This is an automated email from the ASF dual-hosted git repository.
riemer pushed a commit to branch dev
in repository https://gitbox.apache.org/repos/asf/incubator-streampipes.git
The following commit(s) were added to refs/heads/dev by this push:
new 0a86bdf [STREAMPIPES-480] Update Spring versions and migrate Spring
config
0a86bdf is described below
commit 0a86bdfc7222e56523f74f8f0d81c9ee9b9cbbab
Author: Dominik Riemer <[email protected]>
AuthorDate: Sun Dec 5 11:13:17 2021 +0100
[STREAMPIPES-480] Update Spring versions and migrate Spring config
---
pom.xml | 6 ++--
.../backend/StreamPipesBackendApplication.java | 1 +
.../backend/StreamPipesPasswordEncoder.java | 33 ++++++++++++++++++++++
.../streampipes/backend/WebSecurityConfig.java | 11 +++-----
.../manager/execution/http/HttpRequestBuilder.java | 2 +-
.../base/impl/AbstractAuthGuardedRestResource.java | 28 ++++++++++++++++++
.../impl/dashboard/AbstractDashboardResource.java | 16 +++++------
.../streampipes/rest/impl/dashboard/Dashboard.java | 13 +++++----
.../impl/datalake/DataLakeDashboardResource.java | 12 ++++----
9 files changed, 91 insertions(+), 31 deletions(-)
diff --git a/pom.xml b/pom.xml
index ad0f2c8..7ed9727 100644
--- a/pom.xml
+++ b/pom.xml
@@ -102,9 +102,9 @@
<snakeyaml.version>1.26</snakeyaml.version>
<snappy-java.version>1.1.7.7</snappy-java.version>
<spark.version>2.1.2</spark.version>
- <spring.version>5.3.10</spring.version>
- <spring-boot.version>2.5.5</spring-boot.version>
- <spring-security.version>5.5.2</spring-security.version>
+ <spring.version>5.3.13</spring.version>
+ <spring-boot.version>2.6.1</spring-boot.version>
+ <spring-security.version>5.6.0</spring-security.version>
<swagger.version>2.1.6</swagger.version>
<type-parser.version>0.6.0</type-parser.version>
<underscore.version>1.47</underscore.version>
diff --git
a/streampipes-backend/src/main/java/org/apache/streampipes/backend/StreamPipesBackendApplication.java
b/streampipes-backend/src/main/java/org/apache/streampipes/backend/StreamPipesBackendApplication.java
index af97e1d..c78b8a6 100644
---
a/streampipes-backend/src/main/java/org/apache/streampipes/backend/StreamPipesBackendApplication.java
+++
b/streampipes-backend/src/main/java/org/apache/streampipes/backend/StreamPipesBackendApplication.java
@@ -58,6 +58,7 @@ import java.util.stream.Collectors;
@EnableAutoConfiguration
@Import({StreamPipesResourceConfig.class,
WelcomePageController.class,
+ StreamPipesPasswordEncoder.class,
WebSecurityConfig.class,
SpPermissionEvaluator.class
})
diff --git
a/streampipes-backend/src/main/java/org/apache/streampipes/backend/StreamPipesPasswordEncoder.java
b/streampipes-backend/src/main/java/org/apache/streampipes/backend/StreamPipesPasswordEncoder.java
new file mode 100644
index 0000000..b6e5cca
--- /dev/null
+++
b/streampipes-backend/src/main/java/org/apache/streampipes/backend/StreamPipesPasswordEncoder.java
@@ -0,0 +1,33 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.apache.streampipes.backend;
+
+import
org.apache.streampipes.user.management.authentication.StreamPipesCredentialsMatcher;
+import org.springframework.context.annotation.Bean;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.stereotype.Component;
+
+@Component
+public class StreamPipesPasswordEncoder {
+
+ @Bean
+ public PasswordEncoder passwordEncoder() {
+ return new StreamPipesCredentialsMatcher();
+ }
+}
diff --git
a/streampipes-backend/src/main/java/org/apache/streampipes/backend/WebSecurityConfig.java
b/streampipes-backend/src/main/java/org/apache/streampipes/backend/WebSecurityConfig.java
index 5d59c58..ac9c385 100644
---
a/streampipes-backend/src/main/java/org/apache/streampipes/backend/WebSecurityConfig.java
+++
b/streampipes-backend/src/main/java/org/apache/streampipes/backend/WebSecurityConfig.java
@@ -42,14 +42,16 @@ import
org.springframework.security.web.authentication.UsernamePasswordAuthentic
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
private final UserDetailsService userDetailsService;
+ private StreamPipesPasswordEncoder passwordEncoder;
- public WebSecurityConfig() {
+ public WebSecurityConfig(StreamPipesPasswordEncoder passwordEncoder) {
+ this.passwordEncoder = passwordEncoder;
this.userDetailsService = new SpUserDetailsService();
}
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws
Exception {
-
auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
+
auth.userDetailsService(userDetailsService).passwordEncoder(this.passwordEncoder.passwordEncoder());
}
@Override
@@ -82,11 +84,6 @@ public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
return userDetailsService;
}
- @Bean
- public PasswordEncoder passwordEncoder() {
- return new StreamPipesCredentialsMatcher();
- }
-
@Bean(BeanIds.AUTHENTICATION_MANAGER)
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
diff --git
a/streampipes-pipeline-management/src/main/java/org/apache/streampipes/manager/execution/http/HttpRequestBuilder.java
b/streampipes-pipeline-management/src/main/java/org/apache/streampipes/manager/execution/http/HttpRequestBuilder.java
index 54653ff..671235a 100644
---
a/streampipes-pipeline-management/src/main/java/org/apache/streampipes/manager/execution/http/HttpRequestBuilder.java
+++
b/streampipes-pipeline-management/src/main/java/org/apache/streampipes/manager/execution/http/HttpRequestBuilder.java
@@ -108,7 +108,7 @@ public class HttpRequestBuilder {
.findForObjectId(this.pipelineId)
.stream()
.findFirst()
- .map(Permission::getOwnerSid).orElseThrow(() -> new
IllegalArgumentException("Could not find owner for pipeline"));
+ .map(Permission::getOwnerSid).orElseThrow(() -> new
IllegalArgumentException("Could not find owner for pipeline " + pipelineId));
Principal correspondingUser = new
SpResourceManager().manageUsers().getPrincipalById(ownerSid);
return "Bearer " + new
JwtTokenProvider().createToken(correspondingUser);
diff --git
a/streampipes-rest-core-base/src/main/java/org/apache/streampipes/rest/core/base/impl/AbstractAuthGuardedRestResource.java
b/streampipes-rest-core-base/src/main/java/org/apache/streampipes/rest/core/base/impl/AbstractAuthGuardedRestResource.java
index 1e24ff5..d04273e 100644
---
a/streampipes-rest-core-base/src/main/java/org/apache/streampipes/rest/core/base/impl/AbstractAuthGuardedRestResource.java
+++
b/streampipes-rest-core-base/src/main/java/org/apache/streampipes/rest/core/base/impl/AbstractAuthGuardedRestResource.java
@@ -17,17 +17,25 @@
*/
package org.apache.streampipes.rest.core.base.impl;
+import org.apache.streampipes.model.client.user.Role;
import org.apache.streampipes.user.management.model.PrincipalUserDetails;
import org.springframework.security.core.context.SecurityContextHolder;
import javax.ws.rs.core.Context;
import javax.ws.rs.core.SecurityContext;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
public class AbstractAuthGuardedRestResource extends AbstractRestResource {
@Context
protected SecurityContext securityContext;
+ private static final List<String> adminRoles = Arrays.asList(
+ Role.Constants.ROLE_ADMIN_VALUE,
+ Role.Constants.ROLE_SERVICE_ADMIN_VALUE);
+
protected boolean isAuthenticated() {
return this.securityContext.getUserPrincipal() != null;
}
@@ -44,4 +52,24 @@ public class AbstractAuthGuardedRestResource extends
AbstractRestResource {
return getPrincipal().getDetails().getPrincipalId();
}
+ protected boolean isAdminOrHasAnyAuthority(String... authorities) {
+ List<String> allAuthorities = new ArrayList<>(Arrays.asList(authorities));
+ allAuthorities.addAll(adminRoles);
+ return hasAnyAuthority(allAuthorities);
+ }
+
+ protected boolean hasAnyAuthority(String... authorities) {
+ return hasAnyAuthority(Arrays.asList(authorities));
+ }
+
+ protected boolean hasAnyAuthority(List<String> authorities) {
+ return isAuthenticated() &&
+ SecurityContextHolder
+ .getContext()
+ .getAuthentication()
+ .getAuthorities()
+ .stream()
+ .anyMatch(a -> authorities.contains(a.getAuthority()));
+ }
+
}
diff --git
a/streampipes-rest/src/main/java/org/apache/streampipes/rest/impl/dashboard/AbstractDashboardResource.java
b/streampipes-rest/src/main/java/org/apache/streampipes/rest/impl/dashboard/AbstractDashboardResource.java
index 32bd69c..3638e5d 100644
---
a/streampipes-rest/src/main/java/org/apache/streampipes/rest/impl/dashboard/AbstractDashboardResource.java
+++
b/streampipes-rest/src/main/java/org/apache/streampipes/rest/impl/dashboard/AbstractDashboardResource.java
@@ -35,7 +35,7 @@ public abstract class AbstractDashboardResource extends
AbstractAuthGuardedRestR
@GET
@Produces(MediaType.APPLICATION_JSON)
@JacksonSerialized
- @PreAuthorize("hasAnyAuthority(#root.this.getReadRoles())")
+ @PreAuthorize("this.hasReadAuthority()")
@PostFilter("hasPermission(filterObject.couchDbId, 'READ')")
public List<DashboardModel> getAllDashboards() {
return getResourceManager().findAll();
@@ -44,7 +44,7 @@ public abstract class AbstractDashboardResource extends
AbstractAuthGuardedRestR
@GET
@Produces(MediaType.APPLICATION_JSON)
@Path("/{dashboardId}")
- @PreAuthorize("hasAnyAuthority(#root.this.getReadRoles()) and
hasPermission(#dashboardId, 'READ')")
+ @PreAuthorize("this.hasReadAuthority() and hasPermission(#dashboardId,
'READ')")
public DashboardModel getDashboard(@PathParam("dashboardId") String
dashboardId) {
return getResourceManager().find(dashboardId);
}
@@ -52,7 +52,7 @@ public abstract class AbstractDashboardResource extends
AbstractAuthGuardedRestR
@PUT
@Produces(MediaType.APPLICATION_JSON)
@Path("/{dashboardId}")
- @PreAuthorize("hasAnyAuthority(#root.this.getWriteRoles()) and
hasPermission(#dashboardModel.couchDbId, 'WRITE')")
+ @PreAuthorize("this.hasWriteAuthority() and
hasPermission(#dashboardModel.couchDbId, 'WRITE')")
public DashboardModel modifyDashboard(DashboardModel dashboardModel) {
getResourceManager().update(dashboardModel);
return getResourceManager().find(dashboardModel.getCouchDbId());
@@ -61,7 +61,7 @@ public abstract class AbstractDashboardResource extends
AbstractAuthGuardedRestR
@DELETE
@Produces(MediaType.APPLICATION_JSON)
@Path("/{dashboardId}")
- @PreAuthorize("hasAnyAuthority(#root.this.getDeleteRoles()) and
hasPermission(#dashboardId, 'DELETE')")
+ @PreAuthorize("this.hasDeleteAuthority() and hasPermission(#dashboardId,
'DELETE')")
public Response deleteDashboard(@PathParam("dashboardId") String
dashboardId) {
getResourceManager().delete(dashboardId);
return ok();
@@ -69,7 +69,7 @@ public abstract class AbstractDashboardResource extends
AbstractAuthGuardedRestR
@POST
@Produces(MediaType.APPLICATION_JSON)
- @PreAuthorize("hasAnyAuthority(#root.this.getWriteRoles())")
+ @PreAuthorize("this.hasWriteAuthority()")
public Response createDashboard(DashboardModel dashboardModel) {
getResourceManager().create(dashboardModel, getAuthenticatedUserSid());
return ok();
@@ -81,10 +81,10 @@ public abstract class AbstractDashboardResource extends
AbstractAuthGuardedRestR
* Do not delete these abstract methods below - required by Spring SPEL (see
above)
*/
- public abstract String getWriteRoles();
+ public abstract boolean hasReadAuthority();
- public abstract String getReadRoles();
+ public abstract boolean hasWriteAuthority();
- public abstract String getDeleteRoles();
+ public abstract boolean hasDeleteAuthority();
}
diff --git
a/streampipes-rest/src/main/java/org/apache/streampipes/rest/impl/dashboard/Dashboard.java
b/streampipes-rest/src/main/java/org/apache/streampipes/rest/impl/dashboard/Dashboard.java
index db545e7..144c7d9 100644
---
a/streampipes-rest/src/main/java/org/apache/streampipes/rest/impl/dashboard/Dashboard.java
+++
b/streampipes-rest/src/main/java/org/apache/streampipes/rest/impl/dashboard/Dashboard.java
@@ -24,6 +24,7 @@ import
org.apache.streampipes.resource.management.AbstractDashboardResourceManag
import org.springframework.stereotype.Component;
import javax.ws.rs.Path;
+import java.util.Arrays;
@Path("/v2/dashboard/dashboards")
@Component
@@ -35,17 +36,17 @@ public class Dashboard extends AbstractDashboardResource {
}
@Override
- public String getWriteRoles() {
- return Role.Constants.ROLE_ADMIN_VALUE + ", "
+Privilege.Constants.PRIVILEGE_WRITE_DASHBOARD_VALUE;
+ public boolean hasReadAuthority() {
+ return
isAdminOrHasAnyAuthority(Privilege.Constants.PRIVILEGE_READ_DASHBOARD_VALUE);
}
@Override
- public String getReadRoles() {
- return Role.Constants.ROLE_ADMIN_VALUE + ", "
+Privilege.Constants.PRIVILEGE_READ_DASHBOARD_VALUE;
+ public boolean hasWriteAuthority() {
+ return
isAdminOrHasAnyAuthority(Privilege.Constants.PRIVILEGE_WRITE_DASHBOARD_VALUE);
}
@Override
- public String getDeleteRoles() {
- return Role.Constants.ROLE_ADMIN_VALUE + ", "
+Privilege.Constants.PRIVILEGE_DELETE_DASHBOARD_VALUE;
+ public boolean hasDeleteAuthority() {
+ return
isAdminOrHasAnyAuthority(Privilege.Constants.PRIVILEGE_DELETE_DASHBOARD_VALUE);
}
}
diff --git
a/streampipes-rest/src/main/java/org/apache/streampipes/rest/impl/datalake/DataLakeDashboardResource.java
b/streampipes-rest/src/main/java/org/apache/streampipes/rest/impl/datalake/DataLakeDashboardResource.java
index be50911..6aa6a5f 100644
---
a/streampipes-rest/src/main/java/org/apache/streampipes/rest/impl/datalake/DataLakeDashboardResource.java
+++
b/streampipes-rest/src/main/java/org/apache/streampipes/rest/impl/datalake/DataLakeDashboardResource.java
@@ -37,17 +37,17 @@ public class DataLakeDashboardResource extends
AbstractDashboardResource {
}
@Override
- public String getWriteRoles() {
- return Role.Constants.ROLE_ADMIN_VALUE + ", " +
Privilege.Constants.PRIVILEGE_WRITE_DATA_EXPLORER_VIEW_VALUE;
+ public boolean hasReadAuthority() {
+ return
isAdminOrHasAnyAuthority(Privilege.Constants.PRIVILEGE_READ_DATA_EXPLORER_VIEW_VALUE);
}
@Override
- public String getReadRoles() {
- return Role.Constants.ROLE_ADMIN_VALUE + ", "
+Privilege.Constants.PRIVILEGE_READ_DATA_EXPLORER_VIEW_VALUE;
+ public boolean hasWriteAuthority() {
+ return
isAdminOrHasAnyAuthority(Privilege.Constants.PRIVILEGE_WRITE_DATA_EXPLORER_VIEW_VALUE);
}
@Override
- public String getDeleteRoles() {
- return Role.Constants.ROLE_ADMIN_VALUE + ", "
+Privilege.Constants.PRIVILEGE_READ_DATA_EXPLORER_VIEW_VALUE;
+ public boolean hasDeleteAuthority() {
+ return
isAdminOrHasAnyAuthority(Privilege.Constants.PRIVILEGE_DELETE_DATA_EXPLORER_VIEW_VALUE);
}
}
