741d215516
This is a large change, but it's a necessary evil. This change brings us to a minimally-functional implementation of roles. There are many additional changes that are necessary, including refined grammar, bug fixes, code hygiene, and internal code structure changes. In the interest of keeping this patch somewhat read-able, those changes will come in subsequent patches. Until that time, roles are still marked "unimplemented". IMPORTANT: This code does not include any mechanism for transitioning a cluster from user-based access-control to role-based access control. All existing access-control metadata will be ignored (though not deleted). Specific changes: - All user-specific CQL statements now delegate to their roles equivalent. The statements are effectively the same, but CREATE USER will include LOGIN automatically. Also, LIST USERS only lists roles with LOGIN. - A call to LIST PERMISSIONS will now also list permissions of roles that have been granted to the caller, in addition to permissions which have been granted directly. - Much of the logic of creating, altering, and deleting roles has been moved to `auth::service`, since these operations require cooperation between the authenticator, authorizer, and role-manager. - LIST USERS actually works as expected now (fixes #2968).
52 lines
1.7 KiB
C++
52 lines
1.7 KiB
C++
/*
|
|
* Copyright (C) 2017 ScyllaDB
|
|
*/
|
|
|
|
/*
|
|
* This file is part of Scylla.
|
|
*
|
|
* Scylla is free software: you can redistribute it and/or modify
|
|
* it under the terms of the GNU Affero General Public License as published by
|
|
* the Free Software Foundation, either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* Scylla is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with Scylla. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
#include "auth/permissions_cache.hh"
|
|
|
|
#include "auth/authorizer.hh"
|
|
#include "auth/common.hh"
|
|
#include "auth/service.hh"
|
|
#include "db/config.hh"
|
|
|
|
namespace auth {
|
|
|
|
permissions_cache_config permissions_cache_config::from_db_config(const db::config& dc) {
|
|
permissions_cache_config c;
|
|
c.max_entries = dc.permissions_cache_max_entries();
|
|
c.validity_period = std::chrono::milliseconds(dc.permissions_validity_in_ms());
|
|
c.update_period = std::chrono::milliseconds(dc.permissions_update_interval_in_ms());
|
|
|
|
return c;
|
|
}
|
|
|
|
permissions_cache::permissions_cache(const permissions_cache_config& c, service& ser, logging::logger& log)
|
|
: _cache(c.max_entries, c.validity_period, c.update_period, log, [&ser, &log](const key_type& k) {
|
|
log.debug("Refreshing permissions for {}", k.first);
|
|
return ser.underlying_authorizer().authorize(ser, k.first, k.second);
|
|
}) {
|
|
}
|
|
|
|
future<permission_set> permissions_cache::get(stdx::string_view role_name, resource r) {
|
|
return _cache.get(key_type(sstring(role_name), r));
|
|
}
|
|
|
|
}
|