You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@iotdb.apache.org by GitBox <gi...@apache.org> on 2022/04/08 06:39:21 UTC
[GitHub] [iotdb] neuyilan commented on a diff in pull request #5401: [IOTDB-2841] add permission manager model
neuyilan commented on code in PR #5401:
URL: https://github.com/apache/iotdb/pull/5401#discussion_r845717646
##########
confignode/src/main/java/org/apache/iotdb/confignode/manager/PermissonManager.java:
##########
@@ -0,0 +1,40 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.iotdb.confignode.manager;
+
+import org.apache.iotdb.confignode.physical.sys.AuthorPlan;
+import org.apache.iotdb.service.rpc.thrift.TSStatus;
+
+public class PermissonManager {
+
+ private Manager configManager;
Review Comment:
configManager -> configNodeManager
##########
confignode/src/main/java/org/apache/iotdb/confignode/persistence/AuthorInfoPersistence.java:
##########
@@ -0,0 +1,145 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.iotdb.confignode.persistence;
+
+import org.apache.iotdb.confignode.physical.PhysicalPlanType;
+import org.apache.iotdb.confignode.physical.sys.AuthorPlan;
+import org.apache.iotdb.consensus.common.DataSet;
+import org.apache.iotdb.db.auth.AuthException;
+import org.apache.iotdb.db.auth.authorizer.BasicAuthorizer;
+import org.apache.iotdb.db.auth.authorizer.IAuthorizer;
+import org.apache.iotdb.rpc.TSStatusCode;
+import org.apache.iotdb.service.rpc.thrift.TSStatus;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.Set;
+
+public class AuthorInfoPersistence {
+
+ private static final Logger logger = LoggerFactory.getLogger(AuthorInfoPersistence.class);
+
+ private IAuthorizer authorizer;
+
+ {
+ try {
+ authorizer = BasicAuthorizer.getInstance();
+ } catch (AuthException e) {
+ logger.error("get user or role info failed", e);
+ }
+ }
+
+ public TSStatus authorNonQuery(AuthorPlan authorPlan) throws AuthException {
+ PhysicalPlanType authorType = authorPlan.getAuthorType();
+ String userName = authorPlan.getUserName();
+ String roleName = authorPlan.getRoleName();
+ String password = authorPlan.getPassword();
+ String newPassword = authorPlan.getNewPassword();
+ Set<Integer> permissions = authorPlan.getPermissions();
+ String nodeName = authorPlan.getNodeName();
+ try {
+ switch (authorType) {
+ case UPDATE_USER:
+ authorizer.updateUserPassword(userName, newPassword);
+ break;
+ case CREATE_USER:
+ authorizer.createUser(userName, password);
+ break;
+ case CREATE_ROLE:
+ authorizer.createRole(roleName);
+ break;
+ case DROP_USER:
+ authorizer.deleteUser(userName);
+ break;
+ case DROP_ROLE:
+ authorizer.deleteRole(roleName);
+ break;
+ case GRANT_ROLE:
+ for (int i : permissions) {
+ authorizer.grantPrivilegeToRole(roleName, nodeName, i);
+ }
+ break;
+ case GRANT_USER:
+ for (int i : permissions) {
+ authorizer.grantPrivilegeToUser(userName, nodeName, i);
+ }
+ break;
+ case GRANT_ROLE_TO_USER:
+ authorizer.grantRoleToUser(roleName, userName);
+ break;
+ case REVOKE_USER:
+ for (int i : permissions) {
+ authorizer.revokePrivilegeFromUser(userName, nodeName, i);
+ }
+ break;
+ case REVOKE_ROLE:
+ for (int i : permissions) {
+ authorizer.revokePrivilegeFromRole(roleName, nodeName, i);
+ }
+ break;
+ case REVOKE_ROLE_FROM_USER:
+ authorizer.revokeRoleFromUser(roleName, userName);
+ break;
+ default:
+ throw new AuthException("execute " + authorPlan + " failed");
+ }
+ } catch (AuthException e) {
+ throw new AuthException("execute " + authorPlan + " failed: ", e);
+ }
+ return new TSStatus(TSStatusCode.SUCCESS_STATUS.getStatusCode());
+ }
+
+ public DataSet executeListRole(AuthorPlan plan) throws AuthException {
+ return null;
+ }
+
+ public DataSet executeListUser(AuthorPlan plan) throws AuthException {
+ return null;
+ }
Review Comment:
Why do these methods all return null? maybe it's better add some comments or TODO
##########
confignode/src/main/java/org/apache/iotdb/confignode/physical/sys/AuthorPlan.java:
##########
@@ -0,0 +1,268 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.iotdb.confignode.physical.sys;
+
+import org.apache.iotdb.confignode.physical.PhysicalPlan;
+import org.apache.iotdb.confignode.physical.PhysicalPlanType;
+import org.apache.iotdb.db.auth.AuthException;
+import org.apache.iotdb.db.auth.entity.PrivilegeType;
+
+import java.nio.ByteBuffer;
+import java.util.HashSet;
+import java.util.Set;
+
+public class AuthorPlan extends PhysicalPlan {
+
+ private PhysicalPlanType authorType;
+ private String roleName;
+ private String password;
+ private String newPassword;
+ private Set<Integer> permissions;
+ private String nodeName;
+ private String userName;
+
+ public AuthorPlan(PhysicalPlanType type) {
+ super(type);
+ }
+
+ /**
+ * AuthorPlan Constructor.
+ *
+ * @param authorType author type
+ * @param userName user name
+ * @param roleName role name
+ * @param password password
+ * @param newPassword new password
+ * @param permissions permissions
+ * @param nodeName node name in Path structure
+ * @throws AuthException Authentication Exception
+ */
+ public AuthorPlan(
+ PhysicalPlanType authorType,
+ String userName,
+ String roleName,
+ String password,
+ String newPassword,
+ Set<Integer> permissions,
+ String nodeName)
+ throws AuthException {
+ this(authorType);
+ this.authorType = authorType;
+ this.userName = userName;
+ this.roleName = roleName;
+ this.password = password;
+ this.newPassword = newPassword;
+ this.permissions = permissions;
+ this.nodeName = nodeName;
+ }
+
+ public PhysicalPlanType getAuthorType() {
+ return authorType;
+ }
+
+ public void setAuthorType(PhysicalPlanType authorType) {
+ this.authorType = authorType;
+ }
+
+ public String getRoleName() {
+ return roleName;
+ }
+
+ public void setRoleName(String roleName) {
+ this.roleName = roleName;
+ }
+
+ public String getPassword() {
+ return password;
+ }
+
+ public void setPassword(String password) {
+ this.password = password;
+ }
+
+ public String getNewPassword() {
+ return newPassword;
+ }
+
+ public void setNewPassword(String newPassword) {
+ this.newPassword = newPassword;
+ }
+
+ public Set<Integer> getPermissions() {
+ return permissions;
+ }
+
+ public void setPermissions(Set<Integer> permissions) {
+ this.permissions = permissions;
+ }
+
+ public String getNodeName() {
+ return nodeName;
+ }
+
+ public void setNodeName(String nodeName) {
+ this.nodeName = nodeName;
+ }
+
+ public String getUserName() {
+ return userName;
+ }
+
+ public void setUserName(String userName) {
+ this.userName = userName;
+ }
+
+ private Set<Integer> strToPermissions(String[] authorizationList) throws AuthException {
+ Set<Integer> result = new HashSet<>();
+ if (authorizationList == null) {
+ return result;
+ }
+ for (String s : authorizationList) {
+ PrivilegeType[] types = PrivilegeType.values();
+ boolean legal = false;
+ for (PrivilegeType privilegeType : types) {
+ if (s.equalsIgnoreCase(privilegeType.name())) {
+ result.add(privilegeType.ordinal());
+ legal = true;
+ break;
+ }
+ }
+ if (!legal) {
+ throw new AuthException("No such privilege " + s);
+ }
+ }
+ return result;
+ }
+
+ @Override
+ protected void serializeImpl(ByteBuffer buffer) {
+ buffer.putInt(getPlanTypeOrdinal(authorType));
+ buffer.putInt(userName.length());
+ buffer.put(userName.getBytes());
+ buffer.putInt(roleName.length());
+ buffer.put(roleName.getBytes());
+ buffer.putInt(password.length());
+ buffer.put(password.getBytes());
+ buffer.putInt(newPassword.length());
+ buffer.put(newPassword.getBytes());
+ if (permissions == null && permissions.size() == 0) {
+ buffer.put("false".getBytes());
+ } else {
+ buffer.put("true".getBytes());
+ buffer.putInt(permissions.size());
+ for (Integer permission : permissions) {
+ buffer.putInt(permission);
+ }
+ }
+ if (nodeName == null && nodeName.equals("")) {
+ buffer.put("false".getBytes());
+ } else {
+ buffer.put("true".getBytes());
+ buffer.putInt(nodeName.length());
+ buffer.put(nodeName.getBytes());
+ }
+ }
+
+ @Override
+ protected void deserializeImpl(ByteBuffer buffer) {
+ int type = buffer.getInt();
Review Comment:
the type is not used, we should use the type to init authorType?
##########
confignode/src/main/java/org/apache/iotdb/confignode/physical/sys/AuthorPlan.java:
##########
@@ -0,0 +1,268 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.iotdb.confignode.physical.sys;
+
+import org.apache.iotdb.confignode.physical.PhysicalPlan;
+import org.apache.iotdb.confignode.physical.PhysicalPlanType;
+import org.apache.iotdb.db.auth.AuthException;
+import org.apache.iotdb.db.auth.entity.PrivilegeType;
+
+import java.nio.ByteBuffer;
+import java.util.HashSet;
+import java.util.Set;
+
+public class AuthorPlan extends PhysicalPlan {
+
+ private PhysicalPlanType authorType;
+ private String roleName;
+ private String password;
+ private String newPassword;
+ private Set<Integer> permissions;
+ private String nodeName;
+ private String userName;
+
+ public AuthorPlan(PhysicalPlanType type) {
+ super(type);
+ }
+
+ /**
+ * AuthorPlan Constructor.
+ *
+ * @param authorType author type
+ * @param userName user name
+ * @param roleName role name
+ * @param password password
+ * @param newPassword new password
+ * @param permissions permissions
+ * @param nodeName node name in Path structure
+ * @throws AuthException Authentication Exception
+ */
+ public AuthorPlan(
+ PhysicalPlanType authorType,
+ String userName,
+ String roleName,
+ String password,
+ String newPassword,
+ Set<Integer> permissions,
+ String nodeName)
+ throws AuthException {
+ this(authorType);
+ this.authorType = authorType;
+ this.userName = userName;
+ this.roleName = roleName;
+ this.password = password;
+ this.newPassword = newPassword;
+ this.permissions = permissions;
+ this.nodeName = nodeName;
+ }
+
+ public PhysicalPlanType getAuthorType() {
+ return authorType;
+ }
+
+ public void setAuthorType(PhysicalPlanType authorType) {
+ this.authorType = authorType;
+ }
+
+ public String getRoleName() {
+ return roleName;
+ }
+
+ public void setRoleName(String roleName) {
+ this.roleName = roleName;
+ }
+
+ public String getPassword() {
+ return password;
+ }
+
+ public void setPassword(String password) {
+ this.password = password;
+ }
+
+ public String getNewPassword() {
+ return newPassword;
+ }
+
+ public void setNewPassword(String newPassword) {
+ this.newPassword = newPassword;
+ }
+
+ public Set<Integer> getPermissions() {
+ return permissions;
+ }
+
+ public void setPermissions(Set<Integer> permissions) {
+ this.permissions = permissions;
+ }
+
+ public String getNodeName() {
+ return nodeName;
+ }
+
+ public void setNodeName(String nodeName) {
+ this.nodeName = nodeName;
+ }
+
+ public String getUserName() {
+ return userName;
+ }
+
+ public void setUserName(String userName) {
+ this.userName = userName;
+ }
+
+ private Set<Integer> strToPermissions(String[] authorizationList) throws AuthException {
+ Set<Integer> result = new HashSet<>();
+ if (authorizationList == null) {
+ return result;
+ }
+ for (String s : authorizationList) {
+ PrivilegeType[] types = PrivilegeType.values();
+ boolean legal = false;
+ for (PrivilegeType privilegeType : types) {
+ if (s.equalsIgnoreCase(privilegeType.name())) {
+ result.add(privilegeType.ordinal());
+ legal = true;
+ break;
+ }
+ }
+ if (!legal) {
+ throw new AuthException("No such privilege " + s);
+ }
+ }
+ return result;
+ }
Review Comment:
This method is not used?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@iotdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org