Skip to content

Commit 8c563c5

Browse files
tombentleytombentley
authored
Add an ACL Authorizer implementation (kroxylicious#2903)
* kroxylicious-authorizer-acl: Implement the Authorizer API using ACLs * Allow keywords as identifiers * Javadoc ResourceType.implies() * Rejig import statement to better support multi import from same package * Remove `version` * Import User by default, but allow it to be overridden Signed-off-by: Tom Bentley <tbentley@redhat.com>
1 parent d2fb021 commit 8c563c5

File tree

30 files changed

+2808
-0
lines changed

30 files changed

+2808
-0
lines changed

‎etc/checkstyle-suppressions.xml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,4 +20,7 @@
2020
files="io[/\\]kroxylicious[/\\]kubernetes[/\\]filter[/\\]api[/\\].*\.java"/>
2121
<suppress checks=".*"
2222
files="io[/\\]kroxylicious[/\\]microbenchmarks[/\\]jmh_generated[/\\].*"/>
23+
24+
<suppress checks=".*"
25+
files="generated-sources/antlr4/.*"/>
2326
</suppressions>

‎kroxylicious-authorizer-api/src/main/java/io/kroxylicious/authorizer/service/ResourceType.java‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,13 @@
1919
*/
2020
public interface ResourceType<S extends Enum<S> & ResourceType<S>> {
2121

22+
/**
23+
* Returns a set of operations that are implied by this operation.
24+
* This must return the complete transitive closure of all such implied operations.
25+
* In other words, if logically speaking {@code A} implies {@code B}, and {@code B} implies {@code C} then
26+
* programmatically speaking {@code A.implies()} must contain both {@code B} <em>and {@code C}</em>.
27+
* @return The operations that are implied by this operation.
28+
*/
2229
default Set<S> implies() {
2330
// TODO This is actually really tricky to model in a way that works for different Authorizer implementations
2431
// Allowing operations to express implication makes in-process authorization evaluations easier

‎kroxylicious-authorizer-providers/kroxylicious-authorizer-acl/pom.xml‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
4+
Copyright Kroxylicious Authors.
5+
6+
Licensed under the Apache Software License version 2.0, available at http://www.apache.org/licenses/LICENSE-2.0
7+
8+
-->
9+
10+
<project xmlns="http://maven.apache.org/POM/4.0.0"
11+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
12+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
13+
<modelVersion>4.0.0</modelVersion>
14+
<parent>
15+
<groupId>io.kroxylicious</groupId>
16+
<artifactId>kroxylicious-parent</artifactId>
17+
<version>0.18.0-SNAPSHOT</version>
18+
<relativePath>../../pom.xml</relativePath>
19+
</parent>
20+
21+
<artifactId>kroxylicious-authorizer-acl</artifactId>
22+
<name>ACL Authorization plugin implementation</name>
23+
<description>An Authorization plugin implementation using Access Control Lists (ACLs)</description>
24+
25+
<dependencies>
26+
<dependency>
27+
<groupId>io.kroxylicious</groupId>
28+
<artifactId>kroxylicious-api</artifactId>
29+
</dependency>
30+
<dependency>
31+
<groupId>org.antlr</groupId>
32+
<artifactId>antlr4-runtime</artifactId>
33+
</dependency>
34+
<dependency>
35+
<groupId>io.kroxylicious</groupId>
36+
<artifactId>kroxylicious-annotations</artifactId>
37+
</dependency>
38+
<dependency>
39+
<groupId>io.kroxylicious</groupId>
40+
<artifactId>kroxylicious-authorizer-api</artifactId>
41+
</dependency>
42+
<dependency>
43+
<groupId>com.google.re2j</groupId>
44+
<artifactId>re2j</artifactId>
45+
</dependency>
46+
<dependency>
47+
<groupId>com.github.spotbugs</groupId>
48+
<artifactId>spotbugs-annotations</artifactId>
49+
</dependency>
50+
<dependency>
51+
<groupId>org.assertj</groupId>
52+
<artifactId>assertj-core</artifactId>
53+
<scope>test</scope>
54+
</dependency>
55+
<dependency>
56+
<groupId>org.junit.jupiter</groupId>
57+
<artifactId>junit-jupiter-api</artifactId>
58+
<scope>test</scope>
59+
</dependency>
60+
<dependency>
61+
<groupId>org.junit.jupiter</groupId>
62+
<artifactId>junit-jupiter-params</artifactId>
63+
<scope>test</scope>
64+
</dependency>
65+
</dependencies>
66+
67+
<build>
68+
<plugins>
69+
<plugin>
70+
<groupId>org.antlr</groupId>
71+
<artifactId>antlr4-maven-plugin</artifactId>
72+
<version>4.13.1</version>
73+
<executions>
74+
<execution>
75+
<goals>
76+
<goal>antlr4</goal>
77+
</goals>
78+
<phase>generate-sources</phase>
79+
80+
</execution>
81+
</executions>
82+
</plugin>
83+
<plugin>
84+
<groupId>org.apache.maven.plugins</groupId>
85+
<artifactId>maven-javadoc-plugin</artifactId>
86+
<executions>
87+
<execution>
88+
<id>attach-javadocs</id>
89+
<configuration>
90+
<!-- don't doc the antler generated classes -->
91+
<excludePackageNames>io.kroxylicious.authorizer.provider.acl.parser</excludePackageNames>
92+
</configuration>
93+
</execution>
94+
</executions>
95+
</plugin>
96+
</plugins>
97+
</build>
98+
99+
</project>

‎kroxylicious-authorizer-providers/kroxylicious-authorizer-acl/src/main/antlr4/io/kroxylicious/authorizer/provider/acl/parser/AclRules.g4‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
/**
2+
* Copyright Kroxylicious Authors.
3+
*
4+
* Licensed under the Apache Software License version 2.0, available at http://www.apache.org/licenses/LICENSE-2.0
5+
*/
6+
grammar AclRules;
7+
8+
rule:
9+
importStmt*
10+
denyRule*
11+
allowRule*
12+
endRule
13+
<EOF>
14+
;
15+
16+
// We include all the lexer keywords, in addition to the lexer IDENT token, into this grammar rule
17+
// so that those keywords can be used in identifiers in the grammar
18+
ident : FROM | IMPORT | AS
19+
| ALLOW | DENY | TO
20+
| WITH | NAME | IN | LIKE | MATCHING
21+
| OTHERWISE
22+
| IDENT;
23+
24+
importStmt: FROM packageName IMPORT importList SEMI
25+
;
26+
packageName: qualIdent
27+
;
28+
qualIdent: ident (DOT ident)*
29+
;
30+
importList: importElement (COMMA importElement)*
31+
;
32+
importElement: name=ident (AS local=ident)?
33+
;
34+
35+
denyRule: DENY allowOrDenyRule SEMI
36+
;
37+
allowRule: ALLOW allowOrDenyRule SEMI
38+
;
39+
40+
allowOrDenyRule: userPattern TO operationPattern
41+
;
42+
43+
userPattern: principalType WITH NAME userNamePred
44+
;
45+
principalType: ident
46+
;
47+
userNamePred: nameAny
48+
| nameEq
49+
| nameIn
50+
| nameLike
51+
;
52+
53+
operationPattern: operations resource WITH NAME resourceNamePred
54+
;
55+
56+
operations: STAR
57+
| operation
58+
| operationSet
59+
;
60+
operation: ident
61+
;
62+
operationSet: LBRA operation (COMMA operation)* RBRA
63+
;
64+
65+
resource: ident
66+
//| STAR
67+
;
68+
69+
resourceNamePred: nameAny
70+
| nameEq
71+
| nameIn
72+
| nameMatch
73+
| nameLike
74+
;
75+
nameAny: STAR
76+
;
77+
nameEq: EQ STRING
78+
;
79+
nameIn: IN LBRA STRING (COMMA STRING)* RBRA
80+
;
81+
nameMatch: MATCHING REGEX
82+
;
83+
nameLike: LIKE STRING
84+
;
85+
86+
endRule: OTHERWISE DENY SEMI
87+
;
88+
89+
// lexer rules
90+
SEMI: ';';
91+
DOT: '.';
92+
COMMA: ',';
93+
STAR: '*';
94+
EQ: '=';
95+
LBRA: '{';
96+
RBRA: '}';
97+
DENY: 'deny';
98+
ALLOW: 'allow';
99+
OTHERWISE: 'otherwise';
100+
IN: 'in';
101+
TO: 'to';
102+
AS: 'as';
103+
LIKE: 'like';
104+
MATCHING: 'matching';
105+
FROM: 'from';
106+
IMPORT: 'import';
107+
NAME: 'name';
108+
WITH: 'with';
109+
STRING: '"' (STRING_ESC | .)*? '"';
110+
fragment STRING_ESC: '\\"' | '\\\\';
111+
REGEX: '/' (REGEX_ESC | .)*? '/';
112+
fragment REGEX_ESC: '\\/' | '\\\\';
113+
LINE_COMMENT: '//' .*? '\r'? '\n' -> skip;
114+
COMMENT: '/*' .*? '*/' -> skip;
115+
WS: [ \t\r\n]+ -> skip;
116+
IDENT: [A-Za-z][A-Za-z0-9_]*;

0 commit comments

Comments
 (0)