hsheinblatt commented on code in PR #1361: URL: https://github.com/apache/knox/pull/1361#discussion_r3900979838
########## gateway-server/src/main/java/org/apache/knox/gateway/services/factory/DelegationPolicyServiceFactory.java: ########## @@ -0,0 +1,84 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with this + * work for additional information regarding copyright ownership. The ASF + * licenses this file to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * <p> + * http://www.apache.org/licenses/LICENSE-2.0 + * <p> + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the + * License for the specific language governing permissions and limitations under + * the License. + */ +package org.apache.knox.gateway.services.factory; + +import org.apache.knox.gateway.GatewayMessages; +import org.apache.knox.gateway.config.GatewayConfig; +import org.apache.knox.gateway.i18n.messages.MessagesFactory; +import org.apache.knox.gateway.services.GatewayServices; +import org.apache.knox.gateway.services.Service; +import org.apache.knox.gateway.services.ServiceLifecycleException; +import org.apache.knox.gateway.services.ServiceType; +import org.apache.knox.gateway.services.knoxidf.delegation.EmptyDelegationPolicyService; +import org.apache.knox.gateway.services.knoxidf.delegation.JdbcDelegationPolicyService; + +import java.util.Collection; +import java.util.List; +import java.util.Map; + +public class DelegationPolicyServiceFactory extends AbstractServiceFactory { + + private static final GatewayMessages LOG = MessagesFactory.get(GatewayMessages.class); + private static final String DEFAULT_IMPLEMENTATION = EmptyDelegationPolicyService.class.getName(); + + @Override + protected Service createService(GatewayServices gatewayServices, ServiceType serviceType, + GatewayConfig gatewayConfig, Map<String, String> options, String implementation) + throws ServiceLifecycleException { + + String implementationToUse = implementation; Review Comment: For the conditional loading of the delegation policy service based on the configuration for either knoxidf or knoxadmin using isKnoxIdfEnabledInAnyTopology(), this has some issues. First, the primary check here is through the topology service, which is loaded after the delegation service so in this case will always fail through to the isKnoxIdfEnabledOnDisk() fallback. But even if we reordered the loading so it was initialized, it doesn't provide much value: checking the topology xml files should be correct anyway. So we could just remove that initial check and fix it to use the fallback reading of the xml files. It's possible to dynamically load topologies from new files later. If at init time, no topologies used knoxidf or knoxadmin, so the delegation service didn't initialize, but then later a new topology was loaded that did include knoxidf or knoxadmin, the topology load wouldn't reload the gateway services, and so the delegation policy service wouldn't be reloaded for them, and they'd fail if they needed it. There are multiple paths here that cause dynamic loading. The simplified descriptor feature seems unlikely to apply to knoxidf. But API calls or direct file manipulation are possibilities. Arguably if you want to later add a knoxidf or knoxadmin service topology with delegation, you'd want to configure the delegation service storage, and if you hadn't already configured it, you'd need to add that configuration, and so you'd need to restart knox for the gateway service storage update. So you could have known that the dynamic loading shouldn't work. Given this is in the abstract base class, and it works similarly to the other knoxidf services, I suggest leaving it for now. It is convenient for the standard case: you want to use knoxidf or knoxadmin, and you need the service, and you don't want to have to add boilerplate. For follow on, we can consider skipping the topology service check or requiring a specific configuration to load the delegation service. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
