Repository: nifi-registry Updated Branches: refs/heads/master 5a56bb74b -> 888e38302
NIFIREG-119 Detect incorrect authorizers config Adds stricter checks in AuthorizerFactory for unique ids within a given type of provider and requires unique providers in composite and composite-configurable user group providers. Failed validation checks cause startup to fail. Adds test cases for these new rules. This closes #91. Signed-off-by: Bryan Bende <[email protected]> Project: http://git-wip-us.apache.org/repos/asf/nifi-registry/repo Commit: http://git-wip-us.apache.org/repos/asf/nifi-registry/commit/888e3830 Tree: http://git-wip-us.apache.org/repos/asf/nifi-registry/tree/888e3830 Diff: http://git-wip-us.apache.org/repos/asf/nifi-registry/diff/888e3830 Branch: refs/heads/master Commit: 888e38302d2626a8ecaf0ed856629ed30ec6c98f Parents: 5a56bb7 Author: Kevin Doran <[email protected]> Authored: Thu Jan 18 13:28:33 2018 -0500 Committer: Bryan Bende <[email protected]> Committed: Fri Jan 19 10:07:46 2018 -0500 ---------------------------------------------------------------------- .../authorization/AuthorizerFactory.java | 24 +++- .../CompositeConfigurableUserGroupProvider.java | 21 ++- .../CompositeUserGroupProvider.java | 4 + .../authorization/AuthorizerFactorySpec.groovy | 129 +++++++++++++++++++ .../authorizers-bad-ap-provider-ids.xml | 47 +++++++ .../security/authorizers-bad-authorizer-ids.xml | 46 +++++++ .../security/authorizers-bad-composite.xml | 54 ++++++++ .../authorizers-bad-configurable-composite.xml | 54 ++++++++ .../authorizers-bad-ug-provider-ids.xml | 46 +++++++ .../authorizers-good-file-providers.xml | 39 ++++++ 10 files changed, 458 insertions(+), 6 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/nifi-registry/blob/888e3830/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/AuthorizerFactory.java ---------------------------------------------------------------------- diff --git a/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/AuthorizerFactory.java b/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/AuthorizerFactory.java index ff412cb..3094309 100644 --- a/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/AuthorizerFactory.java +++ b/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/AuthorizerFactory.java @@ -44,6 +44,7 @@ import javax.xml.bind.JAXBContext; import javax.xml.bind.JAXBElement; import javax.xml.bind.JAXBException; import javax.xml.bind.Unmarshaller; +import javax.xml.stream.XMLStreamException; import javax.xml.transform.stream.StreamSource; import javax.xml.validation.Schema; import javax.xml.validation.SchemaFactory; @@ -58,6 +59,8 @@ import java.util.Map; import java.util.Set; /** + * Creates and configures Authorizers and their providers based on the configuration (authorizers.xml). + * * This implementation of AuthorizerFactory in NiFi Registry is based on a combination of * NiFi's AuthorizerFactory and AuthorizerFactoryBean. */ @@ -145,7 +148,7 @@ public class AuthorizerFactory implements UserGroupProviderLookup, AccessPolicyP // ensure the authorizer class name was specified if (StringUtils.isBlank(authorizerIdentifier)) { - throw new AuthorizerFactoryException("When running securely, the authorizer identifier must be specified in the nifi properties file."); + throw new AuthorizerFactoryException("When running securely, the authorizer identifier must be specified in the nifi-registry.properties file."); } else { try { @@ -153,6 +156,9 @@ public class AuthorizerFactory implements UserGroupProviderLookup, AccessPolicyP // create each user group provider for (final org.apache.nifi.registry.security.authorization.generated.UserGroupProvider userGroupProvider : authorizerConfiguration.getUserGroupProvider()) { + if (userGroupProviders.containsKey(userGroupProvider.getIdentifier())) { + throw new AuthorizerFactoryException("Duplicate User Group Provider identifier in Authorizers configuration: " + userGroupProvider.getIdentifier()); + } userGroupProviders.put(userGroupProvider.getIdentifier(), createUserGroupProvider(userGroupProvider.getIdentifier(), userGroupProvider.getClazz())); } @@ -164,6 +170,9 @@ public class AuthorizerFactory implements UserGroupProviderLookup, AccessPolicyP // create each access policy provider for (final org.apache.nifi.registry.security.authorization.generated.AccessPolicyProvider accessPolicyProvider : authorizerConfiguration.getAccessPolicyProvider()) { + if (accessPolicyProviders.containsKey(accessPolicyProvider.getIdentifier())) { + throw new AuthorizerFactoryException("Duplicate Access Policy Provider identifier in Authorizers configuration: " + accessPolicyProvider.getIdentifier()); + } accessPolicyProviders.put(accessPolicyProvider.getIdentifier(), createAccessPolicyProvider(accessPolicyProvider.getIdentifier(), accessPolicyProvider.getClazz())); } @@ -175,6 +184,9 @@ public class AuthorizerFactory implements UserGroupProviderLookup, AccessPolicyP // create each authorizer for (final org.apache.nifi.registry.security.authorization.generated.Authorizer authorizer : authorizerConfiguration.getAuthorizer()) { + if (authorizers.containsKey(authorizer.getIdentifier())) { + throw new AuthorizerFactoryException("Duplicate Authorizer identifier in Authorizers configuration: " + authorizer.getIdentifier()); + } authorizers.put(authorizer.getIdentifier(), createAuthorizer(authorizer.getIdentifier(), authorizer.getClazz(), authorizer.getClasspath())); } @@ -191,6 +203,8 @@ public class AuthorizerFactory implements UserGroupProviderLookup, AccessPolicyP if (authorizer == null) { throw new AuthorizerFactoryException(String.format("The specified authorizer '%s' could not be found.", authorizerIdentifier)); } + } catch (AuthorizerFactoryException e) { + throw e; } catch (Exception e) { throw new AuthorizerFactoryException("Failed to construct Authorizer.", e); } @@ -203,15 +217,15 @@ public class AuthorizerFactory implements UserGroupProviderLookup, AccessPolicyP @Override public void destroy() throws Exception { if (authorizers != null) { - authorizers.entrySet().stream().forEach(e -> e.getValue().preDestruction()); + authorizers.forEach((key, value) -> value.preDestruction()); } if (accessPolicyProviders != null) { - accessPolicyProviders.entrySet().stream().forEach(e -> e.getValue().preDestruction()); + accessPolicyProviders.forEach((key, value) -> value.preDestruction()); } if (userGroupProviders != null) { - userGroupProviders.entrySet().stream().forEach(e -> e.getValue().preDestruction()); + userGroupProviders.forEach((key, value) -> value.preDestruction()); } } @@ -230,7 +244,7 @@ public class AuthorizerFactory implements UserGroupProviderLookup, AccessPolicyP unmarshaller.setSchema(schema); final JAXBElement<Authorizers> element = unmarshaller.unmarshal(XmlUtils.createSafeReader(new StreamSource(authorizersConfigurationFile)), Authorizers.class); return element.getValue(); - } catch (SAXException | JAXBException e) { + } catch (XMLStreamException | SAXException | JAXBException e) { throw new Exception("Unable to load the authorizer configuration file at: " + authorizersConfigurationFile.getAbsolutePath(), e); } } else { http://git-wip-us.apache.org/repos/asf/nifi-registry/blob/888e3830/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/CompositeConfigurableUserGroupProvider.java ---------------------------------------------------------------------- diff --git a/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/CompositeConfigurableUserGroupProvider.java b/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/CompositeConfigurableUserGroupProvider.java index b65a549..6581e89 100644 --- a/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/CompositeConfigurableUserGroupProvider.java +++ b/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/CompositeConfigurableUserGroupProvider.java @@ -16,6 +16,7 @@ */ package org.apache.nifi.registry.security.authorization; +import org.apache.commons.lang3.StringUtils; import org.apache.nifi.registry.security.authorization.exception.AuthorizationAccessException; import org.apache.nifi.registry.security.authorization.exception.UninheritableAuthorizationsException; import org.apache.nifi.registry.security.exception.SecurityProviderCreationException; @@ -23,7 +24,9 @@ import org.apache.nifi.registry.security.exception.SecurityProviderDestructionEx import org.apache.nifi.registry.util.PropertyValue; import java.util.HashSet; +import java.util.Map; import java.util.Set; +import java.util.regex.Matcher; public class CompositeConfigurableUserGroupProvider extends CompositeUserGroupProvider implements ConfigurableUserGroupProvider { @@ -61,6 +64,18 @@ public class CompositeConfigurableUserGroupProvider extends CompositeUserGroupPr throw new SecurityProviderCreationException(String.format("The Configurable User Group Provider is not configurable: %s", configurableUserGroupProviderKey)); } + // Ensure that the ConfigurableUserGroupProvider is not also listed as one of the providers for the CompositeUserGroupProvider + for (Map.Entry<String,String> entry : configurationContext.getProperties().entrySet()) { + Matcher matcher = USER_GROUP_PROVIDER_PATTERN.matcher(entry.getKey()); + if (matcher.matches() && !StringUtils.isBlank(entry.getValue())) { + final String userGroupProviderKey = entry.getValue(); + + if (userGroupProviderKey.equals(configurableUserGroupProviderKey.getValue())) { + throw new SecurityProviderCreationException(String.format("Duplicate provider in Composite Configurable User Group Provider configuration: %s", userGroupProviderKey)); + } + } + } + configurableUserGroupProvider = (ConfigurableUserGroupProvider) userGroupProvider; // configure the CompositeUserGroupProvider @@ -204,13 +219,17 @@ public class CompositeConfigurableUserGroupProvider extends CompositeUserGroupPr } // Second, lookup groups containing the user identifier - // Don't have to check super.getGroups() because this step is done as part of super.getUserAndGroups(...) String userIdentifier = combinedResult.getUser().getIdentifier(); for (final Group group : configurableUserGroupProvider.getGroups()) { if (group.getUsers() != null && group.getUsers().contains(userIdentifier)) { combinedResult.addGroup(group); } } + for (final Group group : super.getGroups()) { + if (group.getUsers() != null && group.getUsers().contains(userIdentifier)) { + combinedResult.addGroup(group); + } + } return combinedResult; } http://git-wip-us.apache.org/repos/asf/nifi-registry/blob/888e3830/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/CompositeUserGroupProvider.java ---------------------------------------------------------------------- diff --git a/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/CompositeUserGroupProvider.java b/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/CompositeUserGroupProvider.java index 76e154a..3d84c14 100644 --- a/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/CompositeUserGroupProvider.java +++ b/nifi-registry-framework/src/main/java/org/apache/nifi/registry/security/authorization/CompositeUserGroupProvider.java @@ -68,6 +68,10 @@ public class CompositeUserGroupProvider implements UserGroupProvider { throw new SecurityProviderCreationException(String.format("Unable to locate the configured User Group Provider: %s", userGroupProviderKey)); } + if (userGroupProviders.contains(userGroupProvider)) { + throw new SecurityProviderCreationException(String.format("Duplicate provider in Composite User Group Provider configuration: %s", userGroupProviderKey)); + } + userGroupProviders.add(userGroupProvider); } } http://git-wip-us.apache.org/repos/asf/nifi-registry/blob/888e3830/nifi-registry-framework/src/test/groovy/org/apache/nifi/registry/security/authorization/AuthorizerFactorySpec.groovy ---------------------------------------------------------------------- diff --git a/nifi-registry-framework/src/test/groovy/org/apache/nifi/registry/security/authorization/AuthorizerFactorySpec.groovy b/nifi-registry-framework/src/test/groovy/org/apache/nifi/registry/security/authorization/AuthorizerFactorySpec.groovy new file mode 100644 index 0000000..932d483 --- /dev/null +++ b/nifi-registry-framework/src/test/groovy/org/apache/nifi/registry/security/authorization/AuthorizerFactorySpec.groovy @@ -0,0 +1,129 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.nifi.registry.security.authorization + +import org.apache.nifi.registry.extension.ExtensionManager +import org.apache.nifi.registry.properties.NiFiRegistryProperties +import org.apache.nifi.registry.security.authorization.file.FileAccessPolicyProvider +import org.apache.nifi.registry.security.authorization.file.FileUserGroupProvider +import org.apache.nifi.registry.security.authorization.resource.ResourceFactory +import spock.lang.Specification + +class AuthorizerFactorySpec extends Specification { + + def mockProperties = Mock(NiFiRegistryProperties) + def mockExtensionManager = Mock(ExtensionManager) + + AuthorizerFactory authorizerFactory + + // runs before every feature method + def setup() { + mockExtensionManager.getExtensionClassLoader(_) >> this.getClass().getClassLoader() + mockProperties.getPropertyKeys() >> new HashSet<String>() // Called by IdentityMappingUtil.getIdentityMappings() + + authorizerFactory = new AuthorizerFactory(mockProperties, mockExtensionManager, null) + } + + // runs after every feature method + def cleanup() { + authorizerFactory = null + } + + // runs before the first feature method + def setupSpec() {} + + // runs after the last feature method + def cleanupSpec() {} + + def "create default authorizer"() { + + setup: "properties indicate nifi-registry is unsecured" + mockProperties.getProperty(NiFiRegistryProperties.WEB_HTTPS_PORT) >> "" + + when: "getAuthorizer() is first called" + def authorizer = authorizerFactory.getAuthorizer() + + then: "the default authorizer is returned" + authorizer != null + + and: "any authorization request made to that authorizer is approved" + def authorizationResult = authorizer.authorize(getTestAuthorizationRequest()) + authorizationResult.result == AuthorizationResult.Result.Approved + + } + + def "create file-backed authorizer"() { + + setup: + setMockPropsAuthorizersConfig("src/test/resources/security/authorizers-good-file-providers.xml", "managed-authorizer") + + when: "getAuthorizer() is first called" + def authorizer = authorizerFactory.getAuthorizer() + + then: "an authorizer is returned with the expected providers" + authorizer != null + authorizer instanceof ManagedAuthorizer + def apProvider = ((ManagedAuthorizer) authorizer).getAccessPolicyProvider() + apProvider instanceof ConfigurableAccessPolicyProvider + def ugProvider = ((ConfigurableAccessPolicyProvider) apProvider).getUserGroupProvider() + ugProvider instanceof ConfigurableUserGroupProvider + + } + + def "invalid authorizer configuration fails"() { + + when: "a bad configuration is provided and getAuthorizer() is called" + setMockPropsAuthorizersConfig(authorizersConfigFile, selectedAuthorizer) + authorizerFactory = new AuthorizerFactory(mockProperties, mockExtensionManager, null) + authorizerFactory.getAuthorizer() + + then: "expect an exception" + def e = thrown AuthorizerFactoryException + e.message =~ expectedExceptionMessage || e.getCause().getMessage() =~ expectedExceptionMessage + + where: + authorizersConfigFile | selectedAuthorizer | expectedExceptionMessage + "src/test/resources/security/authorizers-good-file-providers.xml" | "" | "When running securely, the authorizer identifier must be specified in the nifi-registry.properties file." + "src/test/resources/security/authorizers-good-file-providers.xml" | "non-existent-authorizer" | "The specified authorizer 'non-existent-authorizer' could not be found." + "src/test/resources/security/authorizers-bad-ug-provider-ids.xml" | "managed-authorizer" | "Duplicate User Group Provider identifier in Authorizers configuration" + "src/test/resources/security/authorizers-bad-ap-provider-ids.xml" | "managed-authorizer" | "Duplicate Access Policy Provider identifier in Authorizers configuration" + "src/test/resources/security/authorizers-bad-authorizer-ids.xml" | "managed-authorizer" | "Duplicate Authorizer identifier in Authorizers configuration" + "src/test/resources/security/authorizers-bad-composite.xml" | "managed-authorizer" | "Duplicate provider in Composite User Group Provider configuration" + "src/test/resources/security/authorizers-bad-configurable-composite.xml" | "managed-authorizer" | "Duplicate provider in Composite Configurable User Group Provider configuration" + + } + + // Helper methods + + private void setMockPropsAuthorizersConfig(String filePath, String authorizer = "managed-authorizer") { + mockProperties.getProperty(NiFiRegistryProperties.WEB_HTTPS_PORT) >> "443" + mockProperties.getSslPort() >> 443 // required to be non-null to create authorizer + mockProperties.getProperty(NiFiRegistryProperties.SECURITY_AUTHORIZERS_CONFIGURATION_FILE) >> filePath + mockProperties.getAuthorizersConfigurationFile() >> new File(filePath) + mockProperties.getProperty(NiFiRegistryProperties.SECURITY_AUTHORIZER) >> authorizer + } + + private static AuthorizationRequest getTestAuthorizationRequest() { + return new AuthorizationRequest.Builder() + .resource(ResourceFactory.getBucketsResource()) + .action(RequestAction.WRITE) + .accessAttempt(false) + .anonymous(true) + .build() + } + +} http://git-wip-us.apache.org/repos/asf/nifi-registry/blob/888e3830/nifi-registry-framework/src/test/resources/security/authorizers-bad-ap-provider-ids.xml ---------------------------------------------------------------------- diff --git a/nifi-registry-framework/src/test/resources/security/authorizers-bad-ap-provider-ids.xml b/nifi-registry-framework/src/test/resources/security/authorizers-bad-ap-provider-ids.xml new file mode 100644 index 0000000..dcbc36a --- /dev/null +++ b/nifi-registry-framework/src/test/resources/security/authorizers-bad-ap-provider-ids.xml @@ -0,0 +1,47 @@ +<?xml version="1.0" encoding="UTF-8" standalone="yes"?> +<!-- + ~ Licensed to the Apache Software Foundation (ASF) under one or more + ~ contributor license agreements. See the NOTICE file distributed with + ~ this work for additional information regarding copyright ownership. + ~ The ASF licenses this file to You under the Apache License, Version 2.0 + ~ (the "License"); you may not use this file except in compliance with + ~ the License. You may obtain a copy of the License at + ~ + ~ http://www.apache.org/licenses/LICENSE-2.0 + ~ + ~ Unless required by applicable law or agreed to in writing, software + ~ distributed under the License is distributed on an "AS IS" BASIS, + ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + ~ See the License for the specific language governing permissions and + ~ limitations under the License. + --> +<authorizers> + + <userGroupProvider> + <identifier>file-user-group-provider</identifier> + <class>org.apache.nifi.registry.security.authorization.file.FileUserGroupProvider</class> + <property name="Users File">./target/test-classes/security/users.xml</property> + </userGroupProvider> + + <accessPolicyProvider> + <identifier>file-access-policy-provider</identifier> + <class>org.apache.nifi.registry.security.authorization.file.FileAccessPolicyProvider</class> + <property name="User Group Provider">file-user-group-provider</property> + <property name="Authorizations File">./target/test-classes/security/authorizations1.xml</property> + </accessPolicyProvider> + + <accessPolicyProvider> + <!-- this is incorrect: identifiers must be unique across all accessPolicyProviders --> + <identifier>file-access-policy-provider</identifier> + <class>org.apache.nifi.registry.security.authorization.file.FileAccessPolicyProvider</class> + <property name="User Group Provider">file-user-group-provider</property> + <property name="Authorizations File">./target/test-classes/security/authorizations2.xml</property> + </accessPolicyProvider> + + <authorizer> + <identifier>managed-authorizer</identifier> + <class>org.apache.nifi.registry.security.authorization.StandardManagedAuthorizer</class> + <property name="Access Policy Provider">file-access-policy-provider</property> + </authorizer> + +</authorizers> \ No newline at end of file http://git-wip-us.apache.org/repos/asf/nifi-registry/blob/888e3830/nifi-registry-framework/src/test/resources/security/authorizers-bad-authorizer-ids.xml ---------------------------------------------------------------------- diff --git a/nifi-registry-framework/src/test/resources/security/authorizers-bad-authorizer-ids.xml b/nifi-registry-framework/src/test/resources/security/authorizers-bad-authorizer-ids.xml new file mode 100644 index 0000000..d31de91 --- /dev/null +++ b/nifi-registry-framework/src/test/resources/security/authorizers-bad-authorizer-ids.xml @@ -0,0 +1,46 @@ +<?xml version="1.0" encoding="UTF-8" standalone="yes"?> +<!-- + ~ Licensed to the Apache Software Foundation (ASF) under one or more + ~ contributor license agreements. See the NOTICE file distributed with + ~ this work for additional information regarding copyright ownership. + ~ The ASF licenses this file to You under the Apache License, Version 2.0 + ~ (the "License"); you may not use this file except in compliance with + ~ the License. You may obtain a copy of the License at + ~ + ~ http://www.apache.org/licenses/LICENSE-2.0 + ~ + ~ Unless required by applicable law or agreed to in writing, software + ~ distributed under the License is distributed on an "AS IS" BASIS, + ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + ~ See the License for the specific language governing permissions and + ~ limitations under the License. + --> +<authorizers> + + <userGroupProvider> + <identifier>file-user-group-provider</identifier> + <class>org.apache.nifi.registry.security.authorization.file.FileUserGroupProvider</class> + <property name="Users File">./target/test-classes/security/users.xml</property> + </userGroupProvider> + + <accessPolicyProvider> + <identifier>file-access-policy-provider</identifier> + <class>org.apache.nifi.registry.security.authorization.file.FileAccessPolicyProvider</class> + <property name="User Group Provider">file-user-group-provider</property> + <property name="Authorizations File">./target/test-classes/security/authorizations.xml</property> + </accessPolicyProvider> + + <authorizer> + <identifier>managed-authorizer</identifier> + <class>org.apache.nifi.registry.security.authorization.StandardManagedAuthorizer</class> + <property name="Access Policy Provider">file-access-policy-provider</property> + </authorizer> + + <authorizer> + <!-- this is incorrect: identifiers must be unique across all authorizers --> + <identifier>managed-authorizer</identifier> + <class>org.apache.nifi.registry.security.authorization.StandardManagedAuthorizer</class> + <property name="Access Policy Provider">file-access-policy-provider</property> + </authorizer> + +</authorizers> \ No newline at end of file http://git-wip-us.apache.org/repos/asf/nifi-registry/blob/888e3830/nifi-registry-framework/src/test/resources/security/authorizers-bad-composite.xml ---------------------------------------------------------------------- diff --git a/nifi-registry-framework/src/test/resources/security/authorizers-bad-composite.xml b/nifi-registry-framework/src/test/resources/security/authorizers-bad-composite.xml new file mode 100644 index 0000000..1aa96f8 --- /dev/null +++ b/nifi-registry-framework/src/test/resources/security/authorizers-bad-composite.xml @@ -0,0 +1,54 @@ +<?xml version="1.0" encoding="UTF-8" standalone="yes"?> +<!-- + ~ Licensed to the Apache Software Foundation (ASF) under one or more + ~ contributor license agreements. See the NOTICE file distributed with + ~ this work for additional information regarding copyright ownership. + ~ The ASF licenses this file to You under the Apache License, Version 2.0 + ~ (the "License"); you may not use this file except in compliance with + ~ the License. You may obtain a copy of the License at + ~ + ~ http://www.apache.org/licenses/LICENSE-2.0 + ~ + ~ Unless required by applicable law or agreed to in writing, software + ~ distributed under the License is distributed on an "AS IS" BASIS, + ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + ~ See the License for the specific language governing permissions and + ~ limitations under the License. + --> +<authorizers> + + <userGroupProvider> + <identifier>file-user-group-provider-1</identifier> + <class>org.apache.nifi.registry.security.authorization.file.FileUserGroupProvider</class> + <property name="Users File">./target/test-classes/security/users.xml</property> + </userGroupProvider> + + <userGroupProvider> + <identifier>file-user-group-provider-2</identifier> + <class>org.apache.nifi.registry.security.authorization.file.FileUserGroupProvider</class> + <property name="Users File">./target/test-classes/security/read-only-users.xml</property> + </userGroupProvider> + + <userGroupProvider> + <identifier>composite-user-group-provider</identifier> + <class>org.apache.nifi.registry.security.authorization.CompositeUserGroupProvider</class> + <property name="User Group Provider 1">file-user-group-provider-1</property> + <property name="User Group Provider 2">file-user-group-provider-2</property> + <!-- this is incorrect: the list of providers must not contain duplicates --> + <property name="User Group Provider 3">file-user-group-provider-2</property> + </userGroupProvider> + + <accessPolicyProvider> + <identifier>file-access-policy-provider</identifier> + <class>org.apache.nifi.registry.security.authorization.file.FileAccessPolicyProvider</class> + <property name="User Group Provider">composite-user-group-provider</property> + <property name="Authorizations File">./target/test-classes/security/authorizations.xml</property> + </accessPolicyProvider> + + <authorizer> + <identifier>managed-authorizer</identifier> + <class>org.apache.nifi.registry.security.authorization.StandardManagedAuthorizer</class> + <property name="Access Policy Provider">file-access-policy-provider</property> + </authorizer> + +</authorizers> \ No newline at end of file http://git-wip-us.apache.org/repos/asf/nifi-registry/blob/888e3830/nifi-registry-framework/src/test/resources/security/authorizers-bad-configurable-composite.xml ---------------------------------------------------------------------- diff --git a/nifi-registry-framework/src/test/resources/security/authorizers-bad-configurable-composite.xml b/nifi-registry-framework/src/test/resources/security/authorizers-bad-configurable-composite.xml new file mode 100644 index 0000000..f019345 --- /dev/null +++ b/nifi-registry-framework/src/test/resources/security/authorizers-bad-configurable-composite.xml @@ -0,0 +1,54 @@ +<?xml version="1.0" encoding="UTF-8" standalone="yes"?> +<!-- + ~ Licensed to the Apache Software Foundation (ASF) under one or more + ~ contributor license agreements. See the NOTICE file distributed with + ~ this work for additional information regarding copyright ownership. + ~ The ASF licenses this file to You under the Apache License, Version 2.0 + ~ (the "License"); you may not use this file except in compliance with + ~ the License. You may obtain a copy of the License at + ~ + ~ http://www.apache.org/licenses/LICENSE-2.0 + ~ + ~ Unless required by applicable law or agreed to in writing, software + ~ distributed under the License is distributed on an "AS IS" BASIS, + ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + ~ See the License for the specific language governing permissions and + ~ limitations under the License. + --> +<authorizers> + + <userGroupProvider> + <identifier>file-user-group-provider-1</identifier> + <class>org.apache.nifi.registry.security.authorization.file.FileUserGroupProvider</class> + <property name="Users File">./target/test-classes/security/users.xml</property> + </userGroupProvider> + + <userGroupProvider> + <identifier>file-user-group-provider-2</identifier> + <class>org.apache.nifi.registry.security.authorization.file.FileUserGroupProvider</class> + <property name="Users File">./target/test-classes/security/read-only-users.xml</property> + </userGroupProvider> + + <userGroupProvider> + <identifier>composite-configurable-user-group-provider</identifier> + <class>org.apache.nifi.registry.security.authorization.CompositeConfigurableUserGroupProvider</class> + <property name="Configurable User Group Provider">file-user-group-provider-1</property> + <!-- this is incorrect: the configurable provider should not be listed in the list of non-configurable providers --> + <property name="User Group Provider 1">file-user-group-provider-1</property> + <property name="User Group Provider 2">file-user-group-provider-2</property> + </userGroupProvider> + + <accessPolicyProvider> + <identifier>file-access-policy-provider</identifier> + <class>org.apache.nifi.registry.security.authorization.file.FileAccessPolicyProvider</class> + <property name="User Group Provider">composite-configurable-user-group-provider</property> + <property name="Authorizations File">./target/test-classes/security/authorizations.xml</property> + </accessPolicyProvider> + + <authorizer> + <identifier>managed-authorizer</identifier> + <class>org.apache.nifi.registry.security.authorization.StandardManagedAuthorizer</class> + <property name="Access Policy Provider">file-access-policy-provider</property> + </authorizer> + +</authorizers> \ No newline at end of file http://git-wip-us.apache.org/repos/asf/nifi-registry/blob/888e3830/nifi-registry-framework/src/test/resources/security/authorizers-bad-ug-provider-ids.xml ---------------------------------------------------------------------- diff --git a/nifi-registry-framework/src/test/resources/security/authorizers-bad-ug-provider-ids.xml b/nifi-registry-framework/src/test/resources/security/authorizers-bad-ug-provider-ids.xml new file mode 100644 index 0000000..a28a36d --- /dev/null +++ b/nifi-registry-framework/src/test/resources/security/authorizers-bad-ug-provider-ids.xml @@ -0,0 +1,46 @@ +<?xml version="1.0" encoding="UTF-8" standalone="yes"?> +<!-- + ~ Licensed to the Apache Software Foundation (ASF) under one or more + ~ contributor license agreements. See the NOTICE file distributed with + ~ this work for additional information regarding copyright ownership. + ~ The ASF licenses this file to You under the Apache License, Version 2.0 + ~ (the "License"); you may not use this file except in compliance with + ~ the License. You may obtain a copy of the License at + ~ + ~ http://www.apache.org/licenses/LICENSE-2.0 + ~ + ~ Unless required by applicable law or agreed to in writing, software + ~ distributed under the License is distributed on an "AS IS" BASIS, + ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + ~ See the License for the specific language governing permissions and + ~ limitations under the License. + --> +<authorizers> + + <userGroupProvider> + <identifier>file-user-group-provider</identifier> + <class>org.apache.nifi.registry.security.authorization.file.FileUserGroupProvider</class> + <property name="Users File">./target/test-classes/security/users1.xml</property> + </userGroupProvider> + + <userGroupProvider> + <!-- this is incorrect: identifiers must be unique across all userGroupProviders --> + <identifier>file-user-group-provider</identifier> + <class>org.apache.nifi.registry.security.authorization.file.FileUserGroupProvider</class> + <property name="Users File">./target/test-classes/security/users2.xml</property> + </userGroupProvider> + + <accessPolicyProvider> + <identifier>file-access-policy-provider</identifier> + <class>org.apache.nifi.registry.security.authorization.file.FileAccessPolicyProvider</class> + <property name="User Group Provider">file-user-group-provider</property> + <property name="Authorizations File">./target/test-classes/security/authorizations.xml</property> + </accessPolicyProvider> + + <authorizer> + <identifier>managed-authorizer</identifier> + <class>org.apache.nifi.registry.security.authorization.StandardManagedAuthorizer</class> + <property name="Access Policy Provider">file-access-policy-provider</property> + </authorizer> + +</authorizers> \ No newline at end of file http://git-wip-us.apache.org/repos/asf/nifi-registry/blob/888e3830/nifi-registry-framework/src/test/resources/security/authorizers-good-file-providers.xml ---------------------------------------------------------------------- diff --git a/nifi-registry-framework/src/test/resources/security/authorizers-good-file-providers.xml b/nifi-registry-framework/src/test/resources/security/authorizers-good-file-providers.xml new file mode 100644 index 0000000..98ad3ce --- /dev/null +++ b/nifi-registry-framework/src/test/resources/security/authorizers-good-file-providers.xml @@ -0,0 +1,39 @@ +<?xml version="1.0" encoding="UTF-8" standalone="yes"?> +<!-- + ~ Licensed to the Apache Software Foundation (ASF) under one or more + ~ contributor license agreements. See the NOTICE file distributed with + ~ this work for additional information regarding copyright ownership. + ~ The ASF licenses this file to You under the Apache License, Version 2.0 + ~ (the "License"); you may not use this file except in compliance with + ~ the License. You may obtain a copy of the License at + ~ + ~ http://www.apache.org/licenses/LICENSE-2.0 + ~ + ~ Unless required by applicable law or agreed to in writing, software + ~ distributed under the License is distributed on an "AS IS" BASIS, + ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + ~ See the License for the specific language governing permissions and + ~ limitations under the License. + --> +<authorizers> + + <userGroupProvider> + <identifier>file-user-group-provider</identifier> + <class>org.apache.nifi.registry.security.authorization.file.FileUserGroupProvider</class> + <property name="Users File">./target/test-classes/security/users.xml</property> + </userGroupProvider> + + <accessPolicyProvider> + <identifier>file-access-policy-provider</identifier> + <class>org.apache.nifi.registry.security.authorization.file.FileAccessPolicyProvider</class> + <property name="User Group Provider">file-user-group-provider</property> + <property name="Authorizations File">./target/test-classes/security/authorizations.xml</property> + </accessPolicyProvider> + + <authorizer> + <identifier>managed-authorizer</identifier> + <class>org.apache.nifi.registry.security.authorization.StandardManagedAuthorizer</class> + <property name="Access Policy Provider">file-access-policy-provider</property> + </authorizer> + +</authorizers> \ No newline at end of file
