Package com.linkedin.venice.authorization

Interface AuthorizerService

All Known Implementing Classes:

MockVeniceAuthorizer

public interface AuthorizerService

An interface to provide functionality to manage ACL's for a Resource and provide access permission Permission to principals Principal when performing Method. The underlying implementation can choose any mechanism for storing and scanning of the ACL's. No guarantees are made about canAccess(Method, Resource, X509Certificate) api when duplicate or conflicting AceEntries are present. An example of how an application flow may looks like. setupResource(Resource) setAcls(AclBinding) canAccess(Method, Resource, X509Certificate) addAce(Resource, AceEntry) canAccess(Method, Resource, X509Certificate) removeAce(Resource, AceEntry) canAccess(Method, Resource, X509Certificate) clearAcls(Resource) clearResource(Resource) }

Method Summary

Modifier and Type	Method	Description
void	addAce(Resource resource, AceEntry aceEntry)	This will add a single AceEntry to the existing AceEntries for a resource.
boolean	canAccess(Method method, Resource resource, Principal principal)	Check if the principal has the permission to perform the method on the resource.
boolean	canAccess(Method method, Resource resource, java.security.cert.X509Certificate accessorCert)	Check if the principal has the permission to perform the method on the resource.
void	clearAcls(Resource resource)	This will clear the existing AceEntries for a resource.
default void	clearResource(Resource resource)	This may perform any finalization steps that may be necessary after all ACL's for a resource is deleted and the resource will not be used later.
AclBinding	describeAcls(Resource resource)	Return a list of existing AceEntries present for the given resource.
void	removeAce(Resource resource, AceEntry aceEntry)	This will remove a single AceEntry from the existing AceEntries for a resource.
void	setAcls(AclBinding aclBinding)	This will set the AceEntries in provided AclBinding object to be the current set of ACL's for the resource.
default void	setupResource(Resource resource)	This may perform any initialization steps that may be necessary before start provisioning any ACL's for a resource.

Method Detail

canAccess

boolean canAccess(Method method,
                  Resource resource,
                  Principal principal)

Check if the principal has the permission to perform the method on the resource. Implementation should define how to handle duplicate/conflicting ACE entries present for the resource and also how to handle presence of no AceEntries for a resource.

Parameters:

method - what method is being performed.

resource - what resource the method is being performed

principal - who is performing the method on the resource.

Returns:

true if principal has the permission to perform the method on the resource, otherwise return false.

canAccess

boolean canAccess(Method method,
                  Resource resource,
                  java.security.cert.X509Certificate accessorCert)

Check if the principal has the permission to perform the method on the resource. Implementation should define how to handle duplicate/conflicting ACE entries present for the resource and also how to handle presence of no AceEntries for a resource.

Parameters:

method - what method is being performed.

resource - what resource the method is being performed

accessorCert - who is performing the method on the resource.

Returns:

true if principal has the permission to perform the method on the resource, otherwise return false.

describeAcls

AclBinding describeAcls(Resource resource)

Return a list of existing AceEntries present for the given resource. Implementations should return an empty AclBinding object when no acl's are present for the resource.

Parameters:

resource -

Returns:

AclBinding object containg the list of existing aceEntries. The AceEntry list may be empty if there is no existing ACL's provisioned.

setAcls

void setAcls(AclBinding aclBinding)

This will set the AceEntries in provided AclBinding object to be the current set of ACL's for the resource. This performs an overwrite operation. An empty AceEntries list will clear all acls and achieve a similar result like clearAcls(Resource).

Parameters:

aclBinding - A fully contained object having a list of AceEntries associated with the resource.

clearAcls

void clearAcls(Resource resource)

This will clear the existing AceEntries for a resource.

Parameters:

resource - the resource for which all ACl's will be cleared.

addAce

void addAce(Resource resource,
            AceEntry aceEntry)

This will add a single AceEntry to the existing AceEntries for a resource. Implementation may or may not allow duplicate/conflicting entries. Implementation may throw any necessary error/exception.

Parameters:

resource - The resource for which an AceEntry is getting added.

aceEntry - The AceEntry to be removed.

removeAce

void removeAce(Resource resource,
               AceEntry aceEntry)

This will remove a single AceEntry from the existing AceEntries for a resource. Implementation should define how to handle removal in case duplicate AceEntries are allowed. The equivalence check should do exact match of all fields of the AceEntry object. Implementation may throw any necessary error/exception.

Parameters:

resource - The resource for which an AceEntry is getting removed.

aceEntry - The AceEntry to be removed.

setupResource

default void setupResource(Resource resource)

This may perform any initialization steps that may be necessary before start provisioning any ACL's for a resource. This may be used to setup/allocate any metadata/context about the resource. This is optional to implement. Implementation should mandate if this needs to be called before start provisioning any ACL's for the resource.

Parameters:

resource -

clearResource

default void clearResource(Resource resource)

This may perform any finalization steps that may be necessary after all ACL's for a resource is deleted and the resource will not be used later. This may be used to clean up any metadata/context information about the resource that was setup in setupResource(com.linkedin.venice.authorization.Resource). This is optional to implement. Implementation should mandate if this needs to be called after deleting all ACL's for the resource.

Parameters:

resource -