co.cask.cdap.security.spi.authorization

Interface Authorizer

All Superinterfaces:

AuthorizationEnforcer, PrivilegesFetcher, PrivilegesManager

All Known Implementing Classes:

AbstractAuthorizer, NoOpAuthorizer

@Beta
public interface Authorizer
extends PrivilegesFetcher, PrivilegesManager, AuthorizationEnforcer

Interface for managing principals' authorization for actions on CDAP entities. Authorization extensions must implement this interface to delegate authorization to appropriate authorization back-ends. The contract with Authorization extensions is as below:

• Authorization is enabled setting the parameter security.authorization.enabled to true in cdap-site.xml.
• The path to the extension jar bundled with all its dependencies must be specified by security.authorization.extension.jar.path in cdap-site.xml
• The extension jar must contain a class that implements Authorizer. This class must be specified as the Attributes.Name#MAIN_CLASS in the extension jar's manifest file.
• The contract with the class that implements Authorizer is that it must have a default constructor.
• Authorizer also provides lifecycle methods for extensions. initialize(AuthorizationContext) can be used to perform initialization tasks. This method provides an AuthorizationContext which gives extensions access to CDAP entities for operations like creating and accessing datasets, accessing datasets in transactions, etc. It also provides access to extension properties via the AuthorizationContext.getExtensionProperties() method. The Properties object returned form this method is populated with all configuration settings from cdap-site.xml that have keys with the prefix security.authorization.extension.config.
• The destroy() method can be used to perform cleanup tasks.

Method Summary

Methods

Modifier and Type	Method and Description
void	addRoleToPrincipal(Role role, Principal principal) Add a role to the specified Principal.
void	createRole(Role role) Create a role.
void	destroy() Destroys an Authorizer.
void	dropRole(Role role) Drop a role.
void	initialize(AuthorizationContext context) Initialize the Authorizer.
Set<Role>	listAllRoles() Returns all available Role.
Set<Role>	listRoles(Principal principal) Returns a set of all roles for the specified Principal.
void	removeRoleFromPrincipal(Role role, Principal principal) Delete a role from the specified Principal.

Methods inherited from interface co.cask.cdap.security.spi.authorization.PrivilegesFetcher

listPrivileges

Methods inherited from interface co.cask.cdap.security.spi.authorization.PrivilegesManager

grant, revoke, revoke

Methods inherited from interface co.cask.cdap.security.spi.authorization.AuthorizationEnforcer

createFilter, enforce, enforce

Method Detail

initialize

void initialize(AuthorizationContext context)
                throws Exception

Initialize the Authorizer. Authorization extensions can use this method to access an AuthorizationContext that allows them to interact with CDAP for operations such as creating and accessing datasets, executing dataset operations in transactions, etc.

Parameters:

context - the AuthorizationContext that can be used to interact with CDAP

Throws:

Exception

createRole

void createRole(Role role)
                throws Exception

Create a role.

Parameters:

role - the Role to create

Throws:

RoleAlreadyExistsException - if the the role to be created already exists

Exception

dropRole

void dropRole(Role role)
              throws Exception

Drop a role.

Parameters:

role - the Role to drop

Throws:

RoleNotFoundException - if the role to be dropped is not found

Exception

addRoleToPrincipal

void addRoleToPrincipal(Role role,
                      Principal principal)
                        throws Exception

Add a role to the specified Principal.

Parameters:

role - the Role to add to the specified group

principal - the Principal to add the role to

Throws:

RoleNotFoundException - if the role to be added to the principals is not found

Exception

removeRoleFromPrincipal

void removeRoleFromPrincipal(Role role,
                           Principal principal)
                             throws Exception

Delete a role from the specified Principal.

Parameters:

role - the Role to remove from the specified group

principal - the Principal to remove the role from

Throws:

RoleNotFoundException - if the role to be removed to the principals is not found

Exception

listRoles

Set<Role> listRoles(Principal principal)
                    throws Exception

Returns a set of all roles for the specified Principal.

Parameters:

principal - the Principal to look up roles for

Returns:

Set of Role for the specified Principal

Throws:

Exception

listAllRoles

Set<Role> listAllRoles()
                       throws Exception

Returns all available Role. Only a super user can perform this operation.

Returns:

a set of all available Role in the system.

Throws:

Exception

destroy

void destroy()
             throws Exception

Destroys an Authorizer. Authorization extensions can use this method to write any cleanup code.

Throws:

Exception