[
https://issues.apache.org/jira/browse/NIFI-3653?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16033338#comment-16033338
]
Matt Gilman commented on NIFI-3653:
-----------------------------------
At this point, I do not believe this will make it into 1.3.0. Things have been
progressing nicely but it's just not ready. The feature has reached to all
parts of the application (UI, clustering, core configuration, access decisions,
etc) and this isn't something I want to rush.
However, I would love if you could implement your custom authorizer and
evaluate this work once it's ready to ensure it's meeting your use case. If
not, then we'd still have time to re-open the JIRA and address any issues
before introducing new public APIs. Once everything is in and looks good, we
can always initiate another release.
In the meantime, feel free to review the work that been done thus far my
feature branch [1]. It is not completed yet, but it's getting close.
[1] https://github.com/mcgilman/nifi/tree/NIFI-3653
> Create PolicyBasedAuthorizer interface to allow authorization chain
> -------------------------------------------------------------------
>
> Key: NIFI-3653
> URL: https://issues.apache.org/jira/browse/NIFI-3653
> Project: Apache NiFi
> Issue Type: Improvement
> Components: Core Framework
> Reporter: Michael Moser
> Assignee: Matt Gilman
>
> Rather than using AbstractPolicyBasedAuthorizer to trigger policy management,
> refactor to use a new interface. New implementations of this interface can
> then create an authorization chain with existing
> AbstractPolicyBasedAuthorizer sub-classes.
> ----
> While investigating alternate implementations of the Authorizer interface, I
> see the AbstractPolicyBasedAuthorizer is meant to be extended. It's
> authorize() method is final, however, and does not have an abstract
> doAuthorize() method that sub-classes can extend.
> In particular, the existing AbstractPolicyBasedAuthorizer authorize() method
> does not take into account the AuthorizationRequest "resourceContext" in its
> authorization decision. This is especially important when authorizing access
> to events in Provenance, which places attributes in resouceContext of its
> AuthorizationRequest when obtaining an authorization decision. I would like
> to use attributes to authorize access to Provenance download & view content
> feature.
> If I had my own sub-class of AbstractPolicyBasedAuthorizer, with the
> availability of a doAuthorize() method, then I could maintain my own user
> policies for allowing access to flowfile content via Provenance.
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
