Package com.linkedin.venice.acl

Class NoOpDynamicAccessController

java.lang.Object

com.linkedin.venice.acl.NoOpDynamicAccessController

All Implemented Interfaces:

AccessController, DynamicAccessController

public class NoOpDynamicAccessController
extends Object
implements DynamicAccessController

A no-op implementation of DynamicAccessController.

Field Summary

Fields

Modifier and Type	Field	Description
static final NoOpDynamicAccessController	INSTANCE
static final String	USER_UNKNOWN

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	NoOpDynamicAccessController()

Method Summary

Modifier and Type	Method	Description
void	addAcl(String resource)	Add a resource to the resource list.
Set<String>	getAccessControlledResources()	Get a list of currently being access-controlled resources.
String	getPrincipalId(X509Certificate clientCert)	Get principal Id from client certificate.
boolean	hasAccess(X509Certificate clientCert, String resource, String method)	Check if client has permission to access a particular resource.
boolean	hasAccessToAdminOperation(X509Certificate clientCert, String operation)	Check if client has permission to execute a particular admin operation.
boolean	hasAccessToTopic(X509Certificate clientCert, String resource, String method)	Check if client has permission to access a particular topic resource.
boolean	hasAcl(String resource)	Check if ACL exists for a particular resource.
DynamicAccessController	init(List<String> resources)	Initialize access controller.
boolean	isAllowlistUsers(X509Certificate clientCert, String resource, String method)	Check whether the client is the allowlist admin users.
boolean	isFailOpen()	Use this method to determine if clients will be granted access to a resource when the corresponding ACL of the resource is missing.
void	removeAcl(String resource)	Remove a resource from the resource list.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

USER_UNKNOWN

public static final String USER_UNKNOWN

See Also:

• Constant Field Values

INSTANCE

public static final NoOpDynamicAccessController INSTANCE

Constructor Details

NoOpDynamicAccessController

protected NoOpDynamicAccessController()

Method Details

init

public DynamicAccessController init(List<String> resources)

Description copied from interface: DynamicAccessController

Initialize access controller.

Specified by:

init in interface DynamicAccessController

Parameters:

resources - the initial resource list

Returns:

the access controller

hasAccess

public boolean hasAccess(X509Certificate clientCert,
 String resource,
 String method)
                  throws AclException

Description copied from interface: DynamicAccessController

Check if client has permission to access a particular resource. This method is invoked by every single request, therefore minimized execution time will result the best latency and throughput.

Specified by:

hasAccess in interface AccessController

Specified by:

hasAccess in interface DynamicAccessController

Parameters:

clientCert - the X509Certificate submitted by client

resource - the resource being requested, such as a Venice store

method - the operation (GET, POST, ...) to perform against the resource

Returns:

true if client has permission to access, otherwise false.

When DynamicAccessController.hasAcl(String) == false, return DynamicAccessController.isFailOpen().

Throws:

AclException

hasAccessToTopic

public boolean hasAccessToTopic(X509Certificate clientCert,
 String resource,
 String method)
                         throws AclException

Description copied from interface: AccessController

Check if client has permission to access a particular topic resource.

Specified by:

hasAccessToTopic in interface AccessController

Parameters:

clientCert - the X509Certificate submitted by client

resource - the resource being requested

method - the operation (Read, Write, ...) to perform against the topic resource

Returns:

true if client has permission to access, otherwise false.

Throws:

AclException

hasAccessToAdminOperation

public boolean hasAccessToAdminOperation(X509Certificate clientCert,
 String operation)
                                  throws AclException

Description copied from interface: AccessController

Check if client has permission to execute a particular admin operation.

Specified by:

hasAccessToAdminOperation in interface AccessController

Parameters:

clientCert - the X509Certificate submitted by client

operation - the operation being performed

Returns:

true if client has permission to access, otherwise false.

Throws:

AclException

isAllowlistUsers

public boolean isAllowlistUsers(X509Certificate clientCert,
 String resource,
 String method)

Description copied from interface: AccessController

Check whether the client is the allowlist admin users.

Specified by:

isAllowlistUsers in interface AccessController

Parameters:

clientCert - the X509Certificate submitted by client

resource - the resource being requested;

method - the operation (GET, POST, ...) to perform against the resource

Returns:

true if the client is admin

getPrincipalId

public String getPrincipalId(X509Certificate clientCert)

Description copied from interface: AccessController

Get principal Id from client certificate.

Specified by:

getPrincipalId in interface AccessController

Parameters:

clientCert - the X509Certificate submitted by client

Returns:

principal Id. (headless account name, service name, LDAP id or group id)

hasAcl

public boolean hasAcl(String resource)
               throws AclException

Description copied from interface: DynamicAccessController

Check if ACL exists for a particular resource.

Specified by:

hasAcl in interface DynamicAccessController

Parameters:

resource - the resource name

Returns:

whether an ACL exists for the resource

Throws:

AclException

addAcl

public void addAcl(String resource)
            throws AclException

Description copied from interface: DynamicAccessController

Add a resource to the resource list. Call this method when a new resource gets created.

Specified by:

addAcl in interface DynamicAccessController

Parameters:

resource - the resource name

Throws:

AclException

removeAcl

public void removeAcl(String resource)
               throws AclException

Description copied from interface: DynamicAccessController

Remove a resource from the resource list. Call this method when a existing resource gets deleted.

Specified by:

removeAcl in interface DynamicAccessController

Parameters:

resource - the resource name

Throws:

AclException

getAccessControlledResources

public Set<String> getAccessControlledResources()

Description copied from interface: DynamicAccessController

Get a list of currently being access-controlled resources. Ideally, this list should be identical the list of existing resources, so that each and every resource (e.g. Venice store) is being access-controlled.

Specified by:

getAccessControlledResources in interface DynamicAccessController

Returns:

the set of access-controlled resources

isFailOpen

public boolean isFailOpen()

Description copied from interface: DynamicAccessController

Use this method to determine if clients will be granted access to a resource when the corresponding ACL of the resource is missing.

Specified by:

isFailOpen in interface DynamicAccessController

Returns:

whether the implementation uses a fail-open policy