You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@solr.apache.org by ja...@apache.org on 2023/02/15 14:18:29 UTC
[solr] branch main updated: SOLR-16658 List of permissions returned to Admin UI is not complete (#1359)
This is an automated email from the ASF dual-hosted git repository.
janhoy pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/solr.git
The following commit(s) were added to refs/heads/main by this push:
new 62efc319c50 SOLR-16658 List of permissions returned to Admin UI is not complete (#1359)
62efc319c50 is described below
commit 62efc319c50ada82d512805abae5a05fbff5c11d
Author: Jan Høydahl <ja...@users.noreply.github.com>
AuthorDate: Wed Feb 15 15:18:22 2023 +0100
SOLR-16658 List of permissions returned to Admin UI is not complete (#1359)
---
solr/CHANGES.txt | 2 ++
.../solr/handler/admin/SystemInfoHandler.java | 7 ++++-
.../security/RuleBasedAuthorizationPluginBase.java | 30 +++++++++++++++++-----
.../BaseTestRuleBasedAuthorizationPlugin.java | 6 +++++
4 files changed, 37 insertions(+), 8 deletions(-)
diff --git a/solr/CHANGES.txt b/solr/CHANGES.txt
index 4fcb4302811..305c1778ffd 100644
--- a/solr/CHANGES.txt
+++ b/solr/CHANGES.txt
@@ -204,6 +204,8 @@ Bug Fixes
* SOLR-16639: Fix jq parse error of solr-exporter metrics node_thread_pool_completed_total (Naoto Minami)
+* SOLR-16658: List of permissions returned to Admin UI is not complete (janhoy)
+
Build
---------------------
* Upgrade forbiddenapis to 3.4 (Uwe Schindler)
diff --git a/solr/core/src/java/org/apache/solr/handler/admin/SystemInfoHandler.java b/solr/core/src/java/org/apache/solr/handler/admin/SystemInfoHandler.java
index 927cfe593d0..b36ab3e4d99 100644
--- a/solr/core/src/java/org/apache/solr/handler/admin/SystemInfoHandler.java
+++ b/solr/core/src/java/org/apache/solr/handler/admin/SystemInfoHandler.java
@@ -34,6 +34,8 @@ import java.util.Date;
import java.util.List;
import java.util.Locale;
import java.util.Set;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
import org.apache.lucene.util.Version;
import org.apache.solr.api.AnnotatedApi;
import org.apache.solr.api.Api;
@@ -339,7 +341,10 @@ public class SystemInfoHandler extends RequestHandlerBase {
RuleBasedAuthorizationPluginBase rbap = (RuleBasedAuthorizationPluginBase) auth;
Set<String> roles = rbap.getUserRoles(req.getUserPrincipal());
info.add("roles", roles);
- info.add("permissions", rbap.getPermissionNamesForRoles(roles));
+ info.add(
+ "permissions",
+ rbap.getPermissionNamesForRoles(
+ Stream.concat(roles.stream(), Stream.of("*", null)).collect(Collectors.toSet())));
}
}
diff --git a/solr/core/src/java/org/apache/solr/security/RuleBasedAuthorizationPluginBase.java b/solr/core/src/java/org/apache/solr/security/RuleBasedAuthorizationPluginBase.java
index 9615d6dfcdc..7c37e034c73 100644
--- a/solr/core/src/java/org/apache/solr/security/RuleBasedAuthorizationPluginBase.java
+++ b/solr/core/src/java/org/apache/solr/security/RuleBasedAuthorizationPluginBase.java
@@ -25,6 +25,8 @@ import java.lang.invoke.MethodHandles;
import java.security.Principal;
import java.util.ArrayList;
import java.util.Arrays;
+import java.util.Collection;
+import java.util.Collections;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
@@ -118,8 +120,22 @@ public abstract class RuleBasedAuthorizationPluginBase
return flag.rsp;
}
- /** Retrieves permission names for a given set of roles */
- public Set<String> getPermissionNamesForRoles(Set<String> roles) {
+ /**
+ * Retrieves permission names for a given set of roles.
+ *
+ * <p>There are two special role names that can be used in the roles list:
+ *
+ * <ul>
+ * <li><code>null</code> meaning permission granted for all requests, even without a role
+ * <li><code>"*"</code> meaning any role will grant the permission
+ * </ul>
+ *
+ * In order to obtain all permissions a user has based on the user's roles, you also need to
+ * include these two special roles to get the full list.
+ *
+ * @param roles a collection of role names.
+ */
+ public Set<String> getPermissionNamesForRoles(Collection<String> roles) {
if (roles == null) {
return Set.of();
}
@@ -340,11 +356,11 @@ public abstract class RuleBasedAuthorizationPluginBase
perms.add(permission);
}
}
- if (permission.role != null) {
- for (String r : permission.role) {
- Set<Permission> rm = roleToPermissionsMap.computeIfAbsent(r, k -> new HashSet<>());
- rm.add(permission);
- }
+ Collection<String> roles =
+ permission.role != null ? permission.role : Collections.singletonList(null);
+ for (String r : roles) {
+ Set<Permission> rm = roleToPermissionsMap.computeIfAbsent(r, k -> new HashSet<>());
+ rm.add(permission);
}
}
diff --git a/solr/core/src/test/org/apache/solr/security/BaseTestRuleBasedAuthorizationPlugin.java b/solr/core/src/test/org/apache/solr/security/BaseTestRuleBasedAuthorizationPlugin.java
index 45c58ef68dd..a19bfccb5c9 100644
--- a/solr/core/src/test/org/apache/solr/security/BaseTestRuleBasedAuthorizationPlugin.java
+++ b/solr/core/src/test/org/apache/solr/security/BaseTestRuleBasedAuthorizationPlugin.java
@@ -31,6 +31,7 @@ import java.io.StringReader;
import java.security.Principal;
import java.util.Arrays;
import java.util.Collection;
+import java.util.Collections;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.List;
@@ -719,6 +720,11 @@ public class BaseTestRuleBasedAuthorizationPlugin extends SolrTestCaseJ4 {
Set.of("schema-edit", "collection-admin-edit", "mycoll_update", "read"),
plugin.getPermissionNamesForRoles(Set.of("admin", "dev")));
assertEquals(emptySet(), plugin.getPermissionNamesForRoles(null));
+ assertEquals(
+ Set.of("collection-admin-read"),
+ plugin.getPermissionNamesForRoles(Collections.singletonList(null)));
+ assertEquals(
+ Set.of("freeforall"), plugin.getPermissionNamesForRoles(Collections.singletonList("*")));
} catch (IOException e) {
; // swallow error, otherwise you have to add a _lot_ of exceptions to methods.
}