Package org.apache.pulsar.broker.authorization

Class PulsarAuthorizationProvider

java.lang.Object

org.apache.pulsar.broker.authorization.PulsarAuthorizationProvider

All Implemented Interfaces:

Closeable, AutoCloseable, AuthorizationProvider

Direct Known Subclasses:

MultiRolesTokenAuthorizationProvider

public class PulsarAuthorizationProvider
extends Object
implements AuthorizationProvider

Default authorization provider that stores authorization policies under local-zookeeper.

Field Summary

Fields

Modifier and Type	Field	Description
ServiceConfiguration	conf
protected PulsarResources	pulsarResources

Constructor Summary

Constructors

Constructor	Description
PulsarAuthorizationProvider()
PulsarAuthorizationProvider(ServiceConfiguration conf, PulsarResources resources)

Method Summary

Modifier and Type	Method	Description
CompletableFuture<Boolean>	allowBrokerOperationAsync(String clusterName, String brokerId, org.apache.pulsar.common.policies.data.BrokerOperation brokerOperation, String role, AuthenticationDataSource authData)
CompletableFuture<Boolean>	allowClusterOperationAsync(String clusterName, org.apache.pulsar.common.policies.data.ClusterOperation clusterOperation, String role, AuthenticationDataSource authData)
CompletableFuture<Boolean>	allowClusterPolicyOperationAsync(String clusterName, String role, org.apache.pulsar.common.policies.data.PolicyName policy, org.apache.pulsar.common.policies.data.PolicyOperation operation, AuthenticationDataSource authData)
CompletableFuture<Boolean>	allowFunctionOpsAsync(org.apache.pulsar.common.naming.NamespaceName namespaceName, String role, AuthenticationDataSource authenticationData)	Allow all function operations with in this namespace.
CompletableFuture<Boolean>	allowNamespaceOperationAsync(org.apache.pulsar.common.naming.NamespaceName namespaceName, String role, org.apache.pulsar.common.policies.data.NamespaceOperation operation, AuthenticationDataSource authData)	Check if a given role is allowed to execute a given operation on the namespace.
CompletableFuture<Boolean>	allowNamespacePolicyOperationAsync(org.apache.pulsar.common.naming.NamespaceName namespaceName, org.apache.pulsar.common.policies.data.PolicyName policy, org.apache.pulsar.common.policies.data.PolicyOperation operation, String role, AuthenticationDataSource authData)	Check if a given role is allowed to execute a given policy operation on the namespace.
CompletableFuture<Boolean>	allowSinkOpsAsync(org.apache.pulsar.common.naming.NamespaceName namespaceName, String role, AuthenticationDataSource authenticationData)	Allow all sink operations with in this namespace.
CompletableFuture<Boolean>	allowSourceOpsAsync(org.apache.pulsar.common.naming.NamespaceName namespaceName, String role, AuthenticationDataSource authenticationData)	Allow all source operations with in this namespace.
CompletableFuture<Boolean>	allowTenantOperationAsync(String tenantName, String role, org.apache.pulsar.common.policies.data.TenantOperation operation, AuthenticationDataSource authData)	Check if a given role is allowed to execute a given operation on the tenant.
CompletableFuture<Boolean>	allowTopicOperationAsync(org.apache.pulsar.common.naming.TopicName topicName, String role, org.apache.pulsar.common.policies.data.TopicOperation operation, AuthenticationDataSource authData)	Check if a given role is allowed to execute a given topic operation on the topic.
CompletableFuture<Boolean>	allowTopicPolicyOperationAsync(org.apache.pulsar.common.naming.TopicName topicName, String role, org.apache.pulsar.common.policies.data.PolicyName policyName, org.apache.pulsar.common.policies.data.PolicyOperation policyOperation, AuthenticationDataSource authData)	Check if a given role is allowed to execute a given topic operation on topic's policy.
CompletableFuture<Boolean>	canConsumeAsync(org.apache.pulsar.common.naming.TopicName topicName, String role, AuthenticationDataSource authenticationData, String subscription)	Check if the specified role has permission to receive messages from the specified fully qualified topic name.
CompletableFuture<Boolean>	canLookupAsync(org.apache.pulsar.common.naming.TopicName topicName, String role, AuthenticationDataSource authenticationData)	Check whether the specified role can perform a lookup for the specified topic.
CompletableFuture<Boolean>	canProduceAsync(org.apache.pulsar.common.naming.TopicName topicName, String role, AuthenticationDataSource authenticationData)	Check if the specified role has permission to send messages to the specified fully qualified topic name.
CompletableFuture<Boolean>	checkPermission(org.apache.pulsar.common.naming.TopicName topicName, String role, org.apache.pulsar.common.policies.data.AuthAction action)
void	close()
CompletableFuture<Map<String,Set<org.apache.pulsar.common.policies.data.AuthAction>>>	getPermissionsAsync(org.apache.pulsar.common.naming.NamespaceName namespaceName)	Get authorization-action permissions on a namespace.
CompletableFuture<Map<String,Set<org.apache.pulsar.common.policies.data.AuthAction>>>	getPermissionsAsync(org.apache.pulsar.common.naming.TopicName topicName)	Get authorization-action permissions on a topic.
CompletableFuture<Map<String,Set<String>>>	getSubscriptionPermissionsAsync(org.apache.pulsar.common.naming.NamespaceName namespaceName)	Get authorization-action permissions on a topic.
CompletableFuture<Void>	grantPermissionAsync(List<org.apache.pulsar.client.admin.GrantTopicPermissionOptions> options)
CompletableFuture<Void>	grantPermissionAsync(org.apache.pulsar.common.naming.NamespaceName namespaceName, Set<org.apache.pulsar.common.policies.data.AuthAction> actions, String role, String authDataJson)	Grant authorization-action permission on a namespace to the given client.
CompletableFuture<Void>	grantPermissionAsync(org.apache.pulsar.common.naming.TopicName topicName, Set<org.apache.pulsar.common.policies.data.AuthAction> actions, String role, String authDataJson)	Grant authorization-action permission on a topic to the given client.
CompletableFuture<Void>	grantSubscriptionPermissionAsync(org.apache.pulsar.common.naming.NamespaceName namespace, String subscriptionName, Set<String> roles, String authDataJson)	Grant permission to roles that can access subscription-admin api.
void	initialize(ServiceConfiguration conf, PulsarResources pulsarResources)	Perform initialization for the authorization provider.
CompletableFuture<Void>	removePermissionsAsync(org.apache.pulsar.common.naming.TopicName topicName)	Remove authorization-action permissions on a topic.
CompletableFuture<Void>	revokePermissionAsync(List<org.apache.pulsar.client.admin.RevokeTopicPermissionOptions> options)
CompletableFuture<Void>	revokePermissionAsync(org.apache.pulsar.common.naming.NamespaceName namespaceName, String role)	Revoke authorization-action permission on a namespace to the given client.
CompletableFuture<Void>	revokePermissionAsync(org.apache.pulsar.common.naming.TopicName topicName, String role)	Revoke authorization-action permission on a topic to the given client.
CompletableFuture<Void>	revokeSubscriptionPermissionAsync(org.apache.pulsar.common.naming.NamespaceName namespace, String subscriptionName, String role, String authDataJson)	Revoke subscription admin-api access for a role.
CompletableFuture<Boolean>	validateTenantAdminAccess(String tenantName, String role, AuthenticationDataSource authData)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.apache.pulsar.broker.authorization.AuthorizationProvider

isSuperUser, isTenantAdmin

Field Details

conf

public ServiceConfiguration conf

pulsarResources

protected PulsarResources pulsarResources

Constructor Details

PulsarAuthorizationProvider

public PulsarAuthorizationProvider()

PulsarAuthorizationProvider

public PulsarAuthorizationProvider(ServiceConfiguration conf,
 PulsarResources resources)
                            throws IOException

Throws:

IOException

Method Details

initialize

public void initialize(ServiceConfiguration conf,
 PulsarResources pulsarResources)
                throws IOException

Description copied from interface: AuthorizationProvider

Perform initialization for the authorization provider.

Specified by:

initialize in interface AuthorizationProvider

Parameters:

conf - broker config object

pulsarResources - Resources component for access to metadata

Throws:

IOException - if the initialization fails

canProduceAsync

public CompletableFuture<Boolean> canProduceAsync(org.apache.pulsar.common.naming.TopicName topicName,
 String role,
 AuthenticationDataSource authenticationData)

Check if the specified role has permission to send messages to the specified fully qualified topic name.

Specified by:

canProduceAsync in interface AuthorizationProvider

Parameters:

topicName - the fully qualified topic name associated with the topic.

role - the app id used to send messages to the topic.

canConsumeAsync

public CompletableFuture<Boolean> canConsumeAsync(org.apache.pulsar.common.naming.TopicName topicName,
 String role,
 AuthenticationDataSource authenticationData,
 String subscription)

Check if the specified role has permission to receive messages from the specified fully qualified topic name.

Specified by:

canConsumeAsync in interface AuthorizationProvider

Parameters:

topicName - the fully qualified topic name associated with the topic.

role - the app id used to receive messages from the topic.

subscription - the subscription name defined by the client

canLookupAsync

public CompletableFuture<Boolean> canLookupAsync(org.apache.pulsar.common.naming.TopicName topicName,
 String role,
 AuthenticationDataSource authenticationData)

Check whether the specified role can perform a lookup for the specified topic. For that the caller needs to have producer or consumer permission.

Specified by:

canLookupAsync in interface AuthorizationProvider

Parameters:

topicName -

role -

Returns:

Throws:

Exception

allowFunctionOpsAsync

public CompletableFuture<Boolean> allowFunctionOpsAsync(org.apache.pulsar.common.naming.NamespaceName namespaceName,
 String role,
 AuthenticationDataSource authenticationData)

Description copied from interface: AuthorizationProvider

Allow all function operations with in this namespace.

Specified by:

allowFunctionOpsAsync in interface AuthorizationProvider

Parameters:

namespaceName - The namespace that the function operations can be executed in

role - The role to check

authenticationData - authentication data related to the role

Returns:

a boolean to determine whether authorized or not

allowSourceOpsAsync

public CompletableFuture<Boolean> allowSourceOpsAsync(org.apache.pulsar.common.naming.NamespaceName namespaceName,
 String role,
 AuthenticationDataSource authenticationData)

Description copied from interface: AuthorizationProvider

Allow all source operations with in this namespace.

Specified by:

allowSourceOpsAsync in interface AuthorizationProvider

Parameters:

namespaceName - The namespace that the sources operations can be executed in

role - The role to check

authenticationData - authentication data related to the role

Returns:

a boolean to determine whether authorized or not

allowSinkOpsAsync

public CompletableFuture<Boolean> allowSinkOpsAsync(org.apache.pulsar.common.naming.NamespaceName namespaceName,
 String role,
 AuthenticationDataSource authenticationData)

Description copied from interface: AuthorizationProvider

Allow all sink operations with in this namespace.

Specified by:

allowSinkOpsAsync in interface AuthorizationProvider

Parameters:

namespaceName - The namespace that the sink operations can be executed in

role - The role to check

authenticationData - authentication data related to the role

Returns:

a boolean to determine whether authorized or not

grantPermissionAsync

public CompletableFuture<Void> grantPermissionAsync(org.apache.pulsar.common.naming.TopicName topicName,
 Set<org.apache.pulsar.common.policies.data.AuthAction> actions,
 String role,
 String authDataJson)

Description copied from interface: AuthorizationProvider

Grant authorization-action permission on a topic to the given client. NOTE: used to complete with IllegalArgumentException when namespace not found or with IllegalStateException when failed to grant permission. This behavior is now deprecated. Please use the appropriate MetadataStoreException.

Specified by:

grantPermissionAsync in interface AuthorizationProvider

authDataJson - additional authdata in json format

Returns:

CompletableFuture

grantPermissionAsync

public CompletableFuture<Void> grantPermissionAsync(List<org.apache.pulsar.client.admin.GrantTopicPermissionOptions> options)

Specified by:

grantPermissionAsync in interface AuthorizationProvider

revokePermissionAsync

public CompletableFuture<Void> revokePermissionAsync(List<org.apache.pulsar.client.admin.RevokeTopicPermissionOptions> options)

Specified by:

revokePermissionAsync in interface AuthorizationProvider

revokePermissionAsync

public CompletableFuture<Void> revokePermissionAsync(org.apache.pulsar.common.naming.TopicName topicName,
 String role)

Description copied from interface: AuthorizationProvider

Revoke authorization-action permission on a topic to the given client.

Specified by:

revokePermissionAsync in interface AuthorizationProvider

Returns:

CompletableFuture

grantPermissionAsync

public CompletableFuture<Void> grantPermissionAsync(org.apache.pulsar.common.naming.NamespaceName namespaceName,
 Set<org.apache.pulsar.common.policies.data.AuthAction> actions,
 String role,
 String authDataJson)

Description copied from interface: AuthorizationProvider

Grant authorization-action permission on a namespace to the given client. NOTE: used to complete with IllegalArgumentException when namespace not found or with IllegalStateException when failed to grant permission. This behavior is now deprecated. Please use the appropriate MetadataStoreException.

Specified by:

grantPermissionAsync in interface AuthorizationProvider

authDataJson - additional authdata in json format

Returns:

CompletableFuture

revokePermissionAsync

public CompletableFuture<Void> revokePermissionAsync(org.apache.pulsar.common.naming.NamespaceName namespaceName,
 String role)

Description copied from interface: AuthorizationProvider

Revoke authorization-action permission on a namespace to the given client.

Specified by:

revokePermissionAsync in interface AuthorizationProvider

Returns:

CompletableFuture

grantSubscriptionPermissionAsync

public CompletableFuture<Void> grantSubscriptionPermissionAsync(org.apache.pulsar.common.naming.NamespaceName namespace,
 String subscriptionName,
 Set<String> roles,
 String authDataJson)

Description copied from interface: AuthorizationProvider

Grant permission to roles that can access subscription-admin api.

Specified by:

grantSubscriptionPermissionAsync in interface AuthorizationProvider

authDataJson - additional authdata in json format

Returns:

CompletableFuture

revokeSubscriptionPermissionAsync

public CompletableFuture<Void> revokeSubscriptionPermissionAsync(org.apache.pulsar.common.naming.NamespaceName namespace,
 String subscriptionName,
 String role,
 String authDataJson)

Description copied from interface: AuthorizationProvider

Revoke subscription admin-api access for a role.

Specified by:

revokeSubscriptionPermissionAsync in interface AuthorizationProvider

Returns:

CompletableFuture

checkPermission

public CompletableFuture<Boolean> checkPermission(org.apache.pulsar.common.naming.TopicName topicName,
 String role,
 org.apache.pulsar.common.policies.data.AuthAction action)

close

public void close()
           throws IOException

Specified by:

close in interface AutoCloseable

Specified by:

close in interface Closeable

Throws:

IOException

allowTenantOperationAsync

public CompletableFuture<Boolean> allowTenantOperationAsync(String tenantName,
 String role,
 org.apache.pulsar.common.policies.data.TenantOperation operation,
 AuthenticationDataSource authData)

Description copied from interface: AuthorizationProvider

Check if a given role is allowed to execute a given operation on the tenant.

Specified by:

allowTenantOperationAsync in interface AuthorizationProvider

Parameters:

tenantName - tenant name

role - role name

operation - tenant operation

authData - authenticated data of the role

Returns:

a completable future represents check result

allowNamespaceOperationAsync

public CompletableFuture<Boolean> allowNamespaceOperationAsync(org.apache.pulsar.common.naming.NamespaceName namespaceName,
 String role,
 org.apache.pulsar.common.policies.data.NamespaceOperation operation,
 AuthenticationDataSource authData)

Description copied from interface: AuthorizationProvider

Check if a given role is allowed to execute a given operation on the namespace.

Specified by:

allowNamespaceOperationAsync in interface AuthorizationProvider

Parameters:

namespaceName - namespace name

role - role name

operation - namespace operation

authData - authenticated data

Returns:

a completable future represents check result

allowNamespacePolicyOperationAsync

public CompletableFuture<Boolean> allowNamespacePolicyOperationAsync(org.apache.pulsar.common.naming.NamespaceName namespaceName,
 org.apache.pulsar.common.policies.data.PolicyName policy,
 org.apache.pulsar.common.policies.data.PolicyOperation operation,
 String role,
 AuthenticationDataSource authData)

Description copied from interface: AuthorizationProvider

Check if a given role is allowed to execute a given policy operation on the namespace.

Specified by:

allowNamespacePolicyOperationAsync in interface AuthorizationProvider

Parameters:

namespaceName - namespace name

policy - policy name

operation - policy operation

role - role name

authData - authenticated data

Returns:

a completable future represents check result

allowTopicOperationAsync

public CompletableFuture<Boolean> allowTopicOperationAsync(org.apache.pulsar.common.naming.TopicName topicName,
 String role,
 org.apache.pulsar.common.policies.data.TopicOperation operation,
 AuthenticationDataSource authData)

Description copied from interface: AuthorizationProvider

Check if a given role is allowed to execute a given topic operation on the topic.

Specified by:

allowTopicOperationAsync in interface AuthorizationProvider

Parameters:

topicName - topic name

role - role name

operation - topic operation

authData - authenticated data

Returns:

CompletableFuture

allowBrokerOperationAsync

public CompletableFuture<Boolean> allowBrokerOperationAsync(String clusterName,
 String brokerId,
 org.apache.pulsar.common.policies.data.BrokerOperation brokerOperation,
 String role,
 AuthenticationDataSource authData)

Specified by:

allowBrokerOperationAsync in interface AuthorizationProvider

allowTopicPolicyOperationAsync

public CompletableFuture<Boolean> allowTopicPolicyOperationAsync(org.apache.pulsar.common.naming.TopicName topicName,
 String role,
 org.apache.pulsar.common.policies.data.PolicyName policyName,
 org.apache.pulsar.common.policies.data.PolicyOperation policyOperation,
 AuthenticationDataSource authData)

Description copied from interface: AuthorizationProvider

Check if a given role is allowed to execute a given topic operation on topic's policy.

Specified by:

allowTopicPolicyOperationAsync in interface AuthorizationProvider

Parameters:

topicName - topic name

role - role name

policyOperation - topic operation

authData - authenticated data

Returns:

CompletableFuture

validateTenantAdminAccess

public CompletableFuture<Boolean> validateTenantAdminAccess(String tenantName,
 String role,
 AuthenticationDataSource authData)

removePermissionsAsync

public CompletableFuture<Void> removePermissionsAsync(org.apache.pulsar.common.naming.TopicName topicName)

Description copied from interface: AuthorizationProvider

Remove authorization-action permissions on a topic.

Specified by:

removePermissionsAsync in interface AuthorizationProvider

Returns:

CompletableFuture

getPermissionsAsync

public CompletableFuture<Map<String,Set<org.apache.pulsar.common.policies.data.AuthAction>>> getPermissionsAsync(org.apache.pulsar.common.naming.TopicName topicName)

Description copied from interface: AuthorizationProvider

Get authorization-action permissions on a topic.

Specified by:

getPermissionsAsync in interface AuthorizationProvider

Returns:

CompletableFuture<Map<String, Set>>

getSubscriptionPermissionsAsync

public CompletableFuture<Map<String,Set<String>>> getSubscriptionPermissionsAsync(org.apache.pulsar.common.naming.NamespaceName namespaceName)

Description copied from interface: AuthorizationProvider

Get authorization-action permissions on a topic.

Specified by:

getSubscriptionPermissionsAsync in interface AuthorizationProvider

Returns:

CompletableFuture<Map<String, Set>>

getPermissionsAsync

public CompletableFuture<Map<String,Set<org.apache.pulsar.common.policies.data.AuthAction>>> getPermissionsAsync(org.apache.pulsar.common.naming.NamespaceName namespaceName)

Description copied from interface: AuthorizationProvider

Get authorization-action permissions on a namespace.

Specified by:

getPermissionsAsync in interface AuthorizationProvider

Returns:

CompletableFuture<Map<String, Set>>

allowClusterOperationAsync

public CompletableFuture<Boolean> allowClusterOperationAsync(String clusterName,
 org.apache.pulsar.common.policies.data.ClusterOperation clusterOperation,
 String role,
 AuthenticationDataSource authData)

Specified by:

allowClusterOperationAsync in interface AuthorizationProvider

allowClusterPolicyOperationAsync

public CompletableFuture<Boolean> allowClusterPolicyOperationAsync(String clusterName,
 String role,
 org.apache.pulsar.common.policies.data.PolicyName policy,
 org.apache.pulsar.common.policies.data.PolicyOperation operation,
 AuthenticationDataSource authData)

Specified by:

allowClusterPolicyOperationAsync in interface AuthorizationProvider