[
https://issues.apache.org/jira/browse/KNOX-3426?focusedWorklogId=1038986&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1038986
]
ASF GitHub Bot logged work on KNOX-3426:
----------------------------------------
Author: ASF GitHub Bot
Created on: 01/Sep/26 05:16
Start Date: 01/Sep/26 05:16
Worklog Time Spent: 10m
Work Description: hsheinblatt commented on code in PR #1361:
URL: https://github.com/apache/knox/pull/1361#discussion_r3900979838
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/factory/DelegationPolicyServiceFactory.java:
##########
@@ -0,0 +1,84 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations
under
+ * the License.
+ */
+package org.apache.knox.gateway.services.factory;
+
+import org.apache.knox.gateway.GatewayMessages;
+import org.apache.knox.gateway.config.GatewayConfig;
+import org.apache.knox.gateway.i18n.messages.MessagesFactory;
+import org.apache.knox.gateway.services.GatewayServices;
+import org.apache.knox.gateway.services.Service;
+import org.apache.knox.gateway.services.ServiceLifecycleException;
+import org.apache.knox.gateway.services.ServiceType;
+import
org.apache.knox.gateway.services.knoxidf.delegation.EmptyDelegationPolicyService;
+import
org.apache.knox.gateway.services.knoxidf.delegation.JdbcDelegationPolicyService;
+
+import java.util.Collection;
+import java.util.List;
+import java.util.Map;
+
+public class DelegationPolicyServiceFactory extends AbstractServiceFactory {
+
+ private static final GatewayMessages LOG =
MessagesFactory.get(GatewayMessages.class);
+ private static final String DEFAULT_IMPLEMENTATION =
EmptyDelegationPolicyService.class.getName();
+
+ @Override
+ protected Service createService(GatewayServices gatewayServices, ServiceType
serviceType,
+ GatewayConfig gatewayConfig, Map<String, String> options, String
implementation)
+ throws ServiceLifecycleException {
+
+ String implementationToUse = implementation;
Review Comment:
For the conditional loading of the delegation policy service based on the
configuration for either knoxidf or knoxadmin using
isKnoxIdfEnabledInAnyTopology(), this has some issues. First, the primary check
here is through the topology service, which is loaded after the delegation
service so in this case will always fail through to the
isKnoxIdfEnabledOnDisk() fallback. But even if we reordered the loading so it
was initialized, it doesn't provide much value: checking the topology xml files
should be correct anyway. So we could just remove that initial check and fix it
to use the fallback reading of the xml files.
It's possible to dynamically load topologies from new files later. If at
init time, no topologies used knoxidf or knoxadmin, so the delegation service
didn't initialize, but then later a new topology was loaded that did include
knoxidf or knoxadmin, the topology load wouldn't reload the gateway services,
and so the delegation policy service wouldn't be reloaded for them, and they'd
fail if they needed it. There are multiple paths here that cause dynamic
loading. The simplified descriptor feature seems unlikely to apply to knoxidf.
But API calls or direct file manipulation are possibilities.
Arguably if you want to later add a knoxidf or knoxadmin service topology
with delegation, you'd want to configure the delegation service storage, and if
you hadn't already configured it, you'd need to add that configuration, and so
you'd need to restart knox for the gateway service storage update. So you could
have known that the dynamic loading shouldn't work.
Given this is in the abstract base class, and it works similarly to the
other knoxidf services, I suggest leaving it for now. It is convenient for the
standard case: you want to use knoxidf or knoxadmin, and you need the service,
and you don't want to have to add boilerplate. For follow on, we can consider
skipping the topology service check or requiring a specific configuration to
load the delegation service.
Issue Time Tracking
-------------------
Worklog Id: (was: 1038986)
Time Spent: 2h 40m (was: 2.5h)
> Delegation policy schema and JDBC implementation
> ------------------------------------------------
>
> Key: KNOX-3426
> URL: https://issues.apache.org/jira/browse/KNOX-3426
> Project: Apache Knox
> Issue Type: Task
> Components: JWT
> Reporter: Harrison Sheinblatt
> Assignee: Harrison Sheinblatt
> Priority: Major
> Time Spent: 2h 40m
> Remaining Estimate: 0h
>
> Persistent storage for delegation policies, with a service interface and JDBC
> implementation. After these tasks, delegation policies can be stored and
> retrieved.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
