You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@nifi.apache.org by mc...@apache.org on 2016/06/28 18:26:22 UTC
nifi git commit: NIFI-2127 Adding support for managing the user-group
relationship from the Group side. This closes #588
Repository: nifi
Updated Branches:
refs/heads/master bb0ea7874 -> 8c837ba1e
NIFI-2127 Adding support for managing the user-group relationship from the Group side. This closes #588
Project: http://git-wip-us.apache.org/repos/asf/nifi/repo
Commit: http://git-wip-us.apache.org/repos/asf/nifi/commit/8c837ba1
Tree: http://git-wip-us.apache.org/repos/asf/nifi/tree/8c837ba1
Diff: http://git-wip-us.apache.org/repos/asf/nifi/diff/8c837ba1
Branch: refs/heads/master
Commit: 8c837ba1eacb1227d9b51b6dbc8fbcd5f204954a
Parents: bb0ea78
Author: Bryan Bende <bb...@apache.org>
Authored: Tue Jun 28 12:00:17 2016 -0400
Committer: Matt Gilman <ma...@gmail.com>
Committed: Tue Jun 28 14:25:38 2016 -0400
----------------------------------------------------------------------
.../org/apache/nifi/authorization/Group.java | 3 -
.../nifi/authorization/FileAuthorizer.java | 81 +++++++++++++++++++-
.../nifi/authorization/FileAuthorizerTest.java | 60 ++++++++++++++-
.../webapp/js/nf/cluster/nf-cluster-table.js | 2 +-
4 files changed, 138 insertions(+), 8 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/nifi/blob/8c837ba1/nifi-api/src/main/java/org/apache/nifi/authorization/Group.java
----------------------------------------------------------------------
diff --git a/nifi-api/src/main/java/org/apache/nifi/authorization/Group.java b/nifi-api/src/main/java/org/apache/nifi/authorization/Group.java
index c208dba..7db619a 100644
--- a/nifi-api/src/main/java/org/apache/nifi/authorization/Group.java
+++ b/nifi-api/src/main/java/org/apache/nifi/authorization/Group.java
@@ -61,9 +61,6 @@ public class Group { // TODO rename to UserGroup
}
/**
- * NOTE: This set of users is populated when retrieving an existing group and will be ignored when adding a new Group.
- * To add a User to a group, it should be done by adding or updating a User with the appropriate Group id.
- *
* @return an unmodifiable set of user identifiers that belong to this group
*/
public Set<String> getUsers() {
http://git-wip-us.apache.org/repos/asf/nifi/blob/8c837ba1/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/main/java/org/apache/nifi/authorization/FileAuthorizer.java
----------------------------------------------------------------------
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/main/java/org/apache/nifi/authorization/FileAuthorizer.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/main/java/org/apache/nifi/authorization/FileAuthorizer.java
index eb5cf48..5c8c9ff 100644
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/main/java/org/apache/nifi/authorization/FileAuthorizer.java
+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/main/java/org/apache/nifi/authorization/FileAuthorizer.java
@@ -59,6 +59,7 @@ import java.nio.file.StandardOpenOption;
import java.util.ArrayList;
import java.util.Collections;
import java.util.Date;
+import java.util.HashSet;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
@@ -642,12 +643,28 @@ public class FileAuthorizer extends AbstractPolicyBasedAuthorizer {
throw new IllegalArgumentException("Group cannot be null");
}
+ final Authorizations authorizations = this.authorizationsHolder.get().getAuthorizations();
+
+ // determine that all users in the group exist before doing anything, throw an exception if they don't
+ final Set<org.apache.nifi.authorization.file.generated.User> jaxbUsers = checkGroupUsers(group, authorizations.getUsers().getUser());
+
// create a new JAXB Group based on the incoming Group
final org.apache.nifi.authorization.file.generated.Group jaxbGroup = new org.apache.nifi.authorization.file.generated.Group();
jaxbGroup.setIdentifier(group.getIdentifier());
jaxbGroup.setName(group.getName());
- final Authorizations authorizations = this.authorizationsHolder.get().getAuthorizations();
+ // find each user and add the group to that user
+ for (String groupUser : group.getUsers()) {
+ for (org.apache.nifi.authorization.file.generated.User jaxbUser : jaxbUsers) {
+ if (jaxbUser.getIdentifier().equals(groupUser)) {
+ final org.apache.nifi.authorization.file.generated.User.Group jaxbUserGroup = new org.apache.nifi.authorization.file.generated.User.Group();
+ jaxbUserGroup.setIdentifier(group.getIdentifier());
+ jaxbUser.getGroup().add(jaxbUserGroup);
+ break;
+ }
+ }
+ }
+
authorizations.getGroups().getGroup().add(jaxbGroup);
saveAndRefreshHolder(authorizations);
@@ -670,11 +687,13 @@ public class FileAuthorizer extends AbstractPolicyBasedAuthorizer {
}
final Authorizations authorizations = this.authorizationsHolder.get().getAuthorizations();
- final List<org.apache.nifi.authorization.file.generated.Group> groups = authorizations.getGroups().getGroup();
+
+ // determine that all users in the group exist before doing anything, throw an exception if they don't
+ final Set<org.apache.nifi.authorization.file.generated.User> jaxbUsers = checkGroupUsers(group, authorizations.getUsers().getUser());
// find the group that needs to be update
org.apache.nifi.authorization.file.generated.Group updateGroup = null;
- for (org.apache.nifi.authorization.file.generated.Group jaxbGroup : groups) {
+ for (org.apache.nifi.authorization.file.generated.Group jaxbGroup : authorizations.getGroups().getGroup()) {
if (jaxbGroup.getIdentifier().equals(group.getIdentifier())) {
updateGroup = jaxbGroup;
break;
@@ -686,6 +705,43 @@ public class FileAuthorizer extends AbstractPolicyBasedAuthorizer {
return null;
}
+ // now we know group and all users exist so perform the updates
+
+ // first find each user and add the group to that user
+ for (String groupUser : group.getUsers()) {
+ for (org.apache.nifi.authorization.file.generated.User jaxbUser : jaxbUsers) {
+ if (jaxbUser.getIdentifier().equals(groupUser)) {
+ final org.apache.nifi.authorization.file.generated.User.Group jaxbUserGroup = new org.apache.nifi.authorization.file.generated.User.Group();
+ jaxbUserGroup.setIdentifier(group.getIdentifier());
+ jaxbUser.getGroup().add(jaxbUserGroup);
+ break;
+ }
+ }
+ }
+
+ // now go through every user, check each group in the user to see if it still
+ for (org.apache.nifi.authorization.file.generated.User jaxbUser : authorizations.getUsers().getUser()) {
+ Iterator<org.apache.nifi.authorization.file.generated.User.Group> userGroupIter = jaxbUser.getGroup().iterator();
+ while (userGroupIter.hasNext()) {
+ final org.apache.nifi.authorization.file.generated.User.Group userGroup = userGroupIter.next();
+
+ // we only care about finding the group that is currently being updated
+ if (userGroup.getIdentifier().equals(group.getIdentifier())) {
+ boolean stillInGroup = false;
+ for (String groupUser : group.getUsers()) {
+ if (groupUser.equals(jaxbUser.getIdentifier())) {
+ stillInGroup = true;
+ break;
+ }
+ }
+
+ if (!stillInGroup) {
+ userGroupIter.remove();
+ }
+ }
+ }
+ }
+
updateGroup.setName(group.getName());
saveAndRefreshHolder(authorizations);
@@ -747,6 +803,25 @@ public class FileAuthorizer extends AbstractPolicyBasedAuthorizer {
return authorizationsHolder.get().getAllGroups();
}
+ private Set<org.apache.nifi.authorization.file.generated.User> checkGroupUsers(final Group group, final List<org.apache.nifi.authorization.file.generated.User> users) {
+ final Set<org.apache.nifi.authorization.file.generated.User> jaxbUsers = new HashSet<>();
+ for (String groupUser : group.getUsers()) {
+ boolean found = false;
+ for (org.apache.nifi.authorization.file.generated.User jaxbUser : users) {
+ if (jaxbUser.getIdentifier().equals(groupUser)) {
+ jaxbUsers.add(jaxbUser);
+ found = true;
+ break;
+ }
+ }
+
+ if (!found) {
+ throw new IllegalStateException("Unable to add group because user " + groupUser + " does not exist");
+ }
+ }
+ return jaxbUsers;
+ }
+
// ------------------ Users ------------------
@Override
http://git-wip-us.apache.org/repos/asf/nifi/blob/8c837ba1/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/test/java/org/apache/nifi/authorization/FileAuthorizerTest.java
----------------------------------------------------------------------
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/test/java/org/apache/nifi/authorization/FileAuthorizerTest.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/test/java/org/apache/nifi/authorization/FileAuthorizerTest.java
index 0b2fea4..8d49928 100644
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/test/java/org/apache/nifi/authorization/FileAuthorizerTest.java
+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/test/java/org/apache/nifi/authorization/FileAuthorizerTest.java
@@ -748,7 +748,6 @@ public class FileAuthorizerTest {
final Group group = new Group.Builder()
.identifier("group-id-1")
.name("group-name-1")
- .addUser("user1") // should be ignored
.build();
final Group addedGroup = authorizer.addGroup(group);
@@ -762,6 +761,48 @@ public class FileAuthorizerTest {
}
@Test
+ public void testAddGroupWithUser() throws Exception {
+ writeAuthorizationsFile(primary, AUTHORIZATIONS);
+ authorizer.onConfigured(configurationContext);
+ assertEquals(2, authorizer.getGroups().size());
+
+ final Group group = new Group.Builder()
+ .identifier("group-id-XXX")
+ .name("group-name-XXX")
+ .addUser("user-1")
+ .build();
+
+ final Group addedGroup = authorizer.addGroup(group);
+ assertNotNull(addedGroup);
+ assertEquals(group.getIdentifier(), addedGroup.getIdentifier());
+ assertEquals(group.getName(), addedGroup.getName());
+ assertEquals(1, addedGroup.getUsers().size());
+
+ final Set<Group> groups = authorizer.getGroups();
+ assertEquals(3, groups.size());
+
+ final User user = authorizer.getUser("user-1");
+ assertNotNull(user);
+ assertTrue(user.getGroups().contains(group.getIdentifier()));
+ }
+
+
+ @Test(expected = IllegalStateException.class)
+ public void testAddGroupWhenUserDoesNotExist() throws Exception {
+ writeAuthorizationsFile(primary, EMPTY_AUTHORIZATIONS);
+ authorizer.onConfigured(configurationContext);
+ assertEquals(0, authorizer.getGroups().size());
+
+ final Group group = new Group.Builder()
+ .identifier("group-id-1")
+ .name("group-name-1")
+ .addUser("user1")
+ .build();
+
+ authorizer.addGroup(group);
+ }
+
+ @Test
public void testGetGroupByIdentifierWhenFound() throws Exception {
writeAuthorizationsFile(primary, AUTHORIZATIONS);
authorizer.onConfigured(configurationContext);
@@ -847,14 +888,31 @@ public class FileAuthorizerTest {
authorizer.onConfigured(configurationContext);
assertEquals(2, authorizer.getGroups().size());
+ // verify user-1 is in group-1 before the update
+ final User user1Before = authorizer.getUser("user-1");
+ assertTrue(user1Before.getGroups().contains("group-1"));
+
+ // verify user-2 is NOT in group-1 before the update
+ final User user2Before = authorizer.getUser("user-2");
+ assertFalse(user2Before.getGroups().contains("group-1"));
+
final Group group = new Group.Builder()
.identifier("group-1")
.name("new-name")
+ .addUser("user-2")
.build();
final Group updatedGroup = authorizer.updateGroup(group);
assertEquals(group.getIdentifier(), updatedGroup.getIdentifier());
assertEquals(group.getName(), updatedGroup.getName());
+
+ // user-1 should no longer be in group-1
+ final User user1After = authorizer.getUser("user-1");
+ assertFalse(user1After.getGroups().contains("group-1"));
+
+ // user-2 should now be in group-1
+ final User user2After = authorizer.getUser("user-2");
+ assertTrue(user2After.getGroups().contains("group-1"));
}
@Test
http://git-wip-us.apache.org/repos/asf/nifi/blob/8c837ba1/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/cluster/nf-cluster-table.js
----------------------------------------------------------------------
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/cluster/nf-cluster-table.js b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/cluster/nf-cluster-table.js
index 47a83e0..7aa2450 100644
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/cluster/nf-cluster-table.js
+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-ui/src/main/webapp/js/nf/cluster/nf-cluster-table.js
@@ -28,7 +28,7 @@ nf.ClusterTable = (function () {
filterList: 'cluster-filter-list'
},
urls: {
- cluster: '../nifi-api/cluster',
+ cluster: '../nifi-api/controller/cluster',
nodes: '../nifi-api/controller/cluster/nodes'
}
};