This is an automated email from the ASF dual-hosted git repository.
healchow pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/incubator-inlong.git
The following commit(s) were added to refs/heads/master by this push:
new 4a335b9 [INLONG-2854][Manager] Support another plugin of
authentication (#3004)
4a335b9 is described below
commit 4a335b9aec7276a044d46af31d7fe590159ef333
Author: wardli <[email protected]>
AuthorDate: Thu Mar 10 12:51:03 2022 +0800
[INLONG-2854][Manager] Support another plugin of authentication (#3004)
---
inlong-manager/manager-common/pom.xml | 4 ++
.../inlong/manager/common/auth/InlongShiro.java | 38 +++++++++++++
.../inlong/manager/web/auth/ShiroConfig.java | 47 ++++------------
.../InlongShiroImpl.java} | 65 ++++++++--------------
.../src/main/resources/application.properties | 7 +--
5 files changed, 78 insertions(+), 83 deletions(-)
diff --git a/inlong-manager/manager-common/pom.xml
b/inlong-manager/manager-common/pom.xml
index 3742fe3..8beba78 100644
--- a/inlong-manager/manager-common/pom.xml
+++ b/inlong-manager/manager-common/pom.xml
@@ -169,6 +169,10 @@
</exclusion>
</exclusions>
</dependency>
+ <dependency>
+ <groupId>org.apache.shiro</groupId>
+ <artifactId>shiro-spring</artifactId>
+ </dependency>
</dependencies>
</project>
diff --git
a/inlong-manager/manager-common/src/main/java/org/apache/inlong/manager/common/auth/InlongShiro.java
b/inlong-manager/manager-common/src/main/java/org/apache/inlong/manager/common/auth/InlongShiro.java
new file mode 100644
index 0000000..bd71dd9
--- /dev/null
+++
b/inlong-manager/manager-common/src/main/java/org/apache/inlong/manager/common/auth/InlongShiro.java
@@ -0,0 +1,38 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.inlong.manager.common.auth;
+
+import org.apache.shiro.authc.credential.CredentialsMatcher;
+import org.apache.shiro.mgt.SecurityManager;
+import org.apache.shiro.realm.AuthorizingRealm;
+import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
+import org.apache.shiro.web.mgt.WebSecurityManager;
+import org.apache.shiro.web.session.mgt.WebSessionManager;
+
+public interface InlongShiro {
+
+ WebSecurityManager getWebSecurityManager();
+
+ AuthorizingRealm getShiroRealm();
+
+ WebSessionManager getWebSessionManager();
+
+ CredentialsMatcher getCredentialsMatcher();
+
+ ShiroFilterFactoryBean getShiroFilter(SecurityManager securityManager);
+}
diff --git
a/inlong-manager/manager-web/src/main/java/org/apache/inlong/manager/web/auth/ShiroConfig.java
b/inlong-manager/manager-web/src/main/java/org/apache/inlong/manager/web/auth/ShiroConfig.java
index 4a877d6..aabb6a9 100644
---
a/inlong-manager/manager-web/src/main/java/org/apache/inlong/manager/web/auth/ShiroConfig.java
+++
b/inlong-manager/manager-web/src/main/java/org/apache/inlong/manager/web/auth/ShiroConfig.java
@@ -17,10 +17,8 @@
package org.apache.inlong.manager.web.auth;
-import java.util.LinkedHashMap;
-import java.util.Map;
-import javax.servlet.Filter;
-import org.apache.inlong.manager.service.core.UserService;
+import javax.annotation.Resource;
+import org.apache.inlong.manager.common.auth.InlongShiro;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.realm.AuthorizingRealm;
@@ -29,7 +27,6 @@ import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.web.mgt.WebSecurityManager;
import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
-import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
@@ -37,12 +34,12 @@ import org.springframework.context.annotation.Configuration;
@Configuration
public class ShiroConfig {
- @Autowired
- private UserService userService;
+ @Resource
+ private InlongShiro inLongShiro;
@Bean
public AuthorizingRealm shiroRealm(HashedCredentialsMatcher matcher) {
- AuthorizingRealm authorizingRealm = new
WebAuthorizingRealm(userService);
+ AuthorizingRealm authorizingRealm = inLongShiro.getShiroRealm();
authorizingRealm.setCredentialsMatcher(matcher);
return authorizingRealm;
}
@@ -50,23 +47,22 @@ public class ShiroConfig {
@Bean
public WebSecurityManager
securityManager(@Qualifier("hashedCredentialsMatcher")
HashedCredentialsMatcher matcher) {
- DefaultWebSecurityManager securityManager = new
DefaultWebSecurityManager();
+ DefaultWebSecurityManager securityManager =
(DefaultWebSecurityManager) inLongShiro.getWebSecurityManager();
securityManager.setRealm(shiroRealm(matcher));
return securityManager;
}
@Bean
public DefaultWebSessionManager sessionManager() {
- DefaultWebSessionManager sessionManager = new
DefaultWebSessionManager();
+ DefaultWebSessionManager sessionManager = (DefaultWebSessionManager)
inLongShiro.getWebSessionManager();
sessionManager.setGlobalSessionTimeout(1000 * 60 * 60);
return sessionManager;
}
@Bean(name = "hashedCredentialsMatcher")
public HashedCredentialsMatcher hashedCredentialsMatcher() {
- HashedCredentialsMatcher hashedCredentialsMatcher = new
HashedCredentialsMatcher();
- hashedCredentialsMatcher.setHashAlgorithmName("MD5");
- hashedCredentialsMatcher.setHashIterations(1024);
+ HashedCredentialsMatcher hashedCredentialsMatcher =
(HashedCredentialsMatcher) inLongShiro
+ .getCredentialsMatcher();
return hashedCredentialsMatcher;
}
@@ -75,30 +71,7 @@ public class ShiroConfig {
*/
@Bean
public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager)
{
- ShiroFilterFactoryBean shiroFilterFactoryBean = new
ShiroFilterFactoryBean();
- shiroFilterFactoryBean.setSecurityManager(securityManager);
-
- // anon: can be accessed by anyone, authc: only authentication is
successful can be accessed
- Map<String, Filter> filters = new LinkedHashMap<>();
- filters.put("authc", new AuthenticationFilter());
- shiroFilterFactoryBean.setFilters(filters);
- Map<String, String> pathDefinitions = new LinkedHashMap<>();
- // login, register request
- pathDefinitions.put("/anno/**/*", "anon");
-
- // swagger api
- pathDefinitions.put("/doc.html", "anon");
- pathDefinitions.put("/v2/api-docs/**/**", "anon");
- pathDefinitions.put("/webjars/**/*", "anon");
- pathDefinitions.put("/swagger-resources/**/*", "anon");
- pathDefinitions.put("/swagger-resources", "anon");
-
- // openapi
- pathDefinitions.put("/openapi/**/*", "anon");
-
- pathDefinitions.put("/**", "authc");
-
- shiroFilterFactoryBean.setFilterChainDefinitionMap(pathDefinitions);
+ ShiroFilterFactoryBean shiroFilterFactoryBean =
inLongShiro.getShiroFilter(securityManager);
return shiroFilterFactoryBean;
}
diff --git
a/inlong-manager/manager-web/src/main/java/org/apache/inlong/manager/web/auth/ShiroConfig.java
b/inlong-manager/manager-web/src/main/java/org/apache/inlong/manager/web/auth/impl/InlongShiroImpl.java
similarity index 61%
copy from
inlong-manager/manager-web/src/main/java/org/apache/inlong/manager/web/auth/ShiroConfig.java
copy to
inlong-manager/manager-web/src/main/java/org/apache/inlong/manager/web/auth/impl/InlongShiroImpl.java
index 4a877d6..48c7d0c 100644
---
a/inlong-manager/manager-web/src/main/java/org/apache/inlong/manager/web/auth/ShiroConfig.java
+++
b/inlong-manager/manager-web/src/main/java/org/apache/inlong/manager/web/auth/impl/InlongShiroImpl.java
@@ -15,69 +15,62 @@
* limitations under the License.
*/
-package org.apache.inlong.manager.web.auth;
+package org.apache.inlong.manager.web.auth.impl;
import java.util.LinkedHashMap;
import java.util.Map;
import javax.servlet.Filter;
+import org.apache.inlong.manager.common.auth.InlongShiro;
import org.apache.inlong.manager.service.core.UserService;
+import org.apache.inlong.manager.web.auth.AuthenticationFilter;
+import org.apache.inlong.manager.web.auth.WebAuthorizingRealm;
+import org.apache.shiro.authc.credential.CredentialsMatcher;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.realm.AuthorizingRealm;
-import
org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.web.mgt.WebSecurityManager;
import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
+import org.apache.shiro.web.session.mgt.WebSessionManager;
import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.annotation.Qualifier;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.stereotype.Component;
-@Configuration
-public class ShiroConfig {
+@ConditionalOnProperty(name = "type", prefix = "inlong.auth", havingValue =
"default")
+@Component
+public class InlongShiroImpl implements InlongShiro {
@Autowired
private UserService userService;
- @Bean
- public AuthorizingRealm shiroRealm(HashedCredentialsMatcher matcher) {
- AuthorizingRealm authorizingRealm = new
WebAuthorizingRealm(userService);
- authorizingRealm.setCredentialsMatcher(matcher);
- return authorizingRealm;
+ @Override
+ public WebSecurityManager getWebSecurityManager() {
+ return new DefaultWebSecurityManager();
}
- @Bean
- public WebSecurityManager
securityManager(@Qualifier("hashedCredentialsMatcher")
- HashedCredentialsMatcher matcher) {
- DefaultWebSecurityManager securityManager = new
DefaultWebSecurityManager();
- securityManager.setRealm(shiroRealm(matcher));
- return securityManager;
+ @Override
+ public AuthorizingRealm getShiroRealm() {
+ return new WebAuthorizingRealm(userService);
}
- @Bean
- public DefaultWebSessionManager sessionManager() {
- DefaultWebSessionManager sessionManager = new
DefaultWebSessionManager();
- sessionManager.setGlobalSessionTimeout(1000 * 60 * 60);
- return sessionManager;
+ @Override
+ public WebSessionManager getWebSessionManager() {
+ return new DefaultWebSessionManager();
}
- @Bean(name = "hashedCredentialsMatcher")
- public HashedCredentialsMatcher hashedCredentialsMatcher() {
+ @Override
+ public CredentialsMatcher getCredentialsMatcher() {
HashedCredentialsMatcher hashedCredentialsMatcher = new
HashedCredentialsMatcher();
hashedCredentialsMatcher.setHashAlgorithmName("MD5");
hashedCredentialsMatcher.setHashIterations(1024);
return hashedCredentialsMatcher;
}
- /**
- * Filter for annon / authc
- */
- @Bean
- public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager)
{
+ @Override
+ public ShiroFilterFactoryBean getShiroFilter(SecurityManager
securityManager) {
ShiroFilterFactoryBean shiroFilterFactoryBean = new
ShiroFilterFactoryBean();
shiroFilterFactoryBean.setSecurityManager(securityManager);
-
// anon: can be accessed by anyone, authc: only authentication is
successful can be accessed
Map<String, Filter> filters = new LinkedHashMap<>();
filters.put("authc", new AuthenticationFilter());
@@ -101,14 +94,4 @@ public class ShiroConfig {
shiroFilterFactoryBean.setFilterChainDefinitionMap(pathDefinitions);
return shiroFilterFactoryBean;
}
-
- /**
- * Enable permission verification annotation
- */
- @Bean
- public AuthorizationAttributeSourceAdvisor
authorizationAttributeSourceAdvisor() {
- AuthorizationAttributeSourceAdvisor advisor = new
AuthorizationAttributeSourceAdvisor();
-
advisor.setSecurityManager(securityManager(hashedCredentialsMatcher()));
- return advisor;
- }
}
diff --git
a/inlong-manager/manager-web/src/main/resources/application.properties
b/inlong-manager/manager-web/src/main/resources/application.properties
index f9d0eaa..b46b012 100644
--- a/inlong-manager/manager-web/src/main/resources/application.properties
+++ b/inlong-manager/manager-web/src/main/resources/application.properties
@@ -16,31 +16,26 @@
# specific language governing permissions and limitations
# under the License.
#
-
server.port=8083
server.servlet.context-path=/api/inlong/manager
logging.level.root=INFO
logging.file.path=log
spring.application.name=InLong-Manager-Web
spring.profiles.active=dev
-
# Serialize the Date type to a timestamp
spring.jackson.serialization.write-dates-as-timestamps=true
spring.jackson.date-format=yyyy-MM-dd HH:mm:ss
spring.jackson.time-zone=GMT+8
-
# Configure mybatis
mybatis.mapper-locations=classpath:mappers/*.xml
# Global mapping, no need to write the full path of the entity class in the
xml file
mybatis.type-aliases-package=org.apache.inlong.manager.dao.entity
# Turn on camel case mapping
mybatis.configuration.map-underscore-to-camel-case=true
-
# Configure mybatis paging plugin
pagehelper.helperDialect=mysql
pagehelper.reasonable=true
pagehelper.params=count=countSql
-
# Configure http client
common.http-client.maxTotal=5000
common.http-client.defaultMaxPerRoute=2000
@@ -48,3 +43,5 @@ common.http-client.validateAfterInactivity=5000
common.http-client.connectionTimeout=3000
common.http-client.readTimeout=10000
common.http-client.connectionRequestTimeout=3000
+# Configure auth plugin
+inlong.auth.type=default
