Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add access control support for admin service #3233

Merged

Conversation

nobodyiam
Copy link
Member

@nobodyiam nobodyiam commented Aug 8, 2020

What's the purpose of this PR

Add access control support for admin service so that only trusted apollo portal could access admin service.

Instructions

Configurations for admin service

The following configurations can be set in ApolloConfigDB.ServerConfig.

  • admin-service.access.control.enabled

Specify whether to enable access control for admin service or not. If set to true, then portal must pass the correct token when calling admin service.

Example:
admin-service.access.control.enabled=true

  • admin-service.access.tokens

Specify the tokens allowed to call admin service, multiple tokens should be separated by ,.
If this configuration is empty, then the access control won't take effect.

Example:
admin-service.access.tokens=098f6bcd4621d373cade4e832627b4f6
admin-service.access.tokens=098f6bcd4621d373cade4e832627b4f6,ad0234829205b9033196ba818f7a872b

Configurations for portal

The following configurations can be set in ApolloPortalDB.ServerConfig.

  • admin-service.access.tokens

Specify the access tokens for admin service in different environments in json format, e.g.

{
    "dev" : "098f6bcd4621d373cade4e832627b4f6",
    "pro" : "ad0234829205b9033196ba818f7a872b"
}

Follow this checklist to help us incorporate your contribution quickly and easily:

  • Read the Contributing Guide before making this pull request.
  • Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
  • Write necessary unit tests to verify the code.
  • Run mvn clean test to make sure this pull request doesn't break anything.

@codecov-commenter
Copy link

codecov-commenter commented Aug 8, 2020

Codecov Report

Merging #3233 into master will increase coverage by 0.44%.
The diff coverage is 92.39%.

Impacted file tree graph

@@             Coverage Diff              @@
##             master    #3233      +/-   ##
============================================
+ Coverage     51.05%   51.49%   +0.44%     
- Complexity     2270     2296      +26     
============================================
  Files           440      442       +2     
  Lines         13660    13739      +79     
  Branches       1389     1398       +9     
============================================
+ Hits           6974     7075     +101     
+ Misses         6199     6175      -24     
- Partials        487      489       +2     
Impacted Files Coverage Δ Complexity Δ
...m/ctrip/framework/apollo/biz/config/BizConfig.java 26.78% <0.00%> (-1.00%) 8.00 <0.00> (ø)
...k/apollo/portal/component/config/PortalConfig.java 22.82% <0.00%> (-0.26%) 9.00 <0.00> (ø)
...apollo/portal/component/RetryableRestTemplate.java 79.84% <90.90%> (+16.68%) 29.00 <7.00> (+9.00)
...lo/adminservice/AdminServiceAutoConfiguration.java 100.00% <100.00%> (ø) 2.00 <2.00> (?)
...rvice/filter/AdminServiceAuthenticationFilter.java 100.00% <100.00%> (ø) 11.00 <11.00> (?)
...nfigservice/filter/ClientAuthenticationFilter.java 91.30% <100.00%> (ø) 14.00 <0.00> (ø)
...rip/framework/apollo/core/signature/Signature.java 80.00% <100.00%> (ø) 3.00 <0.00> (ø)
...o/openapi/filter/ConsumerAuthenticationFilter.java 94.11% <100.00%> (ø) 4.00 <0.00> (ø)
... and 5 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8c5d79f...ae9ba6c. Read the comment docs.

@nobodyiam nobodyiam force-pushed the admin-service-access-control branch from c5cfeea to a489281 Compare August 14, 2020 14:29
@nobodyiam nobodyiam force-pushed the admin-service-access-control branch from a489281 to ae9ba6c Compare August 16, 2020 12:54
@nobodyiam nobodyiam merged commit 6ff6ddd into apolloconfig:master Aug 16, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants