You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@kylin.apache.org by GitBox <gi...@apache.org> on 2022/09/22 09:59:58 UTC
[GitHub] [kylin] Syleechan opened a new pull request, #1986: KYLIN-5270: Contribute eBay's part authentication mechanism to kylin5
Syleechan opened a new pull request, #1986:
URL: https://github.com/apache/kylin/pull/1986
## Proposed changes
Contribute eBay's part authentication mechanism to kylin5
## Branch to commit
- [ ] Branch **kylin3** for v2.x to v3.x
- [ ] Branch **kylin4** for v4.x
- [x] Branch **kylin5** for v5.x
## Types of changes
What types of changes does your code introduce to Kylin?
_Put an `x` in the boxes that apply_
- [ ] Bugfix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
- [ ] Documentation Update (if none of the other choices apply)
## Checklist
_Put an `x` in the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of them, don't hesitate to ask. We're here to help! This is simply a reminder of what we are going to look for before merging your code._
- [x] I have created an issue on [Kylin's jira](https://issues.apache.org/jira/browse/KYLIN), and have described the bug/feature there in detail
- [x] Commit messages in my PR start with the related jira ID, like "KYLIN-0000 Make Kylin project open-source"
- [x] Compiling and unit tests pass locally with my changes
- [ ] I have added tests that prove my fix is effective or that my feature works
- [ ] I have added necessary documentation (if appropriate)
- [ ] Any dependent changes have been merged
## Further comments
If this is a relatively large or complex change, kick off the discussion at user@kylin.apache.org or dev@kylin.apache.org by explaining why you chose the solution you did and what alternatives you considered, etc...
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@kylin.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kylin] Mukvin commented on a diff in pull request #1986: KYLIN-5270: Contribute eBay's part authentication mechanism to kylin5
Posted by GitBox <gi...@apache.org>.
Mukvin commented on code in PR #1986:
URL: https://github.com/apache/kylin/pull/1986#discussion_r980859340
##########
src/common-service/src/main/java/org/apache/kylin/rest/service/CustomUserServiceWithAccess.java:
##########
@@ -0,0 +1,122 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.kylin.rest.service;
+
+import org.apache.kylin.common.KylinConfig;
+import org.apache.kylin.metadata.user.ManagedUser;
+import org.apache.kylin.metadata.user.NKylinUserManager;
+import org.apache.kylin.query.security.AccessDeniedException;
+import org.apache.kylin.rest.exception.InternalErrorException;
+import org.apache.kylin.rest.security.AccessProvider;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.util.Assert;
+
+import java.io.IOException;
+import java.util.List;
+
+public class CustomUserServiceWithAccess extends OpenUserService{
+
+ private Logger logger = LoggerFactory.getLogger(CustomUserServiceWithAccess.class);
+
+ public static final String SUPER_ADMIN = "ADMIN";
+
+ private final AccessProvider accessProvider;
+
+ private final UserService userService;
+
+ public CustomUserServiceWithAccess(AccessProvider accessProvider, UserService userService) {
+ Assert.notNull(accessProvider, "The accessProvider should not be null.");
+ Assert.notNull(userService, "The userService should not be null.");
+ this.accessProvider = accessProvider;
+ this.userService = userService;
+ }
+
+ /**
+ * check whether the new user can access Kylin System
+ */
+ @Override
+ public void createUser(UserDetails user) {
+ accessProvider.checkAccessible(user.getUsername());//visit bdp hive or other corp inner service
+ userService.createUser(user);
+ }
+
+ @Override
+ public void updateUser(UserDetails user) {
+ userService.updateUser(user);
+ }
+
+ @Override
+ public boolean userExists(String userName){
Review Comment:
username maybe better.
##########
src/common-service/src/main/java/org/apache/kylin/rest/service/CustomUserServiceWithAccess.java:
##########
@@ -0,0 +1,122 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.kylin.rest.service;
+
+import org.apache.kylin.common.KylinConfig;
+import org.apache.kylin.metadata.user.ManagedUser;
+import org.apache.kylin.metadata.user.NKylinUserManager;
+import org.apache.kylin.query.security.AccessDeniedException;
+import org.apache.kylin.rest.exception.InternalErrorException;
+import org.apache.kylin.rest.security.AccessProvider;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.util.Assert;
+
+import java.io.IOException;
+import java.util.List;
+
+public class CustomUserServiceWithAccess extends OpenUserService{
+
+ private Logger logger = LoggerFactory.getLogger(CustomUserServiceWithAccess.class);
+
+ public static final String SUPER_ADMIN = "ADMIN";
+
+ private final AccessProvider accessProvider;
+
+ private final UserService userService;
+
+ public CustomUserServiceWithAccess(AccessProvider accessProvider, UserService userService) {
+ Assert.notNull(accessProvider, "The accessProvider should not be null.");
+ Assert.notNull(userService, "The userService should not be null.");
+ this.accessProvider = accessProvider;
+ this.userService = userService;
+ }
+
+ /**
+ * check whether the new user can access Kylin System
+ */
+ @Override
+ public void createUser(UserDetails user) {
+ accessProvider.checkAccessible(user.getUsername());//visit bdp hive or other corp inner service
+ userService.createUser(user);
+ }
+
+ @Override
+ public void updateUser(UserDetails user) {
+ userService.updateUser(user);
+ }
+
+ @Override
+ public boolean userExists(String userName){
+ boolean ifRegistered = userService.userExists(userName);
+ if(!ifRegistered){
+ try{
+ accessProvider.checkAccessible(userName);// default true
+ } catch (AccessDeniedException e){
+ logger.info("user {} is not able to access Kylin due to ", userName, e);
+ return false;
+ }
+ ManagedUser newUser = new ManagedUser(userName);
+ userService.createUser(newUser);
+ }
+ return true;
+ }
+
+
+
+ @Override
+ public List<ManagedUser> listUsers() throws IOException {
+ return userService.listUsers();
+ }
+
+ @Override
+ public List<String> listAdminUsers() throws IOException {
+ return userService.listAdminUsers();
+ }
+
+ @Override
+ public void completeUserInfo(ManagedUser user) {
+ userService.completeUserInfo(user);
+ }
+
+
+ @Override
+ public UserDetails loadUserByUsername(String userName) {
+ if(!userExists(userName)){//if not in registered list, then need to check BDP access ability
+ throw new AccessDeniedException(userName + " is unable to access Kylin System");
+ }
+ return userService.loadUserByUsername(userName);
+ }
+
+ @Override
+ public void deleteUser(String userName) {
Review Comment:
username may be better.
##########
src/common-service/src/main/java/org/apache/kylin/rest/service/CustomUserServiceWithAccess.java:
##########
@@ -0,0 +1,122 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.kylin.rest.service;
+
+import org.apache.kylin.common.KylinConfig;
+import org.apache.kylin.metadata.user.ManagedUser;
+import org.apache.kylin.metadata.user.NKylinUserManager;
+import org.apache.kylin.query.security.AccessDeniedException;
+import org.apache.kylin.rest.exception.InternalErrorException;
+import org.apache.kylin.rest.security.AccessProvider;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.util.Assert;
+
+import java.io.IOException;
+import java.util.List;
+
+public class CustomUserServiceWithAccess extends OpenUserService{
+
+ private Logger logger = LoggerFactory.getLogger(CustomUserServiceWithAccess.class);
+
+ public static final String SUPER_ADMIN = "ADMIN";
+
+ private final AccessProvider accessProvider;
+
+ private final UserService userService;
+
+ public CustomUserServiceWithAccess(AccessProvider accessProvider, UserService userService) {
+ Assert.notNull(accessProvider, "The accessProvider should not be null.");
+ Assert.notNull(userService, "The userService should not be null.");
+ this.accessProvider = accessProvider;
+ this.userService = userService;
+ }
+
+ /**
+ * check whether the new user can access Kylin System
+ */
+ @Override
+ public void createUser(UserDetails user) {
+ accessProvider.checkAccessible(user.getUsername());//visit bdp hive or other corp inner service
+ userService.createUser(user);
+ }
+
+ @Override
+ public void updateUser(UserDetails user) {
+ userService.updateUser(user);
+ }
+
+ @Override
+ public boolean userExists(String userName){
+ boolean ifRegistered = userService.userExists(userName);
+ if(!ifRegistered){
+ try{
+ accessProvider.checkAccessible(userName);// default true
+ } catch (AccessDeniedException e){
+ logger.info("user {} is not able to access Kylin due to ", userName, e);
+ return false;
+ }
+ ManagedUser newUser = new ManagedUser(userName);
+ userService.createUser(newUser);
+ }
+ return true;
Review Comment:
this logic looks a little weird.
if accessProvider.checkAccessible(userName) is false, it will create a new user. And if it is true, it will create a new user too by code reading directly.
And this method does two things, check user exists and create a new user.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@kylin.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kylin] hit-lacus commented on pull request #1986: KYLIN-5270: Contribute eBay's part authentication mechanism to kylin5
Posted by GitBox <gi...@apache.org>.
hit-lacus commented on PR #1986:
URL: https://github.com/apache/kylin/pull/1986#issuecomment-1299504020
Can one of the admins verify this patch?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@kylin.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kylin] Syleechan commented on a diff in pull request #1986: KYLIN-5270: Contribute eBay's part authentication mechanism to kylin5
Posted by GitBox <gi...@apache.org>.
Syleechan commented on code in PR #1986:
URL: https://github.com/apache/kylin/pull/1986#discussion_r983028012
##########
src/common-service/src/main/java/org/apache/kylin/rest/service/CustomUserServiceWithAccess.java:
##########
@@ -0,0 +1,122 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.kylin.rest.service;
+
+import org.apache.kylin.common.KylinConfig;
+import org.apache.kylin.metadata.user.ManagedUser;
+import org.apache.kylin.metadata.user.NKylinUserManager;
+import org.apache.kylin.query.security.AccessDeniedException;
+import org.apache.kylin.rest.exception.InternalErrorException;
+import org.apache.kylin.rest.security.AccessProvider;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.util.Assert;
+
+import java.io.IOException;
+import java.util.List;
+
+public class CustomUserServiceWithAccess extends OpenUserService{
+
+ private Logger logger = LoggerFactory.getLogger(CustomUserServiceWithAccess.class);
+
+ public static final String SUPER_ADMIN = "ADMIN";
+
+ private final AccessProvider accessProvider;
+
+ private final UserService userService;
+
+ public CustomUserServiceWithAccess(AccessProvider accessProvider, UserService userService) {
+ Assert.notNull(accessProvider, "The accessProvider should not be null.");
+ Assert.notNull(userService, "The userService should not be null.");
+ this.accessProvider = accessProvider;
+ this.userService = userService;
+ }
+
+ /**
+ * check whether the new user can access Kylin System
+ */
+ @Override
+ public void createUser(UserDetails user) {
+ accessProvider.checkAccessible(user.getUsername());//visit bdp hive or other corp inner service
+ userService.createUser(user);
+ }
+
+ @Override
+ public void updateUser(UserDetails user) {
+ userService.updateUser(user);
+ }
+
+ @Override
+ public boolean userExists(String userName){
+ boolean ifRegistered = userService.userExists(userName);
+ if(!ifRegistered){
+ try{
+ accessProvider.checkAccessible(userName);// default true
+ } catch (AccessDeniedException e){
+ logger.info("user {} is not able to access Kylin due to ", userName, e);
+ return false;
+ }
+ ManagedUser newUser = new ManagedUser(userName);
+ userService.createUser(newUser);
+ }
+ return true;
Review Comment:
>
this logic first check if the user in system just use KylinUserService to check, if false then use accessProvider.checkAccessible(userName) to check, if false it will return fasle then method loadUserByUserName in class SelfManagedAuthoritiesPopulator would throw exception; if accessProvider.checkAccessible(userName) is true means user can access system and create user info.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@kylin.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org