Skip to content

Fix the regression in isSupperUser #7241

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jiazhai merged 1 commit into from
Jun 24, 2020
Merged

Fix the regression in isSupperUser #7241

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 8 additions & 6 deletions ...er-common/src/main/java/org/apache/pulsar/broker/authorization/AuthorizationProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,25 +47,27 @@ public interface AuthorizationProvider extends Closeable {
/**
* Check if specified role is a super user
* @param role the role to check
* @param authenticationData authentication data related to the role
* @return a CompletableFuture containing a boolean in which true means the role is a super user
* and false if it is not
*/
default CompletableFuture<Boolean> isSuperUser(String role, ServiceConfiguration serviceConfiguration) {
default CompletableFuture<Boolean> isSuperUser(String role,
AuthenticationDataSource authenticationData,
ServiceConfiguration serviceConfiguration) {
Set<String> superUserRoles = serviceConfiguration.getSuperUserRoles();
return CompletableFuture.completedFuture(role != null && superUserRoles.contains(role) ? true : false);
}

/**
* @deprecated Use method {@link #isSuperUser(String, AuthenticationDataSource, ServiceConfiguration)}
* Check if specified role is a super user
* @param role the role to check
* @param authenticationData authentication data related to the role
* @return a CompletableFuture containing a boolean in which true means the role is a super user
* and false if it is not
*/
default CompletableFuture<Boolean> isSuperUser(String role,
AuthenticationDataSource authenticationData,
ServiceConfiguration serviceConfiguration) {
return isSuperUser(role, serviceConfiguration);
default CompletableFuture<Boolean> isSuperUser(String role, ServiceConfiguration serviceConfiguration) {
Set<String> superUserRoles = serviceConfiguration.getSuperUserRoles();
return CompletableFuture.completedFuture(role != null && superUserRoles.contains(role) ? true : false);
}

/**
Expand Down
10 changes: 5 additions & 5 deletions ...mon/src/main/java/org/apache/pulsar/broker/authorization/PulsarAuthorizationProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -322,7 +322,7 @@ public CompletableFuture<Void> revokeSubscriptionPermissionAsync(NamespaceName n
String role, String authDataJson) {
return updateSubscriptionPermissionAsync(namespace, subscriptionName, Collections.singleton(role), true);
}

private CompletableFuture<Void> updateSubscriptionPermissionAsync(NamespaceName namespace, String subscriptionName, Set<String> roles,
boolean remove) {
CompletableFuture<Void> result = new CompletableFuture<>();
Expand Down Expand Up @@ -549,7 +549,7 @@ public CompletableFuture<Boolean> allowTopicOperationAsync(TopicName topicName,
new IllegalStateException("TopicOperation is not supported."));
}

CompletableFuture<Boolean> isSuperUserFuture = isSuperUser(role, conf);
CompletableFuture<Boolean> isSuperUserFuture = isSuperUser(role, authData, conf);

return isSuperUserFuture
.thenCombine(isAuthorizedFuture, (isSuperUser, isAuthorized) -> isSuperUser || isAuthorized);
Expand All @@ -573,14 +573,14 @@ private CompletableFuture<Boolean> validateTenantAdminAccess(String tenantName,

if (role != null && conf.getProxyRoles().contains(role)) {
// role check
CompletableFuture<Boolean> isRoleSuperUserFuture = isSuperUser(role, conf);
CompletableFuture<Boolean> isRoleSuperUserFuture = isSuperUser(role, authData, conf);
CompletableFuture<Boolean> isRoleTenantAdminFuture = isTenantAdmin(tenantName, role, tenantInfo, authData);
CompletableFuture<Boolean> isRoleAuthorizedFuture = isRoleSuperUserFuture
.thenCombine(isRoleTenantAdminFuture, (isRoleSuperUser, isRoleTenantAdmin) ->
isRoleSuperUser || isRoleTenantAdmin);

// originalRole check
CompletableFuture<Boolean> isOriginalRoleSuperUserFuture = isSuperUser(originalRole, conf);
CompletableFuture<Boolean> isOriginalRoleSuperUserFuture = isSuperUser(originalRole, authData, conf);
CompletableFuture<Boolean> isOriginalRoleTenantAdminFuture = isTenantAdmin(tenantName, originalRole,
tenantInfo, authData);
CompletableFuture<Boolean> isOriginalRoleAuthorizedFuture = isOriginalRoleSuperUserFuture
Expand All @@ -593,7 +593,7 @@ private CompletableFuture<Boolean> validateTenantAdminAccess(String tenantName,
isRoleAuthorized && isOriginalRoleAuthorized);
} else {
// role check
CompletableFuture<Boolean> isRoleSuperUserFuture = isSuperUser(role, conf);
CompletableFuture<Boolean> isRoleSuperUserFuture = isSuperUser(role, authData, conf);
CompletableFuture<Boolean> isRoleTenantAdminFuture = isTenantAdmin(tenantName, role, tenantInfo, authData);
return isRoleSuperUserFuture
.thenCombine(isRoleTenantAdminFuture, (isRoleSuperUser, isRoleTenantAdmin) ->
Expand Down