opensource/rocketmq
3
0
Fork 0
mirror of https://github.com/apache/rocketmq.git synced 2026-09-21 05:44:03 +08:00
Code Issues Packages Projects Releases Wiki Activity

[ISSUE #3949] Refector AuthenticationInterceptor

Browse Source
This commit is contained in:
zhouxiang
2022-07-13 11:30:48 +08:00
parent ade67ba81e
commit 3685fdaaeb
5 changed files with 36 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
acl/src/main/java/org/apache/rocketmq/acl/AccessValidator.java
+2 -2
View File
@@ -20,7 +20,7 @@ package org.apache.rocketmq.acl;
import com.google.protobuf.GeneratedMessageV3;
import java.util.List;
import java.util.Map;
import org.apache.rocketmq.acl.common.MetadataHeader;
import org.apache.rocketmq.acl.common.AuthenticationHeader;
import org.apache.rocketmq.common.AclConfig;
import org.apache.rocketmq.common.DataVersion;
import org.apache.rocketmq.common.PlainAccessConfig;
@@ -43,7 +43,7 @@ public interface AccessValidator {
* @param header
* @return Plain access resource
*/
AccessResource parse(GeneratedMessageV3 messageV3, MetadataHeader header);
AccessResource parse(GeneratedMessageV3 messageV3, AuthenticationHeader header);
/**
* Validate the access resource.
acl/src/main/java/org/apache/rocketmq/acl/common/MetadataHeader.java → acl/src/main/java/org/apache/rocketmq/acl/common/AuthenticationHeader.java
+17 -17
View File
@@ -17,7 +17,7 @@
package org.apache.rocketmq.acl.common;
public class MetadataHeader {
public class AuthenticationHeader {
private String remoteAddress;
private String tenantId;
private String namespace;
@@ -30,7 +30,7 @@ public class MetadataHeader {
private String protocol;
private int requestCode;
MetadataHeader(final String remoteAddress, final String tenantId, final String namespace,
AuthenticationHeader(final String remoteAddress, final String tenantId, final String namespace,
final String authorization, final String datetime, final String sessionToken, final String requestId,
final String language, final String clientVersion, final String protocol, final int requestCode) {
this.remoteAddress = remoteAddress;
@@ -62,70 +62,70 @@ public class MetadataHeader {
MetadataHeaderBuilder() {
}
public MetadataHeader.MetadataHeaderBuilder remoteAddress(final String remoteAddress) {
public AuthenticationHeader.MetadataHeaderBuilder remoteAddress(final String remoteAddress) {
this.remoteAddress = remoteAddress;
return this;
}
public MetadataHeader.MetadataHeaderBuilder tenantId(final String tenantId) {
public AuthenticationHeader.MetadataHeaderBuilder tenantId(final String tenantId) {
this.tenantId = tenantId;
return this;
}
public MetadataHeader.MetadataHeaderBuilder namespace(final String namespace) {
public AuthenticationHeader.MetadataHeaderBuilder namespace(final String namespace) {
this.namespace = namespace;
return this;
}
public MetadataHeader.MetadataHeaderBuilder authorization(final String authorization) {
public AuthenticationHeader.MetadataHeaderBuilder authorization(final String authorization) {
this.authorization = authorization;
return this;
}
public MetadataHeader.MetadataHeaderBuilder datetime(final String datetime) {
public AuthenticationHeader.MetadataHeaderBuilder datetime(final String datetime) {
this.datetime = datetime;
return this;
}
public MetadataHeader.MetadataHeaderBuilder sessionToken(final String sessionToken) {
public AuthenticationHeader.MetadataHeaderBuilder sessionToken(final String sessionToken) {
this.sessionToken = sessionToken;
return this;
}
public MetadataHeader.MetadataHeaderBuilder requestId(final String requestId) {
public AuthenticationHeader.MetadataHeaderBuilder requestId(final String requestId) {
this.requestId = requestId;
return this;
}
public MetadataHeader.MetadataHeaderBuilder language(final String language) {
public AuthenticationHeader.MetadataHeaderBuilder language(final String language) {
this.language = language;
return this;
}
public MetadataHeader.MetadataHeaderBuilder clientVersion(final String clientVersion) {
public AuthenticationHeader.MetadataHeaderBuilder clientVersion(final String clientVersion) {
this.clientVersion = clientVersion;
return this;
}
public MetadataHeader.MetadataHeaderBuilder protocol(final String protocol) {
public AuthenticationHeader.MetadataHeaderBuilder protocol(final String protocol) {
this.protocol = protocol;
return this;
}
public MetadataHeader.MetadataHeaderBuilder requestCode(final int requestCode) {
public AuthenticationHeader.MetadataHeaderBuilder requestCode(final int requestCode) {
this.requestCode = requestCode;
return this;
}
public MetadataHeader build() {
return new MetadataHeader(this.remoteAddress, this.tenantId, this.namespace, this.authorization,
public AuthenticationHeader build() {
return new AuthenticationHeader(this.remoteAddress, this.tenantId, this.namespace, this.authorization,
this.datetime, this.sessionToken, this.requestId, this.language, this.clientVersion, this.protocol,
this.requestCode);
}
}
public static MetadataHeader.MetadataHeaderBuilder builder() {
return new MetadataHeader.MetadataHeaderBuilder();
public static AuthenticationHeader.MetadataHeaderBuilder builder() {
return new AuthenticationHeader.MetadataHeaderBuilder();
}
public String getRemoteAddress() {
acl/src/main/java/org/apache/rocketmq/acl/plain/PlainAccessResource.java
+2 -2
View File
@@ -36,7 +36,7 @@ import org.apache.rocketmq.acl.AccessResource;
import org.apache.rocketmq.acl.common.AclException;
import org.apache.rocketmq.acl.common.AclUtils;
import org.apache.rocketmq.acl.common.AuthorizationHeader;
import org.apache.rocketmq.acl.common.MetadataHeader;
import org.apache.rocketmq.acl.common.AuthenticationHeader;
import org.apache.rocketmq.acl.common.Permission;
import org.apache.rocketmq.acl.common.SessionCredentials;
import org.apache.rocketmq.common.MixAll;
@@ -172,7 +172,7 @@ public class PlainAccessResource implements AccessResource {
return accessResource;
}
public static PlainAccessResource parse(GeneratedMessageV3 messageV3, MetadataHeader header) {
public static PlainAccessResource parse(GeneratedMessageV3 messageV3, AuthenticationHeader header) {
PlainAccessResource accessResource = new PlainAccessResource();
String remoteAddress = header.getRemoteAddress();
if (remoteAddress != null && remoteAddress.contains(":")) {
acl/src/main/java/org/apache/rocketmq/acl/plain/PlainAccessValidator.java
+2 -2
View File
@@ -21,7 +21,7 @@ import java.util.List;
import java.util.Map;
import org.apache.rocketmq.acl.AccessResource;
import org.apache.rocketmq.acl.AccessValidator;
import org.apache.rocketmq.acl.common.MetadataHeader;
import org.apache.rocketmq.acl.common.AuthenticationHeader;
import org.apache.rocketmq.common.AclConfig;
import org.apache.rocketmq.common.DataVersion;
import org.apache.rocketmq.common.PlainAccessConfig;
@@ -40,7 +40,7 @@ public class PlainAccessValidator implements AccessValidator {
return PlainAccessResource.parse(request, remoteAddr);
}
@Override public AccessResource parse(GeneratedMessageV3 messageV3, MetadataHeader header) {
@Override public AccessResource parse(GeneratedMessageV3 messageV3, AuthenticationHeader header) {
return PlainAccessResource.parse(messageV3, header);
}
proxy/src/main/java/org/apache/rocketmq/proxy/grpc/interceptor/AuthenticationInterceptor.java
+13 -8
View File
@@ -30,12 +30,12 @@ import java.util.List;
import org.apache.rocketmq.acl.AccessResource;
import org.apache.rocketmq.acl.AccessValidator;
import org.apache.rocketmq.acl.common.AclException;
import org.apache.rocketmq.acl.common.MetadataHeader;
import org.apache.rocketmq.acl.common.AuthenticationHeader;
import org.apache.rocketmq.acl.plain.PlainAccessResource;
import org.apache.rocketmq.proxy.config.ConfigurationManager;
public class AuthenticationInterceptor implements ServerInterceptor {
private final List<AccessValidator> accessValidatorList;
protected final List<AccessValidator> accessValidatorList;
public AuthenticationInterceptor(List<AccessValidator> accessValidatorList) {
this.accessValidatorList = accessValidatorList;
@@ -50,7 +50,7 @@ public class AuthenticationInterceptor implements ServerInterceptor {
if (ConfigurationManager.getProxyConfig().isEnableACL()) {
try {
GeneratedMessageV3 messageV3 = (GeneratedMessageV3) message;
MetadataHeader metadataHeader = MetadataHeader.builder()
AuthenticationHeader authenticationHeader = AuthenticationHeader.builder()
.remoteAddress(InterceptorConstants.METADATA.get(Context.current()).get(InterceptorConstants.REMOTE_ADDRESS))
.namespace(InterceptorConstants.METADATA.get(Context.current()).get(InterceptorConstants.NAMESPACE_ID))
.authorization(InterceptorConstants.METADATA.get(Context.current()).get(InterceptorConstants.AUTHORIZATION))
@@ -62,11 +62,8 @@ public class AuthenticationInterceptor implements ServerInterceptor {
.protocol(InterceptorConstants.METADATA.get(Context.current()).get(InterceptorConstants.PROTOCOL_VERSION))
.requestCode(RequestMapping.map(messageV3.getDescriptorForType().getFullName()))
.build();
for (AccessValidator accessValidator : accessValidatorList) {
AccessResource accessResource = accessValidator.parse(messageV3, metadataHeader);
accessValidator.validate(accessResource);
addHeader(headers, messageV3, accessResource);
}
validate(authenticationHeader, headers, messageV3);
super.onMessage(message);
} catch (AclException aclException) {
throw new StatusRuntimeException(Status.PERMISSION_DENIED, headers);
@@ -78,6 +75,14 @@ public class AuthenticationInterceptor implements ServerInterceptor {
};
}
protected void validate(AuthenticationHeader authenticationHeader, Metadata headers, GeneratedMessageV3 messageV3) {
for (AccessValidator accessValidator : accessValidatorList) {
AccessResource accessResource = accessValidator.parse(messageV3, authenticationHeader);
accessValidator.validate(accessResource);
addHeader(headers, messageV3, accessResource);
}
}
protected void addHeader(Metadata headers, GeneratedMessageV3 messageV3, AccessResource accessResource) {
headers.put(InterceptorConstants.RPC_NAME, messageV3.getDescriptorForType().getFullName());
if (accessResource instanceof PlainAccessResource) {