mirror of
https://github.com/scylladb/scylladb.git
synced 2026-06-01 20:46:56 +00:00
5be16247cc
auth: Decouple authorization and role management Access control in Scylla consists of three main modules: authentication, authorization, and role-management. Each of these modules is intended to be interchangeable with alternative implementations. The `auth::service` class composes these modules together to perform all access-control functionality, including caching. This architecture implies two main properties of the individual access-control modules: - Independence of modules. An implementation of authentication should have no dependence or knowledge of authorization or role-management, for example. - Simplicity of implementing the interface. Functionality that is common to all implementations should not have to be duplicated in each implementation. The abstract interface for a module should capture only the differences between particular implementations. Previously, the authorization interface depended on an instance of `auth::service` for certain operations, since it required aggregation over all the roles granted to a particular role or required checking if a given role had superuser. This change decouples authorization entirely from role-management: the authorizer now manages only permissions granted directly to a role, and not those inherited through other roles. When a query needs to be authorized, `auth::service::get_permissions` first uses the role manager to check if the role has superuser. Then, it aggregates calls to `auth::authorizer::authorize` for each role granted to the role (again, from the role-manager) to determine the sum-total permission set. This information is cached for future queries. This structure allows for easier error handling and management (something I hope to improve in the future for both the authorizer and authenticator interfaces), easier system testing, easier implementation of the abstract interfaces, and clearer system boundaries (so the code is easier to grok). Some authorizers, like the "TransitionalAuthorizer", grant permissions to anonymous users. Therefore, we could not unconditionally authorize an empty permission set in `auth::service` for anonymous users. To account for this, the interface of the authorizer has changed to accept an optional name in `authorize`. One additional notable change to the authorizer is the `auth::authorizer::list`: previously, the filtering happened at the CQL query layer and depended on the roles granted to the role in question. I've changed the function to simply query for all roles and I do the filtering in `auth::system` in-memory with the STL. This was necessary to allow the authorizer to be decoupled from role-management. This function is only called for LIST PERMISSIONS (so performance is not a concern), and it significantly reduces demand on the implementation. Finally, we unconditionally create a user in `cql_test_env` since authorization requires its existence.
Scylla
Quick-start
$ git submodule update --init --recursive
$ sudo ./install-dependencies.sh
$ ./configure.py --mode=release
$ ninja-build -j4 # Assuming 4 system threads.
$ ./build/release/scylla
$ # Rejoice!
Please see HACKING.md for detailed information on building and developing Scylla.
Running Scylla
- Run Scylla
./build/release/scylla
- run Scylla with one CPU and ./tmp as data directory
./build/release/scylla --datadir tmp --commitlog-directory tmp --smp 1
- For more run options:
./build/release/scylla --help
Building Fedora RPM
As a pre-requisite, you need to install Mock on your machine:
# Install mock:
sudo yum install mock
# Add user to the "mock" group:
usermod -a -G mock $USER && newgrp mock
Then, to build an RPM, run:
./dist/redhat/build_rpm.sh
The built RPM is stored in /var/lib/mock/<configuration>/result directory.
For example, on Fedora 21 mock reports the following:
INFO: Done(scylla-server-0.00-1.fc21.src.rpm) Config(default) 20 minutes 7 seconds
INFO: Results and/or logs in: /var/lib/mock/fedora-21-x86_64/result
Building Fedora-based Docker image
Build a Docker image with:
cd dist/docker
docker build -t <image-name> .
Run the image with:
docker run -p $(hostname -i):9042:9042 -i -t <image name>