...
This system exposes a set of interfaces defined below.
...
AuthEnforcer
The AuthChecker
AuthEnforcer
interface provides a way to check if an operation is authorized. At various points in the CDAP code (NamespaceHttpHandler, AppLifecycleHttpHandler, ProgramLifecycleHttpHandler, StreamHandler in 3.4), this interface will be used to check if an operation is authorized.
Code Block | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||
interface AuthCheckerAuthEnforcer { /** * ChecksEnforces ifauthorization afor userthe isspecified allowed{@link toPrincipal} performfor athe setspecified of{@link actionsAction} on an entity the specified {@link EntityId}. * * @param Principalprincipal the Principalprincipal that performs the actions. This could be a user, group or a role * @param entity the entity on which an action is being performed * @param action the action being performed * @throws AuthorizationException if the Principalprincipal is not authorized to perform action on the entity */ void checkAuthorizedenforce(Principal Principal, Entity entity, Action action) throws AuthorizationException; } |
...
Code Block | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||
interface Authorizer extends AuthCheckerAuthEnforcer { /** * Grants a principal authorization to perform a set of actions on an entity. * * @param entity the entity on which an action is being performed * @param principal the Principal that performs the actions. This could be a user, group or a role * @param actions the set of actions to grant */ void grant(EntityId entity, Principal principal, Set<Action> actions); /** * Grants a Principal authorization to perform all actions on an entity. * * @param entity the entity on which an action is being performed * @param principal the Principal that performs the actions. This could be a user, group or a role */ void grant(EntityId entity, Principal principal, Set<Action> actions); /** * Revokes a principal's authorization to perform a set of actions on an entity. * * @param entity the entity on which an action is being performed * @param principal the principal that performs the actions. This could be a user, group or a role * @param actions the set of actions to revoke permissions on */ void revoke(EntityId entity, Principal principal, Set<Action> actions); /** * Revokes a principal's authorization to perform any action on an entity. * * @param entity the entity on which an action is being performed * @param principal the principal that performs the actions. This could be a user, group or a role */ void revoke(EntityId entity, Principal Principal); /** * Revokes all principals' authorization to perform any action on an entity. * * @param entity the entity on which an action is being performed */ void revoke(EntityId entity); } |
...