Skip to content

Commit

Permalink
Add method to authorize native query using authentication result (#14376
Browse files Browse the repository at this point in the history 
)
  • Loading branch information
@findingrish
findingrish authored Jun 12, 2023
1 parent b5f4583 commit 8b212e7
Show file tree
Hide file tree
Showing 2 changed files with 66 additions and 20 deletions.
16 changes: 14 additions & 2 deletions server/src/main/java/org/apache/druid/server/QueryLifecycle.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -220,6 +220,18 @@ public void initialize(final Query<?> baseQuery)
* @return authorization result
*/
public Access authorize(HttpServletRequest req)
{
return authorize(AuthorizationUtils.authenticationResultFromRequest(req));
}

/**
* Authorize the query using the authentication result.
* Will return an Access object denoting whether the query is authorized or not.
*
* @param authenticationResult authentication result indicating identity of the requester
* @return authorization result of requester
*/
public Access authorize(AuthenticationResult authenticationResult)
{
transition(State.INITIALIZED, State.AUTHORIZING);
final Iterable<ResourceAction> resourcesToAuthorize = Iterables.concat(
Expand All @@ -233,9 +245,9 @@ public Access authorize(HttpServletRequest req)
)
);
return doAuthorize(
AuthorizationUtils.authenticationResultFromRequest(req),
authenticationResult,
AuthorizationUtils.authorizeAllResourceActions(
req,
authenticationResult,
resourcesToAuthorize,
authorizerMapper
)
Expand Down
70 changes: 52 additions & 18 deletions server/src/test/java/org/apache/druid/server/QueryLifecycleTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -188,15 +188,15 @@ public void testAuthorizeQueryContext_authorized()
EasyMock.expect(authenticationResult.getIdentity()).andReturn(IDENTITY).anyTimes();
EasyMock.expect(authenticationResult.getAuthorizerName()).andReturn(AUTHORIZER).anyTimes();
EasyMock.expect(authorizer.authorize(authenticationResult, new Resource(DATASOURCE, ResourceType.DATASOURCE), Action.READ))
.andReturn(Access.OK);
.andReturn(Access.OK).times(2);
EasyMock.expect(authorizer.authorize(authenticationResult, new Resource("foo", ResourceType.QUERY_CONTEXT), Action.WRITE))
.andReturn(Access.OK);
.andReturn(Access.OK).times(2);
EasyMock.expect(authorizer.authorize(authenticationResult, new Resource("baz", ResourceType.QUERY_CONTEXT), Action.WRITE))
.andReturn(Access.OK);
.andReturn(Access.OK).times(2);

EasyMock.expect(toolChestWarehouse.getToolChest(EasyMock.anyObject()))
.andReturn(toolChest)
.once();
.times(2);

replayAll();

Expand All @@ -223,6 +223,10 @@ public void testAuthorizeQueryContext_authorized()
);

Assert.assertTrue(lifecycle.authorize(mockRequest()).isAllowed());

lifecycle = createLifecycle(authConfig);
lifecycle.initialize(query);
Assert.assertTrue(lifecycle.authorize(authenticationResult).isAllowed());
}

@Test
Expand All @@ -232,13 +236,15 @@ public void testAuthorizeQueryContext_notAuthorized()
EasyMock.expect(authenticationResult.getIdentity()).andReturn(IDENTITY).anyTimes();
EasyMock.expect(authenticationResult.getAuthorizerName()).andReturn(AUTHORIZER).anyTimes();
EasyMock.expect(authorizer.authorize(authenticationResult, new Resource(DATASOURCE, ResourceType.DATASOURCE), Action.READ))
.andReturn(Access.OK);
.andReturn(Access.OK)
.times(2);
EasyMock.expect(authorizer.authorize(authenticationResult, new Resource("foo", ResourceType.QUERY_CONTEXT), Action.WRITE))
.andReturn(Access.DENIED);
.andReturn(Access.DENIED)
.times(2);

EasyMock.expect(toolChestWarehouse.getToolChest(EasyMock.anyObject()))
.andReturn(toolChest)
.once();
.times(2);

replayAll();

Expand All @@ -255,6 +261,10 @@ public void testAuthorizeQueryContext_notAuthorized()
QueryLifecycle lifecycle = createLifecycle(authConfig);
lifecycle.initialize(query);
Assert.assertFalse(lifecycle.authorize(mockRequest()).isAllowed());

lifecycle = createLifecycle(authConfig);
lifecycle.initialize(query);
Assert.assertFalse(lifecycle.authorize(authenticationResult).isAllowed());
}

@Test
Expand All @@ -264,11 +274,12 @@ public void testAuthorizeQueryContext_unsecuredKeys()
EasyMock.expect(authenticationResult.getIdentity()).andReturn(IDENTITY).anyTimes();
EasyMock.expect(authenticationResult.getAuthorizerName()).andReturn(AUTHORIZER).anyTimes();
EasyMock.expect(authorizer.authorize(authenticationResult, new Resource(DATASOURCE, ResourceType.DATASOURCE), Action.READ))
.andReturn(Access.OK);
.andReturn(Access.OK)
.times(2);

EasyMock.expect(toolChestWarehouse.getToolChest(EasyMock.anyObject()))
.andReturn(toolChest)
.once();
.times(2);

replayAll();

Expand Down Expand Up @@ -296,6 +307,10 @@ public void testAuthorizeQueryContext_unsecuredKeys()
);

Assert.assertTrue(lifecycle.authorize(mockRequest()).isAllowed());

lifecycle = createLifecycle(authConfig);
lifecycle.initialize(query);
Assert.assertTrue(lifecycle.authorize(authenticationResult).isAllowed());
}

@Test
Expand All @@ -305,11 +320,12 @@ public void testAuthorizeQueryContext_securedKeys()
EasyMock.expect(authenticationResult.getIdentity()).andReturn(IDENTITY).anyTimes();
EasyMock.expect(authenticationResult.getAuthorizerName()).andReturn(AUTHORIZER).anyTimes();
EasyMock.expect(authorizer.authorize(authenticationResult, new Resource(DATASOURCE, ResourceType.DATASOURCE), Action.READ))
.andReturn(Access.OK);
.andReturn(Access.OK)
.times(2);

EasyMock.expect(toolChestWarehouse.getToolChest(EasyMock.anyObject()))
.andReturn(toolChest)
.once();
.times(2);

replayAll();

Expand Down Expand Up @@ -338,6 +354,10 @@ public void testAuthorizeQueryContext_securedKeys()
);

Assert.assertTrue(lifecycle.authorize(mockRequest()).isAllowed());

lifecycle = createLifecycle(authConfig);
lifecycle.initialize(query);
Assert.assertTrue(lifecycle.authorize(authenticationResult).isAllowed());
}

@Test
Expand All @@ -347,13 +367,15 @@ public void testAuthorizeQueryContext_securedKeysNotAuthorized()
EasyMock.expect(authenticationResult.getIdentity()).andReturn(IDENTITY).anyTimes();
EasyMock.expect(authenticationResult.getAuthorizerName()).andReturn(AUTHORIZER).anyTimes();
EasyMock.expect(authorizer.authorize(authenticationResult, new Resource(DATASOURCE, ResourceType.DATASOURCE), Action.READ))
.andReturn(Access.OK);
.andReturn(Access.OK)
.times(2);
EasyMock.expect(authorizer.authorize(authenticationResult, new Resource("foo", ResourceType.QUERY_CONTEXT), Action.WRITE))
.andReturn(Access.DENIED);
.andReturn(Access.DENIED)
.times(2);

EasyMock.expect(toolChestWarehouse.getToolChest(EasyMock.anyObject()))
.andReturn(toolChest)
.once();
.times(2);

replayAll();

Expand All @@ -373,6 +395,10 @@ public void testAuthorizeQueryContext_securedKeysNotAuthorized()
QueryLifecycle lifecycle = createLifecycle(authConfig);
lifecycle.initialize(query);
Assert.assertFalse(lifecycle.authorize(mockRequest()).isAllowed());

lifecycle = createLifecycle(authConfig);
lifecycle.initialize(query);
Assert.assertFalse(lifecycle.authorize(authenticationResult).isAllowed());
}

@Test
Expand All @@ -382,14 +408,18 @@ public void testAuthorizeLegacyQueryContext_authorized()
EasyMock.expect(authenticationResult.getIdentity()).andReturn(IDENTITY).anyTimes();
EasyMock.expect(authenticationResult.getAuthorizerName()).andReturn(AUTHORIZER).anyTimes();
EasyMock.expect(authorizer.authorize(authenticationResult, new Resource("fake", ResourceType.DATASOURCE), Action.READ))
.andReturn(Access.OK);
.andReturn(Access.OK)
.times(2);
EasyMock.expect(authorizer.authorize(authenticationResult, new Resource("foo", ResourceType.QUERY_CONTEXT), Action.WRITE))
.andReturn(Access.OK);
EasyMock.expect(authorizer.authorize(authenticationResult, new Resource("baz", ResourceType.QUERY_CONTEXT), Action.WRITE)).andReturn(Access.OK);
.andReturn(Access.OK)
.times(2);
EasyMock.expect(authorizer.authorize(authenticationResult, new Resource("baz", ResourceType.QUERY_CONTEXT), Action.WRITE))
.andReturn(Access.OK)
.times(2);

EasyMock.expect(toolChestWarehouse.getToolChest(EasyMock.anyObject()))
.andReturn(toolChest)
.once();
.times(2);

replayAll();

Expand All @@ -408,6 +438,10 @@ public void testAuthorizeLegacyQueryContext_authorized()
Assert.assertTrue(revisedContext.containsKey("queryId"));

Assert.assertTrue(lifecycle.authorize(mockRequest()).isAllowed());

lifecycle = createLifecycle(authConfig);
lifecycle.initialize(query);
Assert.assertTrue(lifecycle.authorize(mockRequest()).isAllowed());
}

private HttpServletRequest mockRequest()
Expand Down

0 comments on commit 8b212e7

Please sign in to comment.