New authorizer #349

jt2594838 · 2018-03-15T04:54:01Z

https://tower.im/projects/36de8571a0ff4833ae9d7f1c5c400c22/todos/0890c06f33dd46daa60fa1f97e97c28b/

# Conflicts: # src/main/java/cn/edu/tsinghua/iotdb/qp/executor/OverflowQPExecutor.java # src/test/java/cn/edu/tsinghua/iotdb/utils/EnvironmentUtils.java

MyXOF · 2018-03-22T02:35:27Z

src/main/java/cn/edu/tsinghua/iotdb/auth/authorizer/LocalFileAuthorizer.java

+ private static TsfileDBConfig config = TsfileDBDescriptor.getInstance().getConfig();
+ private LocalFileAuthorizer() {
+ super(new LocalFileUserManager(config.dataDir + File.separator + "users" + File.separator),
+ new cn.edu.tsinghua.iotdb.auth.Role.LocalFileRoleManager(config.dataDir + File.separator + "roles" + File.separator));


这个包名不放在上面？

MyXOF · 2018-03-22T02:40:25Z

src/main/java/cn/edu/tsinghua/iotdb/auth/entity/PrivilegeType.java

+ CREATE_ROLE, DELETE_ROLE, LIST_ROLE, GRANT_ROLE_PRIVILEGE, REVOKE_ROLE_PRIVILEGE;
+
+ public static boolean isPathRelevant(int type) {
+ return type <= DELETE_TIMESERIES.ordinal();


这个方法具体作用？

有些权限需要和路径绑定（数据的增删改查），因此需要提供一个路径，而有些不用（用户的增删改查）。这个方法用于判断哪些权限需要路径。

MyXOF · 2018-03-22T02:41:26Z

src/main/java/cn/edu/tsinghua/iotdb/auth/entity/Role.java

+ if (o == null || getClass() != o.getClass()) return false;
+ Role role = (Role) o;
+ return Objects.equals(name, role.name) &&
+ Objects.equals(privilegeList, role.privilegeList);


list可以通过equal来比较相等吗？

这个是ArrayList（实际上是其父类AbstractList）的equals方法。

MyXOF · 2018-03-22T03:14:27Z

src/main/java/cn/edu/tsinghua/iotdb/auth/user/BasicUserManager.java

+ try {
+ createUser(TsFileDBConstant.ADMIN_NAME, TsFileDBConstant.ADMIN_PW);
+ } catch (AuthException e) {
+ logger.error("Cannot create admin because {}", e.getMessage());


这个地方创建失败了应该直接抛异常把。不应该在下面显示Admin initialized

MyXOF · 2018-03-22T03:15:25Z

src/main/java/cn/edu/tsinghua/iotdb/auth/user/BasicUserManager.java

+
+ @Override
+ public User getUser(String username) throws AuthException {
+ lock.readLock(username);


这个username为什么要上一个锁，有别人会用它？

是的，需要短暂阻塞对同一用户（或角色）的修改操作。

MyXOF · 2018-03-22T03:19:29Z

src/main/java/cn/edu/tsinghua/iotdb/auth/entity/PathPrivilege.java

+import java.util.concurrent.atomic.AtomicInteger;
+
+/**
+ * This class represent a privilege on a specific path. If the privilege is path-free, the path will be null.


This class represents a privilege

MyXOF · 2018-03-22T03:20:32Z

src/main/java/cn/edu/tsinghua/iotdb/auth/entity/PathPrivilege.java

+ public String path;
+
+ /**
+ * This field record how many times this privilege is referenced during a life cycle (from being loaded to being discarded).


This field records

MyXOF · 2018-03-22T03:31:41Z

src/main/java/cn/edu/tsinghua/iotdb/auth/authorizer/IAuthorizer.java

+ /**
+ * Create a user with given username and password. New users will only be granted no privileges.
+ *
+ * @param username is not null or empty


用户名可以为""这种吗？

不行，目前要求字符长度至少为4。并且antlr不太可能解析出一个空字符串。

MyXOF · 2018-03-22T03:43:34Z

src/main/java/cn/edu/tsinghua/iotdb/qp/physical/sys/AuthorPlan.java

+ for(PrivilegeType privilegeType : types) {
+ if(s.equalsIgnoreCase(privilegeType.name())) {
+ result.add(privilegeType.ordinal());
+ legal = true;


这里legal=true了可以break出来了把？还需要后续的判断吗？

MyXOF · 2018-03-22T03:48:42Z

src/main/java/cn/edu/tsinghua/iotdb/auth/Role/LocalFileRoleAccessor.java

+
+ @Override
+ public void reset() {
+ new File(roleDirPath).mkdirs();


之前不需要做一些清理工作？

不需要，这个只是为了保证系统启动时相应目录存在，并不是进行清理。

liukun4515 · 2018-03-22T07:06:02Z

src/main/java/cn/edu/tsinghua/iotdb/auth/user/BasicUserManager.java

+ public List<String> listAllUsers() {
+ List<String> rtlist = accessor.listAllUsers();
+ rtlist.sort(null);
+ return rtlist;


list all user的同步性如何控制？我看底层是对文件进行查询，如果没有lock等同步机制会不会出问题。
因为前边的所有方法都有lock的控制。

这个操作不保证同步性，也就是说据此拿到的userList可能包含当前已经被删除的用户，但是它表示某一时刻（执行File.list()那一瞬间）的用户存在状态。如果需要对某用户进一步操作，需要使用者自行检查用户的存在性。

liukun4515 · 2018-03-22T07:09:59Z

src/main/java/cn/edu/tsinghua/iotdb/auth/user/LocalFileUserAccessor.java

+ String userName = IOUtils.readString(dataInputStream, STRING_ENCODING, strBufferLocal);
+ userList.add(userName);
+ }
+ user.roleList = userList;


这里是读userlis还是rolelist

liukun4515 · 2018-03-22T07:10:39Z

src/main/java/cn/edu/tsinghua/iotdb/auth/user/LocalFileUserAccessor.java

+
+ @Override
+ public List<String> listAllUsers() {
+ File roleDir = new File(userDirPath);


liukun4515 · 2018-03-22T08:01:47Z

src/main/java/cn/edu/tsinghua/iotdb/concurrent/HashLock.java

+ }
+ try {
+ locks[i].writeLock().unlock();
+ } catch (Exception ignored) {


这里所的unlock是有问题的把？只有lock的线程才有能力unlock，如果是其他现在来unlock是不会起作用的

这个方法是测试用的，避免某些测试遗漏解锁影响其他测试。

liukun4515 · 2018-03-22T08:05:33Z

src/main/java/cn/edu/tsinghua/iotdb/auth/authorizer/LocalFileAuthorizer.java

+ private static TsfileDBConfig config = TsfileDBDescriptor.getInstance().getConfig();
+ private LocalFileAuthorizer() {
+ super(new LocalFileUserManager(config.dataDir + File.separator + "users" + File.separator),
+ new cn.edu.tsinghua.iotdb.auth.Role.LocalFileRoleManager(config.dataDir + File.separator + "roles" + File.separator));


这样的import的内容有问题cn.edu.tsinghua.iotdb.auth.Role.

jt2594838 added 30 commits March 5, 2018 15:44

make Authorizer an interface

9fd2976

complete user module

709dedd

add role operations to user manager

8a8e98a

Complete role module

d8215cb

complete LocalFileAuthorizer

7f52441

fix a problem that using mmap will cause file unclosable

8aab7a3

fix reset method of user manager

4b330c2

update documentations

deffb29

refact authorizer

ce94b10

update documentations

81dfa1c

refact PathPrivilege

7365036

refact RoleManager UserManager

3c994a1

fix privilege removal

b18295d

use backup file to increase the robustness when saving profiles

0c8b73d

Authorizer implements IService

550fb04

fix listAllRoles and listAllUsers

3d8bc02

fix null string read/write

682803a

fix concurrency logics

0fd2665

update unit tests

171ee0a

fix the usage of Authorizer in IoTDB

f277d66

temporary save

b5917b3

fix usage of Authorization Module

5f48b7f

finish authorization tests

85f6443

Merge branch 'master' into new_authorizer

bf4623e

# Conflicts: # src/main/java/cn/edu/tsinghua/iotdb/qp/executor/OverflowQPExecutor.java # src/test/java/cn/edu/tsinghua/iotdb/utils/EnvironmentUtils.java

optimize checkPrivilege() method

1e6949e

update serialization order of PathPrivilege

9bb4f37

fix loadUser method

90a540f

ignore performance test

378d325

IDE-based code optimization

0fd6f0a

update error msg

4804763

jt2594838 added 2 commits March 16, 2018 14:32

add list functions

00a643f

complete list tests

e3927da

MyXOF requested changes Mar 22, 2018

View reviewed changes

jt2594838 added 2 commits March 22, 2018 14:18

pull request advices taken

606c7d2

fix a comment

b606475

liukun4515 reviewed Mar 22, 2018

View reviewed changes

jt2594838 added 2 commits March 22, 2018 15:40

fix some naming error

d397726

simply profile saving

3f06be4

liukun4515 requested changes Mar 22, 2018

View reviewed changes

jt2594838 added 2 commits March 22, 2018 16:40

fix naming errors

7697a09

fix missing listAllRole in BasicRoleManager

9a43956

MyXOF approved these changes Mar 26, 2018

View reviewed changes

liukun4515 approved these changes Mar 26, 2018

View reviewed changes

MyXOF merged commit 2c68db2 into master Mar 27, 2018

Beyyes deleted the new_authorizer branch April 14, 2018 06:47

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

New authorizer #349

New authorizer #349

jt2594838 commented Mar 15, 2018

MyXOF Mar 22, 2018

jt2594838 Mar 22, 2018

MyXOF Mar 22, 2018

jt2594838 Mar 22, 2018

MyXOF Mar 22, 2018

jt2594838 Mar 22, 2018

MyXOF Mar 22, 2018

jt2594838 Mar 22, 2018

MyXOF Mar 22, 2018

jt2594838 Mar 22, 2018

MyXOF Mar 22, 2018

jt2594838 Mar 22, 2018

MyXOF Mar 22, 2018

jt2594838 Mar 22, 2018

MyXOF Mar 22, 2018

jt2594838 Mar 22, 2018

MyXOF Mar 22, 2018

jt2594838 Mar 22, 2018

MyXOF Mar 22, 2018

jt2594838 Mar 22, 2018

liukun4515 Mar 22, 2018

jt2594838 Mar 22, 2018 •

edited

Loading

liukun4515 Mar 22, 2018

jt2594838 Mar 22, 2018

liukun4515 Mar 22, 2018

jt2594838 Mar 22, 2018

liukun4515 Mar 22, 2018

jt2594838 Mar 22, 2018

liukun4515 Mar 22, 2018

New authorizer #349

New authorizer #349

Conversation

jt2594838 commented Mar 15, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jt2594838 Mar 22, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jt2594838 Mar 22, 2018 •

edited

Loading