Repository: kylin Updated Branches: refs/heads/ranger 5aa9837de -> 9864dc683
KYLIN-2703 kylin supports managing access rights for project and cube through apache ranger. Signed-off-by: Li Yang <[email protected]> Project: http://git-wip-us.apache.org/repos/asf/kylin/repo Commit: http://git-wip-us.apache.org/repos/asf/kylin/commit/9864dc68 Tree: http://git-wip-us.apache.org/repos/asf/kylin/tree/9864dc68 Diff: http://git-wip-us.apache.org/repos/asf/kylin/diff/9864dc68 Branch: refs/heads/ranger Commit: 9864dc6830a2512ec16217f2bbadd67a8ede65d0 Parents: 5aa9837 Author: peng.jianhua <[email protected]> Authored: Fri Sep 15 16:16:39 2017 +0800 Committer: Li Yang <[email protected]> Committed: Fri Sep 15 21:14:07 2017 +0800 ---------------------------------------------------------------------- .../kylin/metadata/project/ProjectManager.java | 9 +++ .../apache/kylin/rest/constant/Constant.java | 5 ++ .../kylin/rest/controller/AccessController.java | 21 ++++++- .../rest/security/ExternalAclProvider.java | 3 +- .../security/KylinAclPermissionEvaluator.java | 17 +----- .../kylin/rest/util/AclPermissionUtil.java | 58 ++++++++++++++++++++ webapp/app/js/services/kylinProperties.js | 2 +- webapp/app/partials/cubes/cube_detail.html | 2 +- .../app/partials/projects/project_detail.html | 2 +- 9 files changed, 99 insertions(+), 20 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/kylin/blob/9864dc68/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java ---------------------------------------------------------------------- diff --git a/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java b/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java index df5450c..baf3295 100644 --- a/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java +++ b/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java @@ -447,6 +447,15 @@ public class ProjectManager { return projects; } + public ProjectInstance getProjectByUuid(String uuid) { + Collection<ProjectInstance> copy = new ArrayList<ProjectInstance>(projectMap.values()); + for (ProjectInstance project : copy) { + if (uuid.equals(project.getUuid())) + return project; + } + return null; + } + public ExternalFilterDesc getExternalFilterDesc(String project, String extFilter) { return l2Cache.getExternalFilterDesc(project, extFilter); } http://git-wip-us.apache.org/repos/asf/kylin/blob/9864dc68/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java ---------------------------------------------------------------------- diff --git a/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java b/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java index 05adef1..a1ce32e 100644 --- a/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java +++ b/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java @@ -47,4 +47,9 @@ public class Constant { public final static String SERVER_MODE_QUERY = "query"; public final static String SERVER_MODE_JOB = "job"; public final static String SERVER_MODE_ALL = "all"; + + public final static String CUBE_ADMIN = "CUBE ADMIN"; + public final static String CUBE_EDIT = "CUBE EDIT"; + public final static String CUBE_OPERATION = "CUBE OPERATION"; + public final static String CUBE_QUERY = "CUBE QUERY"; } http://git-wip-us.apache.org/repos/asf/kylin/blob/9864dc68/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java ---------------------------------------------------------------------- diff --git a/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java b/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java index 81153c2..0fd27a5 100644 --- a/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java +++ b/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java @@ -30,12 +30,15 @@ import org.apache.kylin.rest.security.AclPermission; import org.apache.kylin.rest.security.AclPermissionFactory; import org.apache.kylin.rest.security.ExternalAclProvider; import org.apache.kylin.rest.service.AccessService; +import org.apache.kylin.rest.service.UserService; +import org.apache.kylin.rest.util.AclPermissionUtil; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Qualifier; import org.springframework.security.acls.domain.PrincipalSid; import org.springframework.security.acls.model.Acl; import org.springframework.security.acls.model.Permission; import org.springframework.security.acls.model.Sid; +import org.springframework.security.core.userdetails.UserDetails; import org.springframework.stereotype.Controller; import org.springframework.web.bind.annotation.PathVariable; import org.springframework.web.bind.annotation.RequestBody; @@ -55,6 +58,10 @@ public class AccessController extends BasicController { @Qualifier("accessService") private AccessService accessService; + @Autowired + @Qualifier("userService") + private UserService userService; + /** * Get access entry list of a domain object * @@ -64,9 +71,9 @@ public class AccessController extends BasicController { */ @RequestMapping(value = "/{type}/{uuid}", method = { RequestMethod.GET }, produces = { "application/json" }) @ResponseBody - public List<AccessEntryResponse> getAccessEntities(@PathVariable String type, @PathVariable String uuid) { + public List<AccessEntryResponse> getAccessEntities(@PathVariable String type, @PathVariable String uuid) throws IOException { ExternalAclProvider eap = ExternalAclProvider.getInstance(); - + if (eap != null) { List<AccessEntryResponse> ret = new ArrayList<>(); List<Pair<String, AclPermission>> acl = eap.getAcl(type, uuid); @@ -75,6 +82,16 @@ public class AccessController extends BasicController { PrincipalSid sid = new PrincipalSid(p.getFirst()); ret.add(new AccessEntryResponse(null, sid, p.getSecond(), true)); } + } else { + for (UserDetails user : userService.listUsers()) { + PrincipalSid sid = new PrincipalSid(user.getUsername()); + List<String> authorities = AclPermissionUtil.transformAuthorities(user.getAuthorities()); + for (Permission p : AclPermissionFactory.getPermissions()) { + if (eap.checkPermission(user.getUsername(), authorities, type, uuid, p)) { + ret.add(new AccessEntryResponse(null, sid, p, true)); + } + } + } } return ret; } else { http://git-wip-us.apache.org/repos/asf/kylin/blob/9864dc68/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAclProvider.java ---------------------------------------------------------------------- diff --git a/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAclProvider.java b/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAclProvider.java index b748c27..4d66d72 100644 --- a/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAclProvider.java +++ b/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAclProvider.java @@ -22,6 +22,7 @@ import java.util.List; import org.apache.kylin.common.KylinConfig; import org.apache.kylin.common.util.ClassUtil; import org.apache.kylin.common.util.Pair; +import org.springframework.security.acls.model.Permission; /** */ @@ -64,7 +65,7 @@ abstract public class ExternalAclProvider { * @return true if has permission */ abstract public boolean checkPermission(String user, List<String> userRoles, // - String entityType, String entityUuid, AclPermission permission); + String entityType, String entityUuid, Permission permission); /** * Returns all granted permissions on specified entity. http://git-wip-us.apache.org/repos/asf/kylin/blob/9864dc68/server-base/src/main/java/org/apache/kylin/rest/security/KylinAclPermissionEvaluator.java ---------------------------------------------------------------------- diff --git a/server-base/src/main/java/org/apache/kylin/rest/security/KylinAclPermissionEvaluator.java b/server-base/src/main/java/org/apache/kylin/rest/security/KylinAclPermissionEvaluator.java index 1cdd511..b677537 100644 --- a/server-base/src/main/java/org/apache/kylin/rest/security/KylinAclPermissionEvaluator.java +++ b/server-base/src/main/java/org/apache/kylin/rest/security/KylinAclPermissionEvaluator.java @@ -19,17 +19,16 @@ package org.apache.kylin.rest.security; import java.io.Serializable; -import java.util.ArrayList; import java.util.Arrays; import java.util.List; import org.apache.kylin.common.persistence.AclEntity; import org.apache.kylin.rest.service.AclService; +import org.apache.kylin.rest.util.AclPermissionUtil; import org.springframework.security.acls.AclPermissionEvaluator; import org.springframework.security.acls.domain.PermissionFactory; import org.springframework.security.acls.model.Permission; import org.springframework.security.core.Authentication; -import org.springframework.security.core.GrantedAuthority; public class KylinAclPermissionEvaluator extends AclPermissionEvaluator { @@ -59,11 +58,11 @@ public class KylinAclPermissionEvaluator extends AclPermissionEvaluator { String entityUuid, Object permission) { String currentUser = authentication.getName(); - List<String> authorities = getAuthorities(authentication); + List<String> authorities = AclPermissionUtil.transformAuthorities(authentication.getAuthorities()); List<Permission> kylinPermissions = resolveKylinPermission(permission); for (Permission p : kylinPermissions) { - if (eap.checkPermission(currentUser, authorities, entityType, entityUuid, (AclPermission) p)) + if (eap.checkPermission(currentUser, authorities, entityType, entityUuid, p)) return true; } return false; @@ -100,16 +99,6 @@ public class KylinAclPermissionEvaluator extends AclPermissionEvaluator { throw new IllegalArgumentException("Unsupported permission: " + permission); } - private List<String> getAuthorities(Authentication authentication) { - List<String> authorities = new ArrayList<String>(); - for (GrantedAuthority auth : authentication.getAuthorities()) { - if (!authorities.contains(auth.getAuthority())) { - authorities.add(auth.getAuthority()); - } - } - return authorities; - } - @Override public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission) { http://git-wip-us.apache.org/repos/asf/kylin/blob/9864dc68/server-base/src/main/java/org/apache/kylin/rest/util/AclPermissionUtil.java ---------------------------------------------------------------------- diff --git a/server-base/src/main/java/org/apache/kylin/rest/util/AclPermissionUtil.java b/server-base/src/main/java/org/apache/kylin/rest/util/AclPermissionUtil.java new file mode 100644 index 0000000..1e67677 --- /dev/null +++ b/server-base/src/main/java/org/apache/kylin/rest/util/AclPermissionUtil.java @@ -0,0 +1,58 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. +*/ + +package org.apache.kylin.rest.util; + +import java.util.ArrayList; +import java.util.Collection; +import java.util.List; + +import org.apache.kylin.rest.constant.Constant; +import org.apache.kylin.rest.security.AclPermission; +import org.springframework.security.acls.model.Permission; +import org.springframework.security.core.GrantedAuthority; + +public class AclPermissionUtil { + + public static String transformPermission(Permission p) { + String permString = null; + if (AclPermission.ADMINISTRATION.equals(p)) { + permString = Constant.CUBE_ADMIN; + } else if (AclPermission.MANAGEMENT.equals(p)) { + permString = Constant.CUBE_EDIT; + } else if (AclPermission.OPERATION.equals(p)) { + permString = Constant.CUBE_OPERATION; + } else if (AclPermission.READ.equals(p)) { + permString = Constant.CUBE_QUERY; + } else { + permString = p.getPattern(); + } + return permString; + } + + public static List<String> transformAuthorities(Collection<? extends GrantedAuthority> authorities) { + List<String> ret = new ArrayList<String>(); + for (GrantedAuthority auth : authorities) { + if (!authorities.contains(auth.getAuthority())) { + ret.add(auth.getAuthority()); + } + } + return ret; + } + +} http://git-wip-us.apache.org/repos/asf/kylin/blob/9864dc68/webapp/app/js/services/kylinProperties.js ---------------------------------------------------------------------- diff --git a/webapp/app/js/services/kylinProperties.js b/webapp/app/js/services/kylinProperties.js index 04e5cef..a2af4ed 100644 --- a/webapp/app/js/services/kylinProperties.js +++ b/webapp/app/js/services/kylinProperties.js @@ -107,7 +107,7 @@ KylinApp.service('kylinConfig', function (AdminService, $log) { } } - this.isRangerAclEnabled = function() { + this.isExternalAclEnabled = function() { var status = this.getProperty("kylin.server.external-acl-provider").trim(); if (status == '') { return false; http://git-wip-us.apache.org/repos/asf/kylin/blob/9864dc68/webapp/app/partials/cubes/cube_detail.html ---------------------------------------------------------------------- diff --git a/webapp/app/partials/cubes/cube_detail.html b/webapp/app/partials/cubes/cube_detail.html index 06f66f8..51f7dee 100755 --- a/webapp/app/partials/cubes/cube_detail.html +++ b/webapp/app/partials/cubes/cube_detail.html @@ -30,7 +30,7 @@ <a href="" ng-click="cube.visiblePage='json';">JSON(Cube)</a> </li> <li class="{{cube.visiblePage=='access'? 'active':''}}" - ng-if="!kylinConfig.isRangerAclEnabled()"> + ng-if="!kylinConfig.isExternalAclEnabled()"> <a href="" ng-click="cube.visiblePage='access';listAccess(cube, 'CubeInstance');">Access</a> </li> <li class="{{cube.visiblePage=='notification'? 'active':''}}" http://git-wip-us.apache.org/repos/asf/kylin/blob/9864dc68/webapp/app/partials/projects/project_detail.html ---------------------------------------------------------------------- diff --git a/webapp/app/partials/projects/project_detail.html b/webapp/app/partials/projects/project_detail.html index 7fffdbd..7112da6 100644 --- a/webapp/app/partials/projects/project_detail.html +++ b/webapp/app/partials/projects/project_detail.html @@ -22,7 +22,7 @@ <a href="" ng-click="project.visiblePage='cubes';">Cubes</a> </li> <li class="{{project.visiblePage=='access'? 'active':''}}" - ng-if="!kylinConfig.isRangerAclEnabled()"> + ng-if="!kylinConfig.isExternalAclEnabled()"> <a href="" ng-click="project.visiblePage='access';listAccess(project, 'ProjectInstance');">Access</a> </li> <li class="{{project.visiblePage=='config'? 'active':''}}">
