feat(auth): Add roles to policy engine validation logic #9178
Conversation
github-actions
bot
added
the
devops
metadata-service/auth-impl/src/main/java/com/datahub/authorization/PolicyEngine.java
Outdated
Show resolved
Hide resolved
metadata-service/auth-impl/src/test/java/com/datahub/authorization/PolicyEngineTest.java
Outdated
Show resolved
Hide resolved
metadata-service/auth-impl/src/main/java/com/datahub/authorization/DataHubAuthorizer.java
Outdated
Show resolved
Hide resolved
|
Needs a test |
pedro93
force-pushed
the
ps-add-role-validation-to-auth-engine
branch
from
27710ae to
2f2d8f9
Compare
| @@ -126,11 +126,16 @@ private AuthorizedActors mergeAuthorizedActors(@Nullable AuthorizedActors origin | |||
| mergedGroups = new ArrayList<>(groups); | |||
| } | |||
|
|
|||
| Set<Urn> roles = new HashSet<>(original.getRoles()); | |||
There was a problem hiding this comment.
This method seems like dead code? I don't see any references to it outside of this class and tracing back to Dexter's PR I don't see any actual usages of it. To get the actors authorized for something we go through different code unless I'm missing something?
There was a problem hiding this comment.
I am not super familiar with the code.
My understanding is that this merging logic is for when we have multiple chained authorizers.
Since the interface extended a plugin interface, this was something we supported for the community.
metadata-service/auth-impl/src/main/java/com/datahub/authorization/DataHubAuthorizer.java
Show resolved
Hide resolved
| @@ -96,6 +100,9 @@ public PolicyActors getMatchingActors( | |||
| if (actorFilter.getGroups() != null) { | |||
| groups.addAll(actorFilter.getGroups()); | |||
| } | |||
| if (actorFilter.getRoles() != null) { | |||
There was a problem hiding this comment.
This seems to only be used in the dead code above, this check is covered by isRoleMatch
metadata-service/auth-impl/src/main/java/com/datahub/authorization/PolicyEngine.java
Show resolved
Hide resolved
metadata-service/auth-impl/src/test/java/com/datahub/authorization/DataHubAuthorizerTest.java
Show resolved
Hide resolved
metadata-service/auth-impl/src/test/java/com/datahub/authorization/PolicyEngineTest.java
Show resolved
Hide resolved
|
Looks like just needs one conflict resolved. Once this is green LGTM. Nice work! |
pedro93
force-pushed
the
ps-add-role-validation-to-auth-engine
branch
from
7604825 to
6651afe
Compare
Adds roles as a new set of actor that is allowed to perform operations on DataHub.
Checklist