-
Notifications
You must be signed in to change notification settings - Fork 71
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* feat: Advanced authorization Signed-off-by: Anatolii Bazko <[email protected]> * Renames fields Signed-off-by: Anatolii Bazko <[email protected]> * Address remarks Signed-off-by: Anatolii Bazko <[email protected]> * Address remarks Signed-off-by: Anatolii Bazko <[email protected]> * Address remarks Signed-off-by: Anatolii Bazko <[email protected]> --------- Signed-off-by: Anatolii Bazko <[email protected]>
- Loading branch information
Showing
16 changed files
with
660 additions
and
40 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
20 changes: 20 additions & 0 deletions
20
...g/eclipse/che/workspace/infrastructure/kubernetes/authorization/AuthorizationChecker.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| /* | ||
| * Copyright (c) 2012-2023 Red Hat, Inc. | ||
| * This program and the accompanying materials are made | ||
| * available under the terms of the Eclipse Public License 2.0 | ||
| * which is available at https://www.eclipse.org/legal/epl-2.0/ | ||
| * | ||
| * SPDX-License-Identifier: EPL-2.0 | ||
| * | ||
| * Contributors: | ||
| * Red Hat, Inc. - initial API and implementation | ||
| */ | ||
| package org.eclipse.che.workspace.infrastructure.kubernetes.authorization; | ||
|
|
||
| import org.eclipse.che.api.workspace.server.spi.InfrastructureException; | ||
|
|
||
| /** This {@link AuthorizationChecker} checks if user is allowed to use Che. */ | ||
| public interface AuthorizationChecker { | ||
|
|
||
| boolean isAuthorized(String username) throws InfrastructureException; | ||
| } |
27 changes: 27 additions & 0 deletions
27
...eclipse/che/workspace/infrastructure/kubernetes/authorization/AuthorizationException.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| /* | ||
| * Copyright (c) 2012-2023 Red Hat, Inc. | ||
| * This program and the accompanying materials are made | ||
| * available under the terms of the Eclipse Public License 2.0 | ||
| * which is available at https://www.eclipse.org/legal/epl-2.0/ | ||
| * | ||
| * SPDX-License-Identifier: EPL-2.0 | ||
| * | ||
| * Contributors: | ||
| * Red Hat, Inc. - initial API and implementation | ||
| */ | ||
| package org.eclipse.che.workspace.infrastructure.kubernetes.authorization; | ||
|
|
||
| import org.eclipse.che.api.workspace.server.spi.InfrastructureException; | ||
| import org.eclipse.che.api.workspace.server.spi.RuntimeInfrastructure; | ||
|
|
||
| /** | ||
| * An exception thrown by {@link RuntimeInfrastructure} and related components. Indicates that a | ||
| * user is not authorized to use Che. | ||
| * | ||
| * @author Anatolii Bazko | ||
| */ | ||
| public class AuthorizationException extends InfrastructureException { | ||
| public AuthorizationException(String message) { | ||
| super(message); | ||
| } | ||
| } |
48 changes: 48 additions & 0 deletions
48
...workspace/infrastructure/kubernetes/authorization/KubernetesAuthorizationCheckerImpl.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| /* | ||
| * Copyright (c) 2012-2023 Red Hat, Inc. | ||
| * This program and the accompanying materials are made | ||
| * available under the terms of the Eclipse Public License 2.0 | ||
| * which is available at https://www.eclipse.org/legal/epl-2.0/ | ||
| * | ||
| * SPDX-License-Identifier: EPL-2.0 | ||
| * | ||
| * Contributors: | ||
| * Red Hat, Inc. - initial API and implementation | ||
| */ | ||
| package org.eclipse.che.workspace.infrastructure.kubernetes.authorization; | ||
|
|
||
| import static org.eclipse.che.commons.lang.StringUtils.strToSet; | ||
|
|
||
| import java.util.Set; | ||
| import javax.inject.Inject; | ||
| import javax.inject.Named; | ||
| import javax.inject.Singleton; | ||
| import org.eclipse.che.commons.annotation.Nullable; | ||
|
|
||
| /** This {@link KubernetesAuthorizationCheckerImpl} checks if user is allowed to use Che. */ | ||
| @Singleton | ||
| public class KubernetesAuthorizationCheckerImpl implements AuthorizationChecker { | ||
|
|
||
| private final Set<String> allowUsers; | ||
| private final Set<String> denyUsers; | ||
|
|
||
| @Inject | ||
| public KubernetesAuthorizationCheckerImpl( | ||
| @Nullable @Named("che.infra.kubernetes.advanced_authorization.allow_users") String allowUsers, | ||
| @Nullable @Named("che.infra.kubernetes.advanced_authorization.deny_users") String denyUsers) { | ||
| this.allowUsers = strToSet(allowUsers); | ||
| this.denyUsers = strToSet(denyUsers); | ||
| } | ||
|
|
||
| public boolean isAuthorized(String username) { | ||
| return isAllowedUser(username) && !isDeniedUser(username); | ||
| } | ||
|
|
||
| private boolean isAllowedUser(String username) { | ||
| return allowUsers.isEmpty() || allowUsers.contains(username); | ||
| } | ||
|
|
||
| private boolean isDeniedUser(String username) { | ||
| return !denyUsers.isEmpty() && denyUsers.contains(username); | ||
| } | ||
| } |
46 changes: 46 additions & 0 deletions
46
...org/eclipse/che/workspace/infrastructure/kubernetes/authorization/PermissionsCleaner.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| /* | ||
| * Copyright (c) 2012-2023 Red Hat, Inc. | ||
| * This program and the accompanying materials are made | ||
| * available under the terms of the Eclipse Public License 2.0 | ||
| * which is available at https://www.eclipse.org/legal/epl-2.0/ | ||
| * | ||
| * SPDX-License-Identifier: EPL-2.0 | ||
| * | ||
| * Contributors: | ||
| * Red Hat, Inc. - initial API and implementation | ||
| */ | ||
| package org.eclipse.che.workspace.infrastructure.kubernetes.authorization; | ||
|
|
||
| import static org.eclipse.che.commons.lang.StringUtils.strToSet; | ||
|
|
||
| import io.fabric8.kubernetes.client.KubernetesClient; | ||
| import java.util.Set; | ||
| import javax.inject.Inject; | ||
| import javax.inject.Named; | ||
| import javax.inject.Singleton; | ||
| import org.eclipse.che.api.workspace.server.spi.InfrastructureException; | ||
| import org.eclipse.che.commons.annotation.Nullable; | ||
| import org.eclipse.che.workspace.infrastructure.kubernetes.CheServerKubernetesClientFactory; | ||
|
|
||
| /** This {@link PermissionsCleaner} cleans up all user's permissions. */ | ||
| @Singleton | ||
| public class PermissionsCleaner { | ||
|
|
||
| private final Set<String> userClusterRoles; | ||
| private final CheServerKubernetesClientFactory cheServerKubernetesClientFactory; | ||
|
|
||
| @Inject | ||
| public PermissionsCleaner( | ||
| @Nullable @Named("che.infra.kubernetes.user_cluster_roles") String userClusterRoles, | ||
| CheServerKubernetesClientFactory cheServerKubernetesClientFactory) { | ||
| this.cheServerKubernetesClientFactory = cheServerKubernetesClientFactory; | ||
| this.userClusterRoles = strToSet(userClusterRoles); | ||
| } | ||
|
|
||
| public void cleanUp(String namespaceName) throws InfrastructureException { | ||
| KubernetesClient client = cheServerKubernetesClientFactory.create(); | ||
| for (String userClusterRole : userClusterRoles) { | ||
| client.rbac().roleBindings().inNamespace(namespaceName).withName(userClusterRole).delete(); | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
49 changes: 49 additions & 0 deletions
49
...workspace/infrastructure/kubernetes/authorization/KubernetesAuthorizationCheckerTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,49 @@ | ||
| /* | ||
| * Copyright (c) 2012-2023 Red Hat, Inc. | ||
| * This program and the accompanying materials are made | ||
| * available under the terms of the Eclipse Public License 2.0 | ||
| * which is available at https://www.eclipse.org/legal/epl-2.0/ | ||
| * | ||
| * SPDX-License-Identifier: EPL-2.0 | ||
| * | ||
| * Contributors: | ||
| * Red Hat, Inc. - initial API and implementation | ||
| */ | ||
| package org.eclipse.che.workspace.infrastructure.kubernetes.authorization; | ||
|
|
||
| import org.eclipse.che.api.workspace.server.spi.InfrastructureException; | ||
| import org.mockito.testng.MockitoTestNGListener; | ||
| import org.testng.Assert; | ||
| import org.testng.annotations.DataProvider; | ||
| import org.testng.annotations.Listeners; | ||
| import org.testng.annotations.Test; | ||
|
|
||
| @Listeners(MockitoTestNGListener.class) | ||
| public class KubernetesAuthorizationCheckerTest { | ||
| @Test(dataProvider = "advancedAuthorizationData") | ||
| public void advancedAuthorization( | ||
| String testUserName, String allowedUsers, String deniedUsers, boolean expectedIsAuthorized) | ||
| throws InfrastructureException { | ||
| // give | ||
| AuthorizationChecker authorizationChecker = | ||
| new KubernetesAuthorizationCheckerImpl(allowedUsers, deniedUsers); | ||
|
|
||
| // when | ||
| boolean isAuthorized = authorizationChecker.isAuthorized(testUserName); | ||
|
|
||
| // then | ||
| Assert.assertEquals(isAuthorized, expectedIsAuthorized); | ||
| } | ||
|
|
||
| @DataProvider | ||
| public static Object[][] advancedAuthorizationData() { | ||
| return new Object[][] { | ||
| {"user1", "", "", true}, | ||
| {"user1", "user1", "", true}, | ||
| {"user1", "user1", "user2", true}, | ||
| {"user1", "user1", "user1", false}, | ||
| {"user2", "user1", "", false}, | ||
| {"user2", "user1", "user2", false}, | ||
| }; | ||
| } | ||
| } |
Oops, something went wrong.