exceptionfactory commented on a change in pull request #5319:
URL: https://github.com/apache/nifi/pull/5319#discussion_r704472512
##########
File path:
nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/src/main/java/org/apache/nifi/processors/standard/InvokeHTTP.java
##########
@@ -1000,11 +1038,17 @@ private Request configureRequest(final ProcessContext
context, final ProcessSess
final String authUser =
trimToEmpty(context.getProperty(PROP_BASIC_AUTH_USERNAME).getValue());
// If the username/password properties are set then check if digest
auth is being used
- if (!authUser.isEmpty() &&
"false".equalsIgnoreCase(context.getProperty(PROP_DIGEST_AUTH).getValue())) {
- final String authPass =
trimToEmpty(context.getProperty(PROP_BASIC_AUTH_PASSWORD).getValue());
+ if
("false".equalsIgnoreCase(context.getProperty(PROP_DIGEST_AUTH).getValue())) {
+ if (!authUser.isEmpty()) {
+ final String authPass =
trimToEmpty(context.getProperty(PROP_BASIC_AUTH_PASSWORD).getValue());
- String credential = Credentials.basic(authUser, authPass);
- requestBuilder.header("Authorization", credential);
+ String credential = Credentials.basic(authUser, authPass);
+ requestBuilder.header("Authorization", credential);
+ } else {
+
oauth2AccessTokenProviderOptional.ifPresent(oauth2AccessTokenProvider ->
+ requestBuilder.addHeader("Authorization", "Bearer " +
oauth2AccessTokenProvider.getAccessDetails().getAccessToken())
+ );
Review comment:
It would be helpful to add a unit test to ensure the `Authorization`
header is added when the service is configured.
##########
File path:
nifi-nar-bundles/nifi-standard-services/nifi-oauth2-provider-bundle/nifi-oauth2-provider-service/src/main/java/org/apache/nifi/oauth2/StandardOauth2AccessTokenProvider.java
##########
@@ -0,0 +1,300 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.nifi.oauth2;
+
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.PropertyNamingStrategies;
+import okhttp3.FormBody;
+import okhttp3.OkHttpClient;
+import okhttp3.Request;
+import okhttp3.RequestBody;
+import okhttp3.Response;
+import org.apache.nifi.annotation.documentation.CapabilityDescription;
+import org.apache.nifi.annotation.documentation.Tags;
+import org.apache.nifi.annotation.lifecycle.OnDisabled;
+import org.apache.nifi.annotation.lifecycle.OnEnabled;
+import org.apache.nifi.components.AllowableValue;
+import org.apache.nifi.components.PropertyDescriptor;
+import org.apache.nifi.components.ValidationContext;
+import org.apache.nifi.components.ValidationResult;
+import org.apache.nifi.components.Validator;
+import org.apache.nifi.controller.AbstractControllerService;
+import org.apache.nifi.controller.ConfigurationContext;
+import org.apache.nifi.expression.ExpressionLanguageScope;
+import org.apache.nifi.processor.exception.ProcessException;
+import org.apache.nifi.processor.util.StandardValidators;
+import org.apache.nifi.ssl.SSLContextService;
+
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.X509TrustManager;
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.List;
+
+@Tags({"oauth2", "provider", "authorization", "access token", "http"})
+@CapabilityDescription("Provides OAuth 2.0 access tokens that can be used as
Bearer authorization header in HTTP requests." +
+ " Uses Resource Owner Password Credentials Grant.")
+public class StandardOauth2AccessTokenProvider extends
AbstractControllerService implements OAuth2AccessTokenProvider {
+ public static final PropertyDescriptor AUTHORIZATION_SERVER_URL = new
PropertyDescriptor.Builder()
+ .name("authorization-server-url")
+ .displayName("Authorization Server URL")
+ .description("The URL of the authorization server that issues access
tokens.")
+ .required(true)
+ .addValidator(StandardValidators.URL_VALIDATOR)
+ .expressionLanguageSupported(ExpressionLanguageScope.VARIABLE_REGISTRY)
+ .build();
+
+ public static AllowableValue
RESOURCE_OWNER_PASSWORD_CREDENTIALS_GRANT_TYPE = new AllowableValue(
+ "password",
+ "User Password",
+ "Resource Owner Password Credentials Grant. Used to access resources
available to users. Requires username and password and usually Client ID and
Client Secret"
+ );
+ public static AllowableValue CLIENT_CREDENTIALS_GRANT_TYPE = new
AllowableValue(
+ "client_credentials",
+ "Client Credentials",
+ "Client Credentials Grant. Used to access resources available to
clients. Requires Client ID and Client Secret"
+ );
+
+ public static final PropertyDescriptor GRANT_TYPE = new
PropertyDescriptor.Builder()
+ .name("grant-type")
+ .displayName("Grant Type")
+ .description("The OAuth2 Grant Type to be used when acquiring an
access token.")
+ .required(true)
+ .allowableValues(RESOURCE_OWNER_PASSWORD_CREDENTIALS_GRANT_TYPE,
CLIENT_CREDENTIALS_GRANT_TYPE)
+
.defaultValue(RESOURCE_OWNER_PASSWORD_CREDENTIALS_GRANT_TYPE.getValue())
+ .build();
+
+ public static final PropertyDescriptor USERNAME = new
PropertyDescriptor.Builder()
+ .name("service-user-name")
+ .displayName("Username")
+ .description("Username on the service that is being accessed.")
+ .dependsOn(GRANT_TYPE, RESOURCE_OWNER_PASSWORD_CREDENTIALS_GRANT_TYPE)
+ .required(true)
+ .addValidator(StandardValidators.NON_BLANK_VALIDATOR)
+ .expressionLanguageSupported(ExpressionLanguageScope.VARIABLE_REGISTRY)
+ .build();
+
+ public static final PropertyDescriptor PASSWORD = new
PropertyDescriptor.Builder()
+ .name("service-password")
+ .displayName("Password")
+ .description("Password for the username on the service that is being
accessed.")
+ .dependsOn(GRANT_TYPE, RESOURCE_OWNER_PASSWORD_CREDENTIALS_GRANT_TYPE)
+ .required(true)
+ .sensitive(true)
+ .addValidator(StandardValidators.NON_BLANK_VALIDATOR)
+ .build();
+
+ public static final PropertyDescriptor CLIENT_ID = new
PropertyDescriptor.Builder()
+ .name("client-id")
+ .displayName("Client ID")
+ .required(false)
+ .addValidator(StandardValidators.NON_BLANK_VALIDATOR)
+ .expressionLanguageSupported(ExpressionLanguageScope.VARIABLE_REGISTRY)
+ .build();
+
+ public static final PropertyDescriptor CLIENT_SECRET = new
PropertyDescriptor.Builder()
+ .name("client-secret")
+ .displayName("Client secret")
+ .dependsOn(CLIENT_ID)
+ .required(true)
+ .sensitive(true)
+ .addValidator(StandardValidators.NON_BLANK_VALIDATOR)
+ .build();
+
+ public static final PropertyDescriptor SSL_CONTEXT = new
PropertyDescriptor.Builder()
+ .name("ssl-context")
+ .displayName("SSL Context")
Review comment:
Other components such as `InvokeHTTP` and `ListenHTTP` use `SSL Context
Service` as the property name, so recommend adjusting the naming for
consistency:
```suggestion
.name("ssl-context-service")
.displayName("SSL Context Service")
```
##########
File path:
nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/src/main/java/org/apache/nifi/processors/standard/InvokeHTTP.java
##########
@@ -702,6 +714,19 @@ public void onPropertyModified(final PropertyDescriptor
descriptor, final String
.build());
}
+ boolean usingUserNamePasswordAuthorization =
validationContext.getProperty(PROP_BASIC_AUTH_USERNAME).isSet()
+ || validationContext.getProperty(PROP_BASIC_AUTH_USERNAME).isSet();
+
+ boolean usingOAuth2Authorization =
validationContext.getProperty(OAUTH2_ACCESS_TOKEN_PROVIDER).isSet();
+
+ if (usingUserNamePasswordAuthorization && usingOAuth2Authorization) {
+ results.add(new ValidationResult.Builder()
+ .subject("Authorization properties")
+ .valid(false)
+ .explanation("Can't use username+password and OAuth2
authorization at the same time")
Review comment:
It would be helpful to reference to actual property names in the
message, similar to formatted message in `customValidate()` on the service, as
opposed to just `username+password`.
##########
File path:
nifi-nar-bundles/nifi-standard-services/nifi-oauth2-provider-bundle/nifi-oauth2-provider-service/src/main/java/org/apache/nifi/oauth2/StandardOauth2AccessTokenProvider.java
##########
@@ -0,0 +1,300 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.nifi.oauth2;
+
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.PropertyNamingStrategies;
+import okhttp3.FormBody;
+import okhttp3.OkHttpClient;
+import okhttp3.Request;
+import okhttp3.RequestBody;
+import okhttp3.Response;
+import org.apache.nifi.annotation.documentation.CapabilityDescription;
+import org.apache.nifi.annotation.documentation.Tags;
+import org.apache.nifi.annotation.lifecycle.OnDisabled;
+import org.apache.nifi.annotation.lifecycle.OnEnabled;
+import org.apache.nifi.components.AllowableValue;
+import org.apache.nifi.components.PropertyDescriptor;
+import org.apache.nifi.components.ValidationContext;
+import org.apache.nifi.components.ValidationResult;
+import org.apache.nifi.components.Validator;
+import org.apache.nifi.controller.AbstractControllerService;
+import org.apache.nifi.controller.ConfigurationContext;
+import org.apache.nifi.expression.ExpressionLanguageScope;
+import org.apache.nifi.processor.exception.ProcessException;
+import org.apache.nifi.processor.util.StandardValidators;
+import org.apache.nifi.ssl.SSLContextService;
+
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.X509TrustManager;
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.List;
+
+@Tags({"oauth2", "provider", "authorization", "access token", "http"})
+@CapabilityDescription("Provides OAuth 2.0 access tokens that can be used as
Bearer authorization header in HTTP requests." +
+ " Uses Resource Owner Password Credentials Grant.")
+public class StandardOauth2AccessTokenProvider extends
AbstractControllerService implements OAuth2AccessTokenProvider {
+ public static final PropertyDescriptor AUTHORIZATION_SERVER_URL = new
PropertyDescriptor.Builder()
+ .name("authorization-server-url")
+ .displayName("Authorization Server URL")
+ .description("The URL of the authorization server that issues access
tokens.")
+ .required(true)
+ .addValidator(StandardValidators.URL_VALIDATOR)
+ .expressionLanguageSupported(ExpressionLanguageScope.VARIABLE_REGISTRY)
+ .build();
+
+ public static AllowableValue
RESOURCE_OWNER_PASSWORD_CREDENTIALS_GRANT_TYPE = new AllowableValue(
+ "password",
+ "User Password",
+ "Resource Owner Password Credentials Grant. Used to access resources
available to users. Requires username and password and usually Client ID and
Client Secret"
+ );
+ public static AllowableValue CLIENT_CREDENTIALS_GRANT_TYPE = new
AllowableValue(
+ "client_credentials",
+ "Client Credentials",
+ "Client Credentials Grant. Used to access resources available to
clients. Requires Client ID and Client Secret"
+ );
+
+ public static final PropertyDescriptor GRANT_TYPE = new
PropertyDescriptor.Builder()
+ .name("grant-type")
+ .displayName("Grant Type")
+ .description("The OAuth2 Grant Type to be used when acquiring an
access token.")
+ .required(true)
+ .allowableValues(RESOURCE_OWNER_PASSWORD_CREDENTIALS_GRANT_TYPE,
CLIENT_CREDENTIALS_GRANT_TYPE)
+
.defaultValue(RESOURCE_OWNER_PASSWORD_CREDENTIALS_GRANT_TYPE.getValue())
+ .build();
+
+ public static final PropertyDescriptor USERNAME = new
PropertyDescriptor.Builder()
+ .name("service-user-name")
+ .displayName("Username")
+ .description("Username on the service that is being accessed.")
+ .dependsOn(GRANT_TYPE, RESOURCE_OWNER_PASSWORD_CREDENTIALS_GRANT_TYPE)
+ .required(true)
+ .addValidator(StandardValidators.NON_BLANK_VALIDATOR)
+ .expressionLanguageSupported(ExpressionLanguageScope.VARIABLE_REGISTRY)
+ .build();
+
+ public static final PropertyDescriptor PASSWORD = new
PropertyDescriptor.Builder()
+ .name("service-password")
+ .displayName("Password")
+ .description("Password for the username on the service that is being
accessed.")
+ .dependsOn(GRANT_TYPE, RESOURCE_OWNER_PASSWORD_CREDENTIALS_GRANT_TYPE)
+ .required(true)
+ .sensitive(true)
+ .addValidator(StandardValidators.NON_BLANK_VALIDATOR)
+ .build();
+
+ public static final PropertyDescriptor CLIENT_ID = new
PropertyDescriptor.Builder()
+ .name("client-id")
+ .displayName("Client ID")
+ .required(false)
+ .addValidator(StandardValidators.NON_BLANK_VALIDATOR)
+ .expressionLanguageSupported(ExpressionLanguageScope.VARIABLE_REGISTRY)
+ .build();
+
+ public static final PropertyDescriptor CLIENT_SECRET = new
PropertyDescriptor.Builder()
+ .name("client-secret")
+ .displayName("Client secret")
+ .dependsOn(CLIENT_ID)
+ .required(true)
+ .sensitive(true)
+ .addValidator(StandardValidators.NON_BLANK_VALIDATOR)
+ .build();
+
+ public static final PropertyDescriptor SSL_CONTEXT = new
PropertyDescriptor.Builder()
+ .name("ssl-context")
+ .displayName("SSL Context")
+ .addValidator(Validator.VALID)
+ .identifiesControllerService(SSLContextService.class)
+ .required(false)
+ .build();
+
+ private static final List<PropertyDescriptor> PROPERTIES =
Collections.unmodifiableList(Arrays.asList(
+ AUTHORIZATION_SERVER_URL,
+ GRANT_TYPE,
+ USERNAME,
+ PASSWORD,
+ CLIENT_ID,
+ CLIENT_SECRET,
+ SSL_CONTEXT
+ ));
+
+ public static final ObjectMapper ACCESS_DETAILS_MAPPER = new ObjectMapper()
+ .configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false)
+ .setPropertyNamingStrategy(PropertyNamingStrategies.SNAKE_CASE);
+
+ private volatile String authorizationServerUrl;
+ private volatile OkHttpClient httpClient;
+
+ private volatile String grantType;
+ private volatile String username;
+ private volatile String password;
+ private volatile String clientId;
+ private volatile String clientSecret;
+
+ private volatile AccessToken accessDetails;
+
+ @Override
+ public List<PropertyDescriptor> getSupportedPropertyDescriptors() {
+ return PROPERTIES;
+ }
+
+ @OnEnabled
+ public void onEnabled(ConfigurationContext context) {
+ authorizationServerUrl =
context.getProperty(AUTHORIZATION_SERVER_URL).evaluateAttributeExpressions().getValue();
+
+ httpClient = createHttpClient(context);
+
+ grantType = context.getProperty(GRANT_TYPE).getValue();
+ username =
context.getProperty(USERNAME).evaluateAttributeExpressions().getValue();
+ password = context.getProperty(PASSWORD).getValue();
+ clientId =
context.getProperty(CLIENT_ID).evaluateAttributeExpressions().getValue();
+ clientSecret = context.getProperty(CLIENT_SECRET).getValue();
+ }
+
+ @OnDisabled
+ public void onDisabled() {
+ accessDetails = null;
+ }
+
+ @Override
+ protected Collection<ValidationResult> customValidate(ValidationContext
validationContext) {
+ final List<ValidationResult> validationResults = new
ArrayList<>(super.customValidate(validationContext));
+
+ if (
+
validationContext.getProperty(GRANT_TYPE).getValue().equals(CLIENT_CREDENTIALS_GRANT_TYPE.getValue())
Review comment:
There do not appear to be any unit tests that exercise this validation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
