[
https://issues.apache.org/jira/browse/NIFI-4907?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16509606#comment-16509606
]
ASF GitHub Bot commented on NIFI-4907:
--------------------------------------
Github user markobean commented on a diff in the pull request:
https://github.com/apache/nifi/pull/2703#discussion_r194730011
--- Diff:
nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/controller/ControllerFacade.java
---
@@ -1338,6 +1339,67 @@ private void authorizeReplay(final
ProvenanceEventRecord event) {
dataAuthorizable.authorize(authorizer, RequestAction.WRITE, user,
eventAttributes);
}
+ private AuthorizationResult
checkAuthorizationForData(ProvenanceEventRecord event) {
+ final NiFiUser user = NiFiUserUtils.getNiFiUser();
+ final Authorizable dataAuthorizable;
+ if (event.isRemotePortType()) {
+ dataAuthorizable =
flowController.createRemoteDataAuthorizable(event.getComponentId());
+ } else {
+ dataAuthorizable =
flowController.createLocalDataAuthorizable(event.getComponentId());
+ }
+
+ final Map<String, String> eventAttributes = event.getAttributes();
+
+ // ensure we can read the data
+ return dataAuthorizable.checkAuthorization(authorizer,
RequestAction.READ, user, eventAttributes);
+ }
+
+ private AuthorizationResult checkAuthorizationForProvenanceData(final
ProvenanceEventRecord event) {
+ final ProcessGroup rootGroup =
flowController.getGroup(getRootGroupId());
+ final NiFiUser user = NiFiUserUtils.getNiFiUser();
+ final String componentId = event.getComponentId();
+ Connectable connectable;
+ String targetId = null;
+ // check if the component is the rootGroup
+ if (getRootGroupId().equals(componentId)) {
+ targetId = componentId;
+ }
+ if (targetId == null) {
+ // check if the component is a processor
+ connectable = rootGroup.findProcessor(componentId);
+ if (connectable == null) {
+ // if the component id is not a processor then consider a
connection
+ connectable =
rootGroup.findConnection(componentId).getSource();
+
+ if (connectable == null) {
+ throw new ResourceNotFoundException("The component
that generated this event is no longer part of the data flow");
+ }
+ }
+ targetId = connectable.getIdentifier();
+ }
+ final Authorizable provenanceDataAuthorizable =
flowController.createProvenanceDataAuthorizable(targetId);
+
+ return provenanceDataAuthorizable.checkAuthorization(authorizer,
RequestAction.READ, user);
+ }
+
+ private AuthorizationResult checkConnectableAuthorization(final String
componentId) {
+ final ProcessGroup rootGroup =
flowController.getGroup(getRootGroupId());
+ final NiFiUser user = NiFiUserUtils.getNiFiUser();
+ if (rootGroup.getIdentifier().equals(componentId)) {
+ return rootGroup.checkAuthorization(authorizer,
RequestAction.READ, user);
+ }
+ Connectable connectable =
rootGroup.findLocalConnectable(componentId);
--- End diff --
Will findLocalConnectable() versus findProcessor() include connections as
well? If so, then this should return to findProcessor() to account for
connections and subsequently finding the connection's source component.
> Provenance authorization refactoring
> ------------------------------------
>
> Key: NIFI-4907
> URL: https://issues.apache.org/jira/browse/NIFI-4907
> Project: Apache NiFi
> Issue Type: Bug
> Components: Core Framework
> Affects Versions: 1.5.0
> Reporter: Mark Bean
> Assignee: Mark Bean
> Priority: Major
>
> Currently, the 'view the data' component policy is too tightly coupled with
> Provenance queries. The 'query provenance' policy should be the only policy
> required for viewing Provenance query results. Both 'view the component' and
> 'view the data' policies should be used to refine the appropriate visibility
> of event details - but not the event itself.
> 1) Component Visibility
> The authorization of Provenance events is inconsistent with the behavior of
> the graph. For example, if a user does not have 'view the component' policy,
> the graph shows this component as a "black box" (no details such as name,
> UUID, etc.) However, when querying Provenance, this component will show up
> including the Component Type and the Component Name. This is in effect a
> violation of the policy. These component details should be obscured in the
> Provenance event displayed if user does not have the appropriate 'view the
> component' policy.
> 2) Data Visibility
> For a Provenance query, all events should be visible as long as the user
> performing the query belongs to the 'query provenance' global policy. As
> mentioned above, some information about the component may be obscured
> depending on 'view the component' policy, but the event itself should be
> visible. Additionally, details of the event (clicking the View Details "i"
> icon) should only be accessible if the user belongs to the 'view the data'
> policy for the affected component. If the user is not in the appropriate
> 'view the data' policy, a popup warning should be displayed indicating the
> reason details are not visible with more specific detail than the current
> "Contact the system administrator".
> 3) Lineage Graphs
> As with the Provenance table view recommendation above, the lineage graph
> should display all events. Currently, if the lineage graph includes an event
> belonging to a component which the user does not have 'view the data', it is
> shown on the graph as "UNKNOWN". As with Data Visibility mentioned above, the
> graph should indicate the event type as long as the user is in the 'view the
> component'. Subsequent "View Details" on the event should only be visible if
> the user is in the 'view the data' policy.
> In summary, for Provenance query results and lineage graphs, all events
> should be shown. Component Name and Component Type information should be
> conditionally visible depending on the corresponding component policy 'view
> the component' policy. Event details including Provenance event type and
> FlowFile information should be conditionally available depending on the
> corresponding component policy 'view the data'. Inability to display event
> details should provide feedback to the user indicating the reason.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
