You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@iotdb.apache.org by "shuolinl (via GitHub)" <gi...@apache.org> on 2023/09/06 01:06:35 UTC
[GitHub] [iotdb] shuolinl opened a new pull request, #11049: Auth
shuolinl opened a new pull request, #11049:
URL: https://github.com/apache/iotdb/pull/11049
(no comment)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@iotdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [iotdb] JackieTien97 merged pull request #11049: Auth
Posted by "JackieTien97 (via GitHub)" <gi...@apache.org>.
JackieTien97 merged PR #11049:
URL: https://github.com/apache/iotdb/pull/11049
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@iotdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [iotdb] shuolinl commented on pull request #11049: Auth
Posted by "shuolinl (via GitHub)" <gi...@apache.org>.
shuolinl commented on PR #11049:
URL: https://github.com/apache/iotdb/pull/11049#issuecomment-1707505573
<img width="810" alt="截屏2023-09-06 09 11 49" src="https://github.com/apache/iotdb/assets/105656576/efe1c533-3949-413b-aaa9-cad83dbe4872">
最终的效果。
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@iotdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [iotdb] JackieTien97 commented on a diff in pull request #11049: Auth
Posted by "JackieTien97 (via GitHub)" <gi...@apache.org>.
JackieTien97 commented on code in PR #11049:
URL: https://github.com/apache/iotdb/pull/11049#discussion_r1316579356
##########
iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/AuthorityChecker.java:
##########
@@ -187,32 +194,89 @@ public static boolean checkGrantOption(
return true;
}
+ public static boolean checkRole(String username, String rolename) {
+ return authorityFetcher.checkRole(username, rolename);
+ }
+
public static void buildTSBlock(
- Map<String, List<String>> authorizerInfo, SettableFuture<ConfigTaskResult> future) {
+ TAuthorizerResp authResp, SettableFuture<ConfigTaskResult> future) {
List<TSDataType> types = new ArrayList<>();
- for (int i = 0; i < authorizerInfo.size(); i++) {
+ boolean listRoleUser = false;
+ int columnNum = 0;
+ if (authResp.tag.equals(IoTDBConstant.COLUMN_ROLE)
+ || authResp.tag.equals(IoTDBConstant.COLUMN_USER)) {
+ // if list role/user, just return 1 column.
+ columnNum = 1;
+ listRoleUser = true;
+ } else {
+ // if list privilege, return : rolename, path, privilege, grant option
+ columnNum = 4;
+ }
+
+ for (int i = 0; i < columnNum; i++) {
types.add(TSDataType.TEXT);
}
TsBlockBuilder builder = new TsBlockBuilder(types);
List<ColumnHeader> headerList = new ArrayList<>();
- for (String header : authorizerInfo.keySet()) {
- headerList.add(new ColumnHeader(header, TSDataType.TEXT));
+ if (listRoleUser) {
+ headerList.add(new ColumnHeader(authResp.getTag(), TSDataType.TEXT));
+ } else {
+ headerList.add(new ColumnHeader(new String(" ROLE "), TSDataType.TEXT));
+ headerList.add(new ColumnHeader(new String(" PATH "), TSDataType.TEXT));
+ headerList.add(new ColumnHeader(new String(" PRIVILEGES "), TSDataType.TEXT));
+ headerList.add(new ColumnHeader(new String(" GRANT OPTION "), TSDataType.TEXT));
}
- // The Time column will be ignored by the setting of ColumnHeader.
- // So we can put a meaningless value here
- for (String value : authorizerInfo.get(headerList.get(0).getColumnName())) {
- builder.getTimeColumnBuilder().writeLong(0L);
- builder.getColumnBuilder(0).writeBinary(new Binary(value));
- builder.declarePosition();
- }
- for (int i = 1; i < headerList.size(); i++) {
- for (String value : authorizerInfo.get(headerList.get(i).getColumnName())) {
- builder.getColumnBuilder(i).writeBinary(new Binary(value));
+
+ if (listRoleUser) {
+ for (String name : authResp.getMemberInfo()) {
+ builder.getTimeColumnBuilder().writeLong(0L);
+ builder.getColumnBuilder(0).writeBinary(new Binary(name));
+ builder.declarePosition();
+ }
+ } else {
+ TUserResp user = authResp.getPermissionInfo().getUserInfo();
+ if (user != null) {
+ appendPriBuilder("", "", user.getSysPriSet(), user.getSysPriSetGrantOpt(), builder);
+ for (TPathPrivilege path : user.getPrivilegeList()) {
+ appendPriBuilder(
+ "", path.getPath().toString(), path.getPriSet(), path.getPriGrantOpt(), builder);
+ }
+ }
+ Iterator<Map.Entry<String, TRoleResp>> it =
+ authResp.getPermissionInfo().getRoleInfo().entrySet().iterator();
+ while (it.hasNext()) {
+ TRoleResp role = it.next().getValue();
+ appendPriBuilder(
+ role.getRoleName(), "", role.getSysPriSet(), role.getSysPriSetGrantOpt(), builder);
+ for (TPathPrivilege path : role.getPrivilegeList()) {
+ appendPriBuilder(
+ role.getRoleName(),
+ path.getPath().toString(),
+ path.getPriSet(),
+ path.getPriGrantOpt(),
+ builder);
+ }
}
}
DatasetHeader datasetHeader = new DatasetHeader(headerList, true);
future.set(new ConfigTaskResult(TSStatusCode.SUCCESS_STATUS, builder.build(), datasetHeader));
}
+
+ private static void appendPriBuilder(
+ String name, String path, Set<Integer> priv, Set<Integer> grantOpt, TsBlockBuilder builder) {
+ for (int i : priv) {
+ builder.getColumnBuilder(0).writeBinary(new Binary(new String(name)));
+ builder.getColumnBuilder(1).writeBinary(new Binary(new String(path)));
+ builder.getColumnBuilder(2).writeBinary(new Binary(PrivilegeType.values()[i].toString()));
+ if (grantOpt.contains(i)) {
+ builder.getColumnBuilder(3).writeBinary(new Binary(new String("T")));
+ } else {
+ builder.getColumnBuilder(3).writeBinary(new Binary(new String("F")));
Review Comment:
```suggestion
builder.getColumnBuilder(3).writeBoolean(false);
```
##########
iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/AuthorityChecker.java:
##########
@@ -187,32 +194,89 @@ public static boolean checkGrantOption(
return true;
}
+ public static boolean checkRole(String username, String rolename) {
+ return authorityFetcher.checkRole(username, rolename);
+ }
+
public static void buildTSBlock(
- Map<String, List<String>> authorizerInfo, SettableFuture<ConfigTaskResult> future) {
+ TAuthorizerResp authResp, SettableFuture<ConfigTaskResult> future) {
List<TSDataType> types = new ArrayList<>();
- for (int i = 0; i < authorizerInfo.size(); i++) {
+ boolean listRoleUser = false;
+ int columnNum = 0;
+ if (authResp.tag.equals(IoTDBConstant.COLUMN_ROLE)
+ || authResp.tag.equals(IoTDBConstant.COLUMN_USER)) {
+ // if list role/user, just return 1 column.
+ columnNum = 1;
+ listRoleUser = true;
+ } else {
+ // if list privilege, return : rolename, path, privilege, grant option
+ columnNum = 4;
+ }
+
+ for (int i = 0; i < columnNum; i++) {
types.add(TSDataType.TEXT);
}
TsBlockBuilder builder = new TsBlockBuilder(types);
List<ColumnHeader> headerList = new ArrayList<>();
- for (String header : authorizerInfo.keySet()) {
- headerList.add(new ColumnHeader(header, TSDataType.TEXT));
+ if (listRoleUser) {
+ headerList.add(new ColumnHeader(authResp.getTag(), TSDataType.TEXT));
+ } else {
+ headerList.add(new ColumnHeader(new String(" ROLE "), TSDataType.TEXT));
+ headerList.add(new ColumnHeader(new String(" PATH "), TSDataType.TEXT));
+ headerList.add(new ColumnHeader(new String(" PRIVILEGES "), TSDataType.TEXT));
+ headerList.add(new ColumnHeader(new String(" GRANT OPTION "), TSDataType.TEXT));
}
- // The Time column will be ignored by the setting of ColumnHeader.
- // So we can put a meaningless value here
- for (String value : authorizerInfo.get(headerList.get(0).getColumnName())) {
- builder.getTimeColumnBuilder().writeLong(0L);
- builder.getColumnBuilder(0).writeBinary(new Binary(value));
- builder.declarePosition();
- }
- for (int i = 1; i < headerList.size(); i++) {
- for (String value : authorizerInfo.get(headerList.get(i).getColumnName())) {
- builder.getColumnBuilder(i).writeBinary(new Binary(value));
+
+ if (listRoleUser) {
+ for (String name : authResp.getMemberInfo()) {
+ builder.getTimeColumnBuilder().writeLong(0L);
+ builder.getColumnBuilder(0).writeBinary(new Binary(name));
+ builder.declarePosition();
+ }
+ } else {
+ TUserResp user = authResp.getPermissionInfo().getUserInfo();
+ if (user != null) {
+ appendPriBuilder("", "", user.getSysPriSet(), user.getSysPriSetGrantOpt(), builder);
+ for (TPathPrivilege path : user.getPrivilegeList()) {
+ appendPriBuilder(
+ "", path.getPath().toString(), path.getPriSet(), path.getPriGrantOpt(), builder);
+ }
+ }
+ Iterator<Map.Entry<String, TRoleResp>> it =
+ authResp.getPermissionInfo().getRoleInfo().entrySet().iterator();
+ while (it.hasNext()) {
+ TRoleResp role = it.next().getValue();
+ appendPriBuilder(
+ role.getRoleName(), "", role.getSysPriSet(), role.getSysPriSetGrantOpt(), builder);
+ for (TPathPrivilege path : role.getPrivilegeList()) {
+ appendPriBuilder(
+ role.getRoleName(),
+ path.getPath().toString(),
+ path.getPriSet(),
+ path.getPriGrantOpt(),
+ builder);
+ }
}
}
DatasetHeader datasetHeader = new DatasetHeader(headerList, true);
future.set(new ConfigTaskResult(TSStatusCode.SUCCESS_STATUS, builder.build(), datasetHeader));
}
+
+ private static void appendPriBuilder(
+ String name, String path, Set<Integer> priv, Set<Integer> grantOpt, TsBlockBuilder builder) {
+ for (int i : priv) {
+ builder.getColumnBuilder(0).writeBinary(new Binary(new String(name)));
+ builder.getColumnBuilder(1).writeBinary(new Binary(new String(path)));
+ builder.getColumnBuilder(2).writeBinary(new Binary(PrivilegeType.values()[i].toString()));
+ if (grantOpt.contains(i)) {
+ builder.getColumnBuilder(3).writeBinary(new Binary(new String("T")));
Review Comment:
```suggestion
builder.getColumnBuilder(3).writeBoolean(true);
```
##########
iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/persistence/AuthorInfo.java:
##########
@@ -515,6 +465,23 @@ public TPermissionInfoResp checkUserPrivilegeGrantOpt(
return resp;
}
+ public TPermissionInfoResp checkRoleOfUser(String username, String rolename)
+ throws AuthException {
+ TPermissionInfoResp result = new TPermissionInfoResp();
+ User user = authorizer.getUser(username);
+ if (user == null) {
+ throw new AuthException(
+ TSStatusCode.USER_NOT_EXIST, String.format("No such user : %s", username));
+ }
+ result = getUserPermissionInfo(username);
+ if (!user.getRoleList().contains(rolename)) {
+ result.setStatus(RpcUtils.getStatus(TSStatusCode.SUCCESS_STATUS));
+ } else {
+ result.setStatus(RpcUtils.getStatus(TSStatusCode.USER_NOT_HAS_ROLE));
+ }
Review Comment:
reserse it
##########
iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/AuthorityChecker.java:
##########
@@ -187,32 +194,89 @@ public static boolean checkGrantOption(
return true;
}
+ public static boolean checkRole(String username, String rolename) {
+ return authorityFetcher.checkRole(username, rolename);
+ }
+
public static void buildTSBlock(
- Map<String, List<String>> authorizerInfo, SettableFuture<ConfigTaskResult> future) {
+ TAuthorizerResp authResp, SettableFuture<ConfigTaskResult> future) {
List<TSDataType> types = new ArrayList<>();
- for (int i = 0; i < authorizerInfo.size(); i++) {
+ boolean listRoleUser = false;
+ int columnNum = 0;
+ if (authResp.tag.equals(IoTDBConstant.COLUMN_ROLE)
+ || authResp.tag.equals(IoTDBConstant.COLUMN_USER)) {
+ // if list role/user, just return 1 column.
+ columnNum = 1;
+ listRoleUser = true;
+ } else {
+ // if list privilege, return : rolename, path, privilege, grant option
+ columnNum = 4;
+ }
+
+ for (int i = 0; i < columnNum; i++) {
types.add(TSDataType.TEXT);
}
TsBlockBuilder builder = new TsBlockBuilder(types);
List<ColumnHeader> headerList = new ArrayList<>();
- for (String header : authorizerInfo.keySet()) {
- headerList.add(new ColumnHeader(header, TSDataType.TEXT));
+ if (listRoleUser) {
+ headerList.add(new ColumnHeader(authResp.getTag(), TSDataType.TEXT));
+ } else {
+ headerList.add(new ColumnHeader(new String(" ROLE "), TSDataType.TEXT));
+ headerList.add(new ColumnHeader(new String(" PATH "), TSDataType.TEXT));
+ headerList.add(new ColumnHeader(new String(" PRIVILEGES "), TSDataType.TEXT));
+ headerList.add(new ColumnHeader(new String(" GRANT OPTION "), TSDataType.TEXT));
Review Comment:
```suggestion
headerList.add(new ColumnHeader(new String("ROLE"), TSDataType.TEXT));
headerList.add(new ColumnHeader(new String("PATH"), TSDataType.TEXT));
headerList.add(new ColumnHeader(new String("PRIVILEGES"), TSDataType.TEXT));
headerList.add(new ColumnHeader(new String("GRANT OPTION"), TSDataType.BOOLEAN));
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@iotdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org