Skip to content

Addresses comments from #623 in ActiveRolesProvider #708

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

Addresses comments from #623 in ActiveRolesProvider #708

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions ...c/main/java/org/apache/polaris/service/dropwizard/auth/PolarisPrincipalAuthenticator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,11 +40,11 @@ public class PolarisPrincipalAuthenticator implements ContainerRequestFilter {
public void filter(ContainerRequestContext requestContext) throws IOException {
String authHeader = requestContext.getHeaderString("Authorization");
if (authHeader == null) {
throw new IOException("Authorization header is missing");
throw new NotAuthorizedException("Authorization header is missing");
}
int spaceIdx = authHeader.indexOf(' ');
if (spaceIdx <= 0 || !authHeader.substring(0, spaceIdx).equalsIgnoreCase("Bearer")) {
throw new IOException("Authorization header is not a Bearer token");
throw new NotAuthorizedException("Authorization header is not a Bearer token");
}
String credential = authHeader.substring(spaceIdx + 1);
Optional<AuthenticatedPolarisPrincipal> principal = authenticator.authenticate(credential);
Expand Down
5 changes: 5 additions & 0 deletions ...g/apache/polaris/service/dropwizard/auth/PolarisPrincipalRoleSecurityContextProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@

import jakarta.annotation.Priority;
import jakarta.inject.Inject;
import jakarta.ws.rs.ForbiddenException;
import jakarta.ws.rs.Priorities;
import jakarta.ws.rs.container.ContainerRequestContext;
import jakarta.ws.rs.container.ContainerRequestFilter;
Expand Down Expand Up @@ -53,6 +54,10 @@ public void filter(ContainerRequestContext requestContext) throws IOException {
public SecurityContext createSecurityContext(
SecurityContext ctx, AuthenticatedPolarisPrincipal principal) {
Set<String> validRoleNames = activeRolesProvider.getActiveRoles(principal);
if (validRoleNames.isEmpty()) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is making the tests fail, and I think we do have a problem. DefaultActiveRolesProvider expects the principal to have the role PRINCIPAL_ROLE_ALL when all roles are activated:

boolean allRoles = tokenRoles.contains(BasePolarisAuthenticator.PRINCIPAL_ROLE_ALL);

But BasePolarisAuhtenticator creates a principal with an empty roles set in that case. You need to change BasePolarisAuthenticator.getPrincipal():

  if (tokenInfo.getScope() != null) {
      if (tokenInfo.getScope().equals(PRINCIPAL_ROLE_ALL)) {
        activatedPrincipalRoles.add(PRINCIPAL_ROLE_ALL); // this is missing
      } else {
        activatedPrincipalRoles.addAll(...);
      }
    }

LOGGER.warn("Principal {} has no active roles. Request will be denied.", principal.getName());
throw new ForbiddenException("Principal has no active roles");
}
return new SecurityContext() {
@Override
public Principal getUserPrincipal() {
Expand Down
27 changes: 11 additions & 16 deletions service/common/src/main/java/org/apache/polaris/service/auth/DefaultActiveRolesProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,18 +20,16 @@

import jakarta.inject.Inject;
import jakarta.inject.Provider;
import java.util.List;
import java.util.Set;
import java.util.function.Predicate;
import java.util.stream.Collectors;
import org.apache.iceberg.exceptions.NotAuthorizedException;
import org.apache.polaris.core.PolarisCallContext;
import org.apache.polaris.core.auth.AuthenticatedPolarisPrincipal;
import org.apache.polaris.core.auth.PolarisGrantManager;
import org.apache.polaris.core.context.CallContext;
import org.apache.polaris.core.context.RealmContext;
import org.apache.polaris.core.entity.PolarisBaseEntity;
import org.apache.polaris.core.entity.PolarisEntity;
import org.apache.polaris.core.entity.PrincipalRoleEntity;
import org.apache.polaris.core.persistence.MetaStoreManagerFactory;
import org.apache.polaris.core.persistence.PolarisMetaStoreManager;
import org.slf4j.Logger;
Expand All @@ -51,15 +49,13 @@ public class DefaultActiveRolesProvider implements ActiveRolesProvider {

@Override
public Set<String> getActiveRoles(AuthenticatedPolarisPrincipal principal) {
List<PrincipalRoleEntity> activeRoles =
loadActivePrincipalRoles(
principal.getActivatedPrincipalRoleNames(),
principal.getPrincipalEntity(),
metaStoreManagerFactory.getOrCreateMetaStoreManager(realmContextProvider.get()));
return activeRoles.stream().map(PrincipalRoleEntity::getName).collect(Collectors.toSet());
return loadActivePrincipalRoles(
principal.getActivatedPrincipalRoleNames(),
principal.getPrincipalEntity(),
metaStoreManagerFactory.getOrCreateMetaStoreManager(realmContextProvider.get()));
}

protected List<PrincipalRoleEntity> loadActivePrincipalRoles(
private Set<String> loadActivePrincipalRoles(
Set<String> tokenRoles, PolarisEntity principal, PolarisMetaStoreManager metaStoreManager) {
PolarisCallContext polarisContext = CallContext.getCurrentContext().getPolarisCallContext();
PolarisGrantManager.LoadGrantsResult principalGrantResults =
Expand All @@ -76,22 +72,21 @@ protected List<PrincipalRoleEntity> loadActivePrincipalRoles(
"Failed to resolve principal roles for principal name={} id={}",
principal.getName(),
principal.getId());
throw new NotAuthorizedException("Unable to authenticate");
return Set.of();
}
boolean allRoles = tokenRoles.contains(BasePolarisAuthenticator.PRINCIPAL_ROLE_ALL);
Predicate<PrincipalRoleEntity> includeRoleFilter =
allRoles ? r -> true : r -> tokenRoles.contains(r.getName());
List<PrincipalRoleEntity> activeRoles =
Predicate<String> includeRoleFilter = allRoles ? r -> true : r -> tokenRoles.contains(r);
Set<String> activeRoles =
principalGrantResults.getGrantRecords().stream()
.map(
gr ->
metaStoreManager.loadEntity(
polarisContext, gr.getSecurableCatalogId(), gr.getSecurableId()))
.filter(PolarisMetaStoreManager.EntityResult::isSuccess)
.map(PolarisMetaStoreManager.EntityResult::getEntity)
.map(PrincipalRoleEntity::of)
.map(PolarisBaseEntity::getName)
.filter(includeRoleFilter)
.toList();
.collect(Collectors.toSet());
if (activeRoles.size() != principalGrantResults.getGrantRecords().size()) {
LOGGER
.atWarn()
Expand Down
Loading