-
Notifications
You must be signed in to change notification settings - Fork 383
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge remote-tracking branch 'upstream/main' into feat-5192-2
- Loading branch information
Showing
93 changed files
with
2,855 additions
and
370 deletions.
There are no files selected for viewing
116 changes: 116 additions & 0 deletions
116
api/src/main/java/org/apache/gravitino/credential/ADLSTokenCredential.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,116 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one | ||
| * or more contributor license agreements. See the NOTICE file | ||
| * distributed with this work for additional information | ||
| * regarding copyright ownership. The ASF licenses this file | ||
| * to you under the Apache License, Version 2.0 (the | ||
| * "License"); you may not use this file except in compliance | ||
| * with the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, | ||
| * software distributed under the License is distributed on an | ||
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| * KIND, either express or implied. See the License for the | ||
| * specific language governing permissions and limitations | ||
| * under the License. | ||
| */ | ||
|
|
||
| package org.apache.gravitino.credential; | ||
|
|
||
| import com.google.common.base.Preconditions; | ||
| import com.google.common.collect.ImmutableMap; | ||
| import java.util.Map; | ||
| import org.apache.commons.lang3.StringUtils; | ||
|
|
||
| /** ADLS SAS token credential. */ | ||
| public class ADLSTokenCredential implements Credential { | ||
|
|
||
| /** ADLS SAS token credential type. */ | ||
| public static final String ADLS_SAS_TOKEN_CREDENTIAL_TYPE = "adls-sas-token"; | ||
| /** ADLS base domain */ | ||
| public static final String ADLS_DOMAIN = "dfs.core.windows.net"; | ||
| /** ADLS storage account name */ | ||
| public static final String GRAVITINO_AZURE_STORAGE_ACCOUNT_NAME = "azure-storage-account-name"; | ||
| /** ADLS SAS token used to access ADLS data. */ | ||
| public static final String GRAVITINO_ADLS_SAS_TOKEN = "adls-sas-token"; | ||
|
|
||
| private String accountName; | ||
| private String sasToken; | ||
| private long expireTimeInMS; | ||
|
|
||
| /** | ||
| * Constructs an instance of {@link ADLSTokenCredential} with SAS token. | ||
| * | ||
| * @param accountName The ADLS account name. | ||
| * @param sasToken The ADLS SAS token. | ||
| * @param expireTimeInMS The SAS token expire time in ms. | ||
| */ | ||
| public ADLSTokenCredential(String accountName, String sasToken, long expireTimeInMS) { | ||
| validate(accountName, sasToken, expireTimeInMS); | ||
| this.accountName = accountName; | ||
| this.sasToken = sasToken; | ||
| this.expireTimeInMS = expireTimeInMS; | ||
| } | ||
|
|
||
| /** | ||
| * This is the constructor that is used by credential factory to create an instance of credential | ||
| * according to the credential information. | ||
| */ | ||
| public ADLSTokenCredential() {} | ||
|
|
||
| @Override | ||
| public String credentialType() { | ||
| return ADLS_SAS_TOKEN_CREDENTIAL_TYPE; | ||
| } | ||
|
|
||
| @Override | ||
| public long expireTimeInMs() { | ||
| return expireTimeInMS; | ||
| } | ||
|
|
||
| @Override | ||
| public Map<String, String> credentialInfo() { | ||
| return (new ImmutableMap.Builder<String, String>()) | ||
| .put(GRAVITINO_ADLS_SAS_TOKEN, sasToken) | ||
| .build(); | ||
| } | ||
|
|
||
| @Override | ||
| public void initialize(Map<String, String> credentialInfo, long expireTimeInMS) { | ||
| String accountName = credentialInfo.get(GRAVITINO_AZURE_STORAGE_ACCOUNT_NAME); | ||
| String sasToken = credentialInfo.get(GRAVITINO_ADLS_SAS_TOKEN); | ||
| validate(accountName, sasToken, expireTimeInMS); | ||
| this.accountName = accountName; | ||
| this.sasToken = sasToken; | ||
| this.expireTimeInMS = expireTimeInMS; | ||
| } | ||
|
|
||
| /** | ||
| * Get ADLS account name | ||
| * | ||
| * @return The ADLS account name | ||
| */ | ||
| public String accountName() { | ||
| return accountName; | ||
| } | ||
|
|
||
| /** | ||
| * Get ADLS SAS token. | ||
| * | ||
| * @return The ADLS SAS token. | ||
| */ | ||
| public String sasToken() { | ||
| return sasToken; | ||
| } | ||
|
|
||
| private void validate(String accountName, String sasToken, long expireTimeInMS) { | ||
| Preconditions.checkArgument( | ||
| StringUtils.isNotBlank(accountName), "ADLS account name should not be empty."); | ||
| Preconditions.checkArgument( | ||
| StringUtils.isNotBlank(sasToken), "ADLS SAS token should not be empty."); | ||
| Preconditions.checkArgument( | ||
| expireTimeInMS > 0, "The expire time of ADLSTokenCredential should great than 0"); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
160 changes: 160 additions & 0 deletions
160
...src/main/java/org/apache/gravitino/authorization/ranger/ChainAuthorizationProperties.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,160 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one | ||
| * or more contributor license agreements. See the NOTICE file | ||
| * distributed with this work for additional information | ||
| * regarding copyright ownership. The ASF licenses this file | ||
| * to you under the Apache License, Version 2.0 (the | ||
| * "License"); you may not use this file except in compliance | ||
| * with the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, | ||
| * software distributed under the License is distributed on an | ||
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| * KIND, either express or implied. See the License for the | ||
| * specific language governing permissions and limitations | ||
| * under the License. | ||
| */ | ||
| package org.apache.gravitino.authorization.ranger; | ||
|
|
||
| import com.google.common.base.Preconditions; | ||
| import com.google.common.collect.ImmutableList; | ||
| import java.util.Arrays; | ||
| import java.util.HashMap; | ||
| import java.util.List; | ||
| import java.util.Map; | ||
| import java.util.regex.Matcher; | ||
| import java.util.regex.Pattern; | ||
| import java.util.stream.Collectors; | ||
|
|
||
| /** | ||
| * The properties for Chain authorization plugin. <br> | ||
| * <br> | ||
| * Configuration Example: <br> | ||
| * "authorization.chain.plugins" = "hive1,hdfs1" <br> | ||
| * "authorization.chain.hive1.provider" = "ranger"; <br> | ||
| * "authorization.chain.hive1.ranger.service.type" = "HadoopSQL"; <br> | ||
| * "authorization.chain.hive1.ranger.service.name" = "hiveDev"; <br> | ||
| * "authorization.chain.hive1.ranger.auth.type" = "simple"; <br> | ||
| * "authorization.chain.hive1.ranger.admin.url" = "http://localhost:6080"; <br> | ||
| * "authorization.chain.hive1.ranger.username" = "admin"; <br> | ||
| * "authorization.chain.hive1.ranger.password" = "admin"; <br> | ||
| * "authorization.chain.hdfs1.provider" = "ranger"; <br> | ||
| * "authorization.chain.hdfs1.ranger.service.type" = "HDFS"; <br> | ||
| * "authorization.chain.hdfs1.ranger.service.name" = "hdfsDev"; <br> | ||
| * "authorization.chain.hdfs1.ranger.auth.type" = "simple"; <br> | ||
| * "authorization.chain.hdfs1.ranger.admin.url" = "http://localhost:6080"; <br> | ||
| * "authorization.chain.hdfs1.ranger.username" = "admin"; <br> | ||
| * "authorization.chain.hdfs1.ranger.password" = "admin"; <br> | ||
| */ | ||
| public class ChainAuthorizationProperties { | ||
| public static final String PLUGINS_SPLITTER = ","; | ||
| /** Chain authorization plugin names */ | ||
| public static final String CHAIN_PLUGINS_PROPERTIES_KEY = "authorization.chain.plugins"; | ||
|
|
||
| /** Chain authorization plugin provider */ | ||
| public static final String CHAIN_PROVIDER = "authorization.chain.*.provider"; | ||
|
|
||
| static Map<String, String> fetchAuthPluginProperties( | ||
| String pluginName, Map<String, String> properties) { | ||
| Preconditions.checkArgument( | ||
| properties.containsKey(CHAIN_PLUGINS_PROPERTIES_KEY) | ||
| && properties.get(CHAIN_PLUGINS_PROPERTIES_KEY) != null, | ||
| String.format("%s is required", CHAIN_PLUGINS_PROPERTIES_KEY)); | ||
|
|
||
| String[] pluginNames = properties.get(CHAIN_PLUGINS_PROPERTIES_KEY).split(PLUGINS_SPLITTER); | ||
| Preconditions.checkArgument( | ||
| Arrays.asList(pluginNames).contains(pluginName), | ||
| String.format("pluginName %s must be one of %s", pluginName, Arrays.toString(pluginNames))); | ||
|
|
||
| String regex = "^authorization\\.chain\\.(" + pluginName + ")\\..*"; | ||
| Pattern pattern = Pattern.compile(regex); | ||
|
|
||
| Map<String, String> filteredProperties = new HashMap<>(); | ||
| for (Map.Entry<String, String> entry : properties.entrySet()) { | ||
| Matcher matcher = pattern.matcher(entry.getKey()); | ||
| if (matcher.matches()) { | ||
| filteredProperties.put(entry.getKey(), entry.getValue()); | ||
| } | ||
| } | ||
|
|
||
| String removeRegex = "^authorization\\.chain\\.(" + pluginName + ")\\."; | ||
| Pattern removePattern = Pattern.compile(removeRegex); | ||
|
|
||
| Map<String, String> resultProperties = new HashMap<>(); | ||
| for (Map.Entry<String, String> entry : filteredProperties.entrySet()) { | ||
| Matcher removeMatcher = removePattern.matcher(entry.getKey()); | ||
| if (removeMatcher.find()) { | ||
| resultProperties.put(removeMatcher.replaceFirst("authorization."), entry.getValue()); | ||
| } | ||
| } | ||
|
|
||
| return resultProperties; | ||
| } | ||
|
|
||
| public static void validate(Map<String, String> properties) { | ||
| Preconditions.checkArgument( | ||
| properties.containsKey(CHAIN_PLUGINS_PROPERTIES_KEY), | ||
| String.format("%s is required", CHAIN_PLUGINS_PROPERTIES_KEY)); | ||
| List<String> pluginNames = | ||
| Arrays.stream(properties.get(CHAIN_PLUGINS_PROPERTIES_KEY).split(PLUGINS_SPLITTER)) | ||
| .map(String::trim) | ||
| .collect(Collectors.toList()); | ||
| Preconditions.checkArgument( | ||
| !pluginNames.isEmpty(), | ||
| String.format("%s must have at least one plugin name", CHAIN_PLUGINS_PROPERTIES_KEY)); | ||
| Preconditions.checkArgument( | ||
| pluginNames.size() == pluginNames.stream().distinct().count(), | ||
| "Duplicate plugin name in %s: %s", | ||
| CHAIN_PLUGINS_PROPERTIES_KEY, | ||
| pluginNames); | ||
| pluginNames.stream() | ||
| .filter(v -> v.contains(".")) | ||
| .forEach( | ||
| v -> { | ||
| throw new IllegalArgumentException( | ||
| String.format( | ||
| "Plugin name cannot be contain `.` character in the `%s = %s`.", | ||
| CHAIN_PLUGINS_PROPERTIES_KEY, properties.get(CHAIN_PLUGINS_PROPERTIES_KEY))); | ||
| }); | ||
|
|
||
| Pattern pattern = Pattern.compile("^authorization\\.chain\\..*\\..*$"); | ||
| Map<String, String> filteredProperties = | ||
| properties.entrySet().stream() | ||
| .filter(entry -> pattern.matcher(entry.getKey()).matches()) | ||
| .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue)); | ||
|
|
||
| String pluginNamesPattern = String.join("|", pluginNames); | ||
| Pattern patternPluginNames = | ||
| Pattern.compile("^authorization\\.chain\\.(" + pluginNamesPattern + ")\\..*$"); | ||
| for (String key : filteredProperties.keySet()) { | ||
| Matcher matcher = patternPluginNames.matcher(key); | ||
| Preconditions.checkArgument( | ||
| matcher.matches(), | ||
| "The key %s does not match the pattern %s", | ||
| key, | ||
| patternPluginNames.pattern()); | ||
| } | ||
|
|
||
| // Generate regex patterns from wildcardProperties | ||
| List<String> wildcardProperties = ImmutableList.of(CHAIN_PROVIDER); | ||
| for (String pluginName : pluginNames) { | ||
| List<Pattern> patterns = | ||
| wildcardProperties.stream() | ||
| .map(wildcard -> "^" + wildcard.replace("*", pluginName) + "$") | ||
| .map(Pattern::compile) | ||
| .collect(Collectors.toList()); | ||
| // Validate properties keys | ||
| for (Pattern pattern1 : patterns) { | ||
| boolean matches = | ||
| filteredProperties.keySet().stream().anyMatch(key -> pattern1.matcher(key).matches()); | ||
| Preconditions.checkArgument( | ||
| matches, | ||
| "Missing required properties %s for plugin: %s", | ||
| filteredProperties, | ||
| pattern1.pattern()); | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.