throw new AuthenticationException(authenticationErrorMessage(mode, username)); return new AuthenticatedUser(username);
private void authenticate() { if (!StorageService.instance.isAuthSetupComplete()) throw new AuthenticationException("Cannot login as server authentication setup is not yet completed"); IAuthenticator authenticator = DatabaseDescriptor.getAuthenticator(); Map<String, String> credentials = new HashMap<>(); credentials.put(PasswordAuthenticator.USERNAME_KEY, username); credentials.put(PasswordAuthenticator.PASSWORD_KEY, String.valueOf(password)); AuthenticatedUser user = authenticator.legacyAuthenticate(credentials); // Only actual users should be allowed to authenticate for JMX if (user.isAnonymous() || user.isSystem()) throw new AuthenticationException(String.format("Invalid user %s", user.getName())); // The LOGIN privilege is required to authenticate - c.f. ClientState::login if (!DatabaseDescriptor.getRoleManager().canLogin(user.getPrimaryRole())) throw new AuthenticationException(user.getName() + " is not permitted to log in"); }
public Set<PermissionDetails> list(AuthenticatedUser performer, Set<Permission> permissions, IResource resource, RoleResource grantee) throws RequestValidationException, RequestExecutionException { if (!(performer.isSuper() || performer.isSystem()) && !performer.getRoles().contains(grantee)) throw new UnauthorizedException(String.format("You are not authorized to view %s's permissions", grantee == null ? "everyone" : grantee.getRoleName())); if (null == grantee) return listPermissionsForRole(permissions, resource, grantee); Set<RoleResource> roles = DatabaseDescriptor.getRoleManager().getRoles(grantee, true); Set<PermissionDetails> details = new HashSet<>(); for (RoleResource role : roles) details.addAll(listPermissionsForRole(permissions, resource, role)); return details; }
/** * Attempts to login the given user. */ public void login(AuthenticatedUser user) throws AuthenticationException { if (!user.isAnonymous() && !Auth.isExistingUser(user.getName())) throw new AuthenticationException(String.format("User %s doesn't exist - create it with CREATE USER query first", user.getName())); this.user = user; }
/** * Attempts to login the given user. */ public void login(AuthenticatedUser user) throws AuthenticationException { // Login privilege is not inherited via granted roles, so just // verify that the role with the credentials that were actually // supplied has it if (user.isAnonymous() || DatabaseDescriptor.getRoleManager().canLogin(user.getPrimaryRole())) this.user = user; else throw new AuthenticationException(String.format("%s is not permitted to log in", user.getName())); }
public Set<Permission> authorize(AuthenticatedUser user, IResource resource) { if (user.isSuper()) return resource.applicablePermissions(); Set<Permission> permissions = EnumSet.noneOf(Permission.class); try { for (RoleResource role: user.getRoles()) addPermissionsForRole(permissions, resource, role); } catch (RequestValidationException e) { throw new AssertionError(e); // not supposed to happen } catch (RequestExecutionException e) { logger.warn("CassandraAuthorizer failed to authorize {} for {}", user, resource); throw new RuntimeException(e); } return permissions; }
String kspAdmins = accessProperties.getProperty(KEYSPACES_WRITE_PROPERTY); for (String admin : kspAdmins.split(",")) if (admin.equals(user.getName())) return (EnumSet<Permission>) Permission.ALL; if (reader.equals(user.getName())) { canRead = true; break; if (writer.equals(user.getName())) { canWrite = true; break;
public void checkAccess(ClientState state) throws UnauthorizedException { AuthenticatedUser user = state.getUser(); boolean isSuper = user.isSuper(); if (opts.getSuperuser().isPresent() && user.getRoles().contains(role)) throw new UnauthorizedException("You aren't allowed to alter your own superuser " + "status or that of a role granted to you"); if (opts.getSuperuser().isPresent() && !isSuper) throw new UnauthorizedException("Only superusers are allowed to alter superuser status"); // superusers can do whatever else they like if (isSuper) return; // a role may only modify the subset of its own attributes as determined by IRoleManager#alterableOptions if (user.getName().equals(role.getRoleName())) { for (Option option : opts.getOptions().keySet()) { if (!DatabaseDescriptor.getRoleManager().alterableOptions().contains(option)) throw new UnauthorizedException(String.format("You aren't allowed to alter %s", option)); } } else { // if not attempting to alter another role, ensure we have ALTER permissions on it super.checkPermission(state, Permission.ALTER, role); } }
public void checkAccess(ClientState state) throws UnauthorizedException { AuthenticatedUser user = state.getUser(); boolean isSuper = user.isSuper(); if (superuser != null && user.getName().equals(username)) throw new UnauthorizedException("You aren't allowed to alter your own superuser status"); if (superuser != null && !isSuper) throw new UnauthorizedException("Only superusers are allowed to alter superuser status"); if (!user.isSuper() && !user.getName().equals(username)) throw new UnauthorizedException("You aren't allowed to alter this user"); if (!isSuper) { for (IAuthenticator.Option option : opts.getOptions().keySet()) { if (!DatabaseDescriptor.getAuthenticator().alterableOptions().contains(option)) throw new UnauthorizedException(String.format("You aren't allowed to alter %s option", option)); } } }
public void checkAccess(ClientState state) throws UnauthorizedException { if (!state.getUser().isSuper()) throw new UnauthorizedException("Only superusers are allowed to perform DROP USER queries"); }
/** * Checks the user's superuser status. * Only a superuser is allowed to perform CREATE USER and DROP USER queries. * Im most cased, though not necessarily, a superuser will have Permission.ALL on every resource * (depends on IAuthorizer implementation). */ public boolean isSuper() { return !isAnonymous() && Roles.hasSuperuserStatus(role); }
private Set<Permission> authorize(IResource resource) { return user.getPermissions(resource); } }
private void checkPermissionOnResourceChain(Permission perm, IResource resource) { for (IResource r : Resources.chain(resource)) if (authorize(r).contains(perm)) return; throw new UnauthorizedException(String.format("User %s has no %s permission on %s or any of its parents", user.getName(), perm, resource)); }
/** * Attempts to login the given user. */ public void login(AuthenticatedUser user) throws AuthenticationException { // Login privilege is not inherited via granted roles, so just // verify that the role with the credentials that were actually // supplied has it if (user.isAnonymous() || DatabaseDescriptor.getRoleManager().canLogin(user.getPrimaryRole())) this.user = user; else throw new AuthenticationException(String.format("%s is not permitted to log in", user.getName())); }
public void checkAccess(ClientState state) throws UnauthorizedException { AuthenticatedUser user = state.getUser(); boolean isSuper = user.isSuper(); if (opts.getSuperuser().isPresent() && user.getRoles().contains(role)) throw new UnauthorizedException("You aren't allowed to alter your own superuser " + "status or that of a role granted to you"); if (opts.getSuperuser().isPresent() && !isSuper) throw new UnauthorizedException("Only superusers are allowed to alter superuser status"); // superusers can do whatever else they like if (isSuper) return; // a role may only modify the subset of its own attributes as determined by IRoleManager#alterableOptions if (user.getName().equals(role.getRoleName())) { for (Option option : opts.getOptions().keySet()) { if (!DatabaseDescriptor.getRoleManager().alterableOptions().contains(option)) throw new UnauthorizedException(String.format("You aren't allowed to alter %s", option)); } } else { // if not attempting to alter another role, ensure we have ALTER permissions on it super.checkPermission(state, Permission.ALTER, role); } }
/** * Grant all applicable permissions on the newly created role to the user performing the request * see also: SchemaAlteringStatement#grantPermissionsToCreator and the overridden implementations * of it in subclasses CreateKeyspaceStatement & CreateTableStatement. * @param state */ private void grantPermissionsToCreator(ClientState state) { // The creator of a Role automatically gets ALTER/DROP/AUTHORIZE permissions on it if: // * the user is not anonymous // * the configured IAuthorizer supports granting of permissions (not all do, AllowAllAuthorizer doesn't and // custom external implementations may not) if (!state.getUser().isAnonymous()) { try { DatabaseDescriptor.getAuthorizer().grant(AuthenticatedUser.SYSTEM_USER, role.applicablePermissions(), role, RoleResource.role(state.getUser().getName())); } catch (UnsupportedOperationException e) { // not a problem, grant is an optional method on IAuthorizer } } } }
public Set<PermissionDetails> list(AuthenticatedUser performer, Set<Permission> permissions, IResource resource, String of) throws RequestValidationException, RequestExecutionException { if (!performer.isSuper() && !performer.getName().equals(of)) throw new UnauthorizedException(String.format("You are not authorized to view %s's permissions", of == null ? "everyone" : of)); Set<PermissionDetails> details = new HashSet<PermissionDetails>(); for (UntypedResultSet.Row row : process(buildListQuery(resource, of))) { if (row.has(PERMISSIONS)) { for (String p : row.getSet(PERMISSIONS, UTF8Type.instance)) { Permission permission = Permission.valueOf(p); if (permissions.contains(permission)) details.add(new PermissionDetails(row.getString(USERNAME), DataResource.fromName(row.getString(RESOURCE)), permission)); } } } return details; }
public void checkAccess(ClientState state) throws UnauthorizedException { if (!state.getUser().isSuper()) throw new UnauthorizedException("Only superusers are allowed to perform CREATE USER queries"); }
/** * Checks the user's superuser status. * Only a superuser is allowed to perform CREATE USER and DROP USER queries. * Im most cased, though not necessarily, a superuser will have Permission.ALL on every resource * (depends on IAuthorizer implementation). */ public boolean isSuper() { return !isAnonymous() && Roles.hasSuperuserStatus(role); }
public Set<Permission> authorize(AuthenticatedUser user, IResource resource) { if (user.isSuper()) return resource.applicablePermissions(); Set<Permission> permissions = EnumSet.noneOf(Permission.class); try { for (RoleResource role: user.getRoles()) addPermissionsForRole(permissions, resource, role); } catch (RequestValidationException e) { throw new AssertionError(e); // not supposed to happen } catch (RequestExecutionException e) { logger.warn("CassandraAuthorizer failed to authorize {} for {}", user, resource); throw new RuntimeException(e); } return permissions; }