org.springframework.security.acls.model.Permission; /** - * @author xduo - * */ public class AclPermission extends BasePermission { http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAclProvider.java ---------------------------------------------------------------------- diff --git a/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAclProvider.java b/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAclProvider.java new file mode 100644 index 0000000..b748c27 --- /dev/null +++ b/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAclProvider.java @@ -0,0 +1,78 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. +*/ +package org.apache.kylin.rest.security; + +import java.util.List; + +import org.apache.kylin.common.KylinConfig; +import org.apache.kylin.common.util.ClassUtil; +import org.apache.kylin.common.util.Pair; + +/** + */ +abstract public class ExternalAclProvider { + + private static boolean inited = false; + private static ExternalAclProvider singleton = null; + + public static ExternalAclProvider getInstance() { + if (inited) + return singleton; + + synchronized (ExternalAclProvider.class) { + if (inited) + return singleton; + + String cls = KylinConfig.getInstanceFromEnv().getExternalAclProvider(); + if (cls != null && cls.length() > 0) { + singleton = (ExternalAclProvider) ClassUtil.newInstance(cls); + singleton.init(); + } + + inited = true; + return singleton; + } + } + + // ============================================================================ + + abstract public void init(); + + /** + * Checks if a user has permission on an entity. + * @param user + * @param userRoles + * @param entityType String constants defined in AclEntityType + * @param entityUuid + * @param permission + * + * @return true if has permission + */ + abstract public boolean checkPermission(String user, List<String> userRoles, // + String entityType, String entityUuid, AclPermission permission); + + /** + * Returns all granted permissions on specified entity. + * + * @param entityType String constants defined in AclEntityType + * @param entityUuid + * @return a list of (user/role, permission) + */ + abstract public List<Pair<String, AclPermission>> getAcl(String entityType, String entityUuid); + +} http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAuthorizationProvider.java ---------------------------------------------------------------------- diff --git a/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAuthorizationProvider.java b/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAuthorizationProvider.java deleted file mode 100644 index 73f4752..0000000 --- a/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAuthorizationProvider.java +++ /dev/null @@ -1,92 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. -*/ - -package org.apache.kylin.rest.security; - -import java.util.ArrayList; -import java.util.List; - -import org.apache.kylin.common.KylinConfig; -import org.apache.kylin.common.persistence.AclEntity; -import org.apache.kylin.cube.CubeManager; -import org.apache.kylin.metadata.project.ProjectManager; -import org.apache.kylin.rest.constant.Constant; -import org.apache.kylin.rest.response.AccessEntryResponse; -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.security.acls.domain.PrincipalSid; -import org.springframework.security.acls.model.Permission; -import org.springframework.security.acls.model.Sid; -import org.springframework.security.core.Authentication; -import org.springframework.security.core.context.SecurityContextHolder; -import org.springframework.stereotype.Component; - -@Component("externalAuthorizationProvider") -public class ExternalAuthorizationProvider { - - @Autowired - private KylinAclPermissionEvaluator kylinAclPermissionEvaluator; - - private final Permission[] allPermissions = { AclPermission.ADMINISTRATION, AclPermission.MANAGEMENT, AclPermission.OPERATION, AclPermission.READ }; - - public List<AccessEntryResponse> getAcl(String type, String uuid) { - List<AccessEntryResponse> result = new ArrayList<AccessEntryResponse>(); - if (uuid == null) { - return result; - } - - AclEntity ae = null; - KylinConfig config = KylinConfig.getInstanceFromEnv(); - if (type.equals(AclEntityType.PROJECT_INSTANCE)) { - ae = ProjectManager.getInstance(config).getProjectByUuid(uuid); - } else if (type.equals(AclEntityType.CUBE_INSTANCE)) { - ae = CubeManager.getInstance(config).getCubeByUuid(uuid); - } - - if (ae != null) { - Authentication authentication = SecurityContextHolder.getContext().getAuthentication(); - Sid sid = new PrincipalSid(authentication.getName()); - for (Permission permission : allPermissions) { - if (kylinAclPermissionEvaluator.hasPermission(authentication, ae, permission)) { - String permString = kylinAclPermissionEvaluator.transformPermission(permission); - result = generateAceResponses(permString, sid); - break; - } - } - } - - return result; - } - - private List<AccessEntryResponse> generateAceResponses(String permission, Sid sid) { - List<AccessEntryResponse> result = new ArrayList<AccessEntryResponse>(); - switch (permission) { - case Constant.CUBE_ADMIN: - result.add(new AccessEntryResponse(null, sid, AclPermission.ADMINISTRATION, true)); - case Constant.CUBE_EDIT: - result.add(new AccessEntryResponse(null, sid, AclPermission.MANAGEMENT, true)); - case Constant.CUBE_OPERATION: - result.add(new AccessEntryResponse(null, sid, AclPermission.OPERATION, true)); - case Constant.CUBE_QUERY: - result.add(new AccessEntryResponse(null, sid, AclPermission.READ, true)); - default: - break; - } - return result; - } - -} http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/server-base/src/main/java/org/apache/kylin/rest/security/KylinAclPermissionEvaluator.java ---------------------------------------------------------------------- diff --git a/server-base/src/main/java/org/apache/kylin/rest/security/KylinAclPermissionEvaluator.java b/server-base/src/main/java/org/apache/kylin/rest/security/KylinAclPermissionEvaluator.java index 25d1976..1cdd511 100644 --- a/server-base/src/main/java/org/apache/kylin/rest/security/KylinAclPermissionEvaluator.java +++ b/server-base/src/main/java/org/apache/kylin/rest/security/KylinAclPermissionEvaluator.java @@ -23,14 +23,7 @@ import java.util.ArrayList; import java.util.Arrays; import java.util.List; -import org.apache.commons.collections.CollectionUtils; -import org.apache.kylin.common.KylinConfig; -import org.apache.kylin.common.security.KylinAuthorizationProvider; -import org.apache.kylin.cube.CubeInstance; -import org.apache.kylin.metadata.project.ProjectInstance; -import org.apache.kylin.metadata.project.ProjectManager; -import org.apache.kylin.metadata.realization.RealizationType; -import org.apache.kylin.rest.constant.Constant; +import org.apache.kylin.common.persistence.AclEntity; import org.apache.kylin.rest.service.AclService; import org.springframework.security.acls.AclPermissionEvaluator; import org.springframework.security.acls.domain.PermissionFactory; @@ -50,86 +43,52 @@ public class KylinAclPermissionEvaluator extends AclPermissionEvaluator { @Override public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) { + ExternalAclProvider eap = ExternalAclProvider.getInstance(); + if (eap == null) + return super.hasPermission(authentication, targetDomainObject, permission); + if (targetDomainObject == null) { return false; } - KylinConfig kylinConfig= KylinConfig.getInstanceFromEnv(); - if (kylinConfig.isRangerAclEnabled()) { - String projectName = null; - String cubeName = null; - String owner = null; - String currentUser = authentication.getName(); - - if (targetDomainObject instanceof ProjectInstance) { - ProjectInstance projectInstance = (ProjectInstance) targetDomainObject; - projectName = projectInstance.getName(); - owner = projectInstance.getOwner(); - } else if (targetDomainObject instanceof CubeInstance) { - CubeInstance cubeInstance = (CubeInstance) targetDomainObject; - cubeName = cubeInstance.getName(); - owner = cubeInstance.getOwner(); - - List<ProjectInstance> relatedProjectInstances = ProjectManager.getInstance(kylinConfig).findProjects(RealizationType.CUBE, cubeName); - if (!CollectionUtils.isEmpty(relatedProjectInstances)) { - projectName = relatedProjectInstances.get(0).getName(); - } - } else { - return super.hasPermission(authentication, targetDomainObject, permission); - } + AclEntity e = (AclEntity) targetDomainObject; + return checkExternalPermission(eap, authentication, e.getClass().getSimpleName(), e.getId(), permission); + } - if (owner != null && owner.equalsIgnoreCase(currentUser)) { - return true; - } + private boolean checkExternalPermission(ExternalAclProvider eap, Authentication authentication, String entityType, + String entityUuid, Object permission) { - List<Permission> permissions = resolveKylinPermission(permission); - List<String> authorities = getAuthorities(authentication); - for (Permission p : permissions) { - String permString = transformPermission(p); - if (KylinAuthorizationProvider.getInstance(kylinConfig).checkPermission(projectName, cubeName, currentUser, authorities, permString)) { - return true; - } - } - return false; - } + String currentUser = authentication.getName(); + List<String> authorities = getAuthorities(authentication); + List<Permission> kylinPermissions = resolveKylinPermission(permission); - return super.hasPermission(authentication, targetDomainObject, permission); - } - - public String transformPermission(Permission p) { - String permString = null; - if (p.equals(AclPermission.ADMINISTRATION)) { - permString = Constant.CUBE_ADMIN; - } else if (p.equals(AclPermission.MANAGEMENT)) { - permString = Constant.CUBE_EDIT; - } else if (p.equals(AclPermission.OPERATION)) { - permString = Constant.CUBE_OPERATION; - } else if (p.equals(AclPermission.READ)) { - permString = (Constant.CUBE_QUERY); + for (Permission p : kylinPermissions) { + if (eap.checkPermission(currentUser, authorities, entityType, entityUuid, (AclPermission) p)) + return true; } - return permString; + return false; } private List<Permission> resolveKylinPermission(Object permission) { if (permission instanceof Integer) { - return Arrays.asList(kylinPermissionFactory.buildFromMask(((Integer)permission).intValue())); + return Arrays.asList(kylinPermissionFactory.buildFromMask(((Integer) permission).intValue())); } if (permission instanceof Permission) { - return Arrays.asList((Permission)permission); + return Arrays.asList((Permission) permission); } if (permission instanceof Permission[]) { - return Arrays.asList((Permission[])permission); + return Arrays.asList((Permission[]) permission); } if (permission instanceof String) { - String permString = (String)permission; + String permString = (String) permission; Permission p; try { p = kylinPermissionFactory.buildFromName(permString); - } catch(IllegalArgumentException notfound) { + } catch (IllegalArgumentException notfound) { p = kylinPermissionFactory.buildFromName(permString.toUpperCase()); } @@ -154,6 +113,10 @@ public class KylinAclPermissionEvaluator extends AclPermissionEvaluator { @Override public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission) { - return super.hasPermission(authentication, targetId, targetType, permission); + ExternalAclProvider eap = ExternalAclProvider.getInstance(); + if (eap == null) + return super.hasPermission(authentication, targetId, targetType, permission); + + return checkExternalPermission(eap, authentication, targetType, targetId.toString(), permission); } } http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/server-base/src/main/java/org/apache/kylin/rest/security/KylinAuthorization.java ---------------------------------------------------------------------- diff --git a/server-base/src/main/java/org/apache/kylin/rest/security/KylinAuthorization.java b/server-base/src/main/java/org/apache/kylin/rest/security/KylinAuthorization.java deleted file mode 100644 index e5cd761..0000000 --- a/server-base/src/main/java/org/apache/kylin/rest/security/KylinAuthorization.java +++ /dev/null @@ -1,35 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. -*/ -package org.apache.kylin.rest.security; - -import java.util.List; - -import org.apache.kylin.common.security.KylinAuthorizationProvider; - -public class KylinAuthorization extends KylinAuthorizationProvider { - - @Override - public void init() { - } - - @Override - public boolean checkPermission(String projectName, String cubeName, String user, List<String> userRole, String permissions) { - return false; - } - -} \ No newline at end of file http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/server-base/src/main/java/org/apache/kylin/rest/service/JobService.java ---------------------------------------------------------------------- diff --git a/server-base/src/main/java/org/apache/kylin/rest/service/JobService.java b/server-base/src/main/java/org/apache/kylin/rest/service/JobService.java index 7aba9a8..d2180a7 100644 --- a/server-base/src/main/java/org/apache/kylin/rest/service/JobService.java +++ b/server-base/src/main/java/org/apache/kylin/rest/service/JobService.java @@ -33,7 +33,6 @@ import javax.annotation.Nullable; import org.apache.commons.lang3.StringUtils; import org.apache.directory.api.util.Strings; import org.apache.kylin.common.KylinConfig; -import org.apache.kylin.common.security.KylinAuthorizationProvider; import org.apache.kylin.common.util.ClassUtil; import org.apache.kylin.cube.CubeInstance; import org.apache.kylin.cube.CubeSegment; @@ -119,7 +118,6 @@ public class JobService extends BasicService implements InitializingBean { .scheduler(kylinConfig.getSchedulerType()); jobLock = (JobLock) ClassUtil.newInstance(kylinConfig.getJobControllerLock()); - KylinAuthorizationProvider.getInstance(kylinConfig); new Thread(new Runnable() { @Override http://git-wip-us.apache.org/repos/asf/kylin/blob/5aa9837d/webapp/app/js/services/kylinProperties.js ---------------------------------------------------------------------- diff --git a/webapp/app/js/services/kylinProperties.js b/webapp/app/js/services/kylinProperties.js index 061a290..04e5cef 100644 --- a/webapp/app/js/services/kylinProperties.js +++ b/webapp/app/js/services/kylinProperties.js @@ -108,11 +108,11 @@ KylinApp.service('kylinConfig', function (AdminService, $log) { } this.isRangerAclEnabled = function() { - var status = this.getProperty("kylin.authorization.ranger-acl-enabled").trim(); - if (status === 'true') { - return true; - } - return false; + var status = this.getProperty("kylin.server.external-acl-provider").trim(); + if (status == '') { + return false; + } + return true; } });
