5be16247cc
auth: Decouple authorization and role management Access control in Scylla consists of three main modules: authentication, authorization, and role-management. Each of these modules is intended to be interchangeable with alternative implementations. The `auth::service` class composes these modules together to perform all access-control functionality, including caching. This architecture implies two main properties of the individual access-control modules: - Independence of modules. An implementation of authentication should have no dependence or knowledge of authorization or role-management, for example. - Simplicity of implementing the interface. Functionality that is common to all implementations should not have to be duplicated in each implementation. The abstract interface for a module should capture only the differences between particular implementations. Previously, the authorization interface depended on an instance of `auth::service` for certain operations, since it required aggregation over all the roles granted to a particular role or required checking if a given role had superuser. This change decouples authorization entirely from role-management: the authorizer now manages only permissions granted directly to a role, and not those inherited through other roles. When a query needs to be authorized, `auth::service::get_permissions` first uses the role manager to check if the role has superuser. Then, it aggregates calls to `auth::authorizer::authorize` for each role granted to the role (again, from the role-manager) to determine the sum-total permission set. This information is cached for future queries. This structure allows for easier error handling and management (something I hope to improve in the future for both the authorizer and authenticator interfaces), easier system testing, easier implementation of the abstract interfaces, and clearer system boundaries (so the code is easier to grok). Some authorizers, like the "TransitionalAuthorizer", grant permissions to anonymous users. Therefore, we could not unconditionally authorize an empty permission set in `auth::service` for anonymous users. To account for this, the interface of the authorizer has changed to accept an optional name in `authorize`. One additional notable change to the authorizer is the `auth::authorizer::list`: previously, the filtering happened at the CQL query layer and depended on the roles granted to the role in question. I've changed the function to simply query for all roles and I do the filtering in `auth::system` in-memory with the STL. This was necessary to allow the authorizer to be decoupled from role-management. This function is only called for LIST PERMISSIONS (so performance is not a concern), and it significantly reduces demand on the implementation. Finally, we unconditionally create a user in `cql_test_env` since authorization requires its existence.
54 lines
1.8 KiB
C++
54 lines
1.8 KiB
C++
/*
|
|
* Copyright (C) 2017 ScyllaDB
|
|
*/
|
|
|
|
/*
|
|
* This file is part of Scylla.
|
|
*
|
|
* Scylla is free software: you can redistribute it and/or modify
|
|
* it under the terms of the GNU Affero General Public License as published by
|
|
* the Free Software Foundation, either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* Scylla is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with Scylla. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
#include "auth/permissions_cache.hh"
|
|
|
|
#include "auth/authorizer.hh"
|
|
#include "auth/common.hh"
|
|
#include "auth/service.hh"
|
|
#include "db/config.hh"
|
|
|
|
namespace auth {
|
|
|
|
permissions_cache_config permissions_cache_config::from_db_config(const db::config& dc) {
|
|
permissions_cache_config c;
|
|
c.max_entries = dc.permissions_cache_max_entries();
|
|
c.validity_period = std::chrono::milliseconds(dc.permissions_validity_in_ms());
|
|
c.update_period = std::chrono::milliseconds(dc.permissions_update_interval_in_ms());
|
|
|
|
return c;
|
|
}
|
|
|
|
permissions_cache::permissions_cache(const permissions_cache_config& c, service& ser, logging::logger& log)
|
|
: _cache(c.max_entries, c.validity_period, c.update_period, log, [&ser, &log](const key_type& k) {
|
|
log.debug("Refreshing permissions for {}", k.first);
|
|
return ser.get_uncached_permissions(k.first, k.second);
|
|
}) {
|
|
}
|
|
|
|
future<permission_set> permissions_cache::get(const role_or_anonymous& maybe_role, const resource& r) {
|
|
return do_with(key_type(maybe_role, r), [this](const auto& k) {
|
|
return _cache.get(k);
|
|
});
|
|
}
|
|
|
|
}
|