-
Notifications
You must be signed in to change notification settings - Fork 996
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Authentication and Authorization (#793)
* Auth * Authentication and Authorization Client sdk authentication, Server Authentication and authorization. * PR Feedback fixes * Updating docs * Pr comments and end to end test fixes * Adding get token check and minor refactoring * changing autovalue to lombok * removed lognet * Authentication and Authorization End to end test PR comments and end to end test with google auth. * list_features_by_ref to use updated core service method. * Fix for failing test after rebase. * Removed boolean conversion. * Added missing fixture dependency. * Corrected overriding yaml for auth, removed redundant echo. * Allow gcloud command to run without exiting tests * Lint error. * Set GOOGLE_APPLICATION_CREDENTIALS for auth testW * Add gcloud sdk installation to auth tests * Add transactions back to projects, revert to AccessManagementService, and make Auth Config generic * Fix typo in core configuration * Update documentation to remove Google terminology * Remove stream specific configuration in e2e tests * Fix linting Co-authored-by: Andres March (vistaprint) <amarch@vistaprint.com> Co-authored-by: Jayanth Kumar M J <treffen.jayanth@gmail.com> Co-authored-by: e10112844 <jayant.mj@vistaprint.com> Co-authored-by: Willem Pienaar <6728866+woop@users.noreply.github.com> Co-authored-by: Willem Pienaar <git@willem.co>
- Loading branch information
6 people
authored
Jun 23, 2020
1 parent
8c2201c
commit 74bcd3f
Showing
36 changed files
with
1,797 additions
and
272 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
61 changes: 61 additions & 0 deletions
61
core/src/main/java/feast/core/auth/authentication/DefaultJwtAuthenticationProvider.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| /* | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * Copyright 2018-2020 The Feast Authors | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * https://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package feast.core.auth.authentication; | ||
|
|
||
| import java.util.Map; | ||
| import org.springframework.security.authentication.AuthenticationProvider; | ||
| import org.springframework.security.core.Authentication; | ||
| import org.springframework.security.core.AuthenticationException; | ||
| import org.springframework.security.oauth2.jwt.NimbusJwtDecoder; | ||
| import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter; | ||
| import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationProvider; | ||
|
|
||
| /** Json Web Token Authentication Provider used to validate incoming requests to Feast Core. */ | ||
| public class DefaultJwtAuthenticationProvider implements AuthenticationProvider { | ||
|
|
||
| private JwtAuthenticationProvider authProvider; | ||
|
|
||
| /** | ||
| * @param options String K/V pair of options to initialize the AuthenticationProvider with. Only | ||
| * one option is currently configurable, the jwkEndpointURI. | ||
| */ | ||
| public DefaultJwtAuthenticationProvider(Map<String, String> options) { | ||
| // Endpoint used to retrieve certificates to validate JWT token | ||
| String jwkEndpointURI = options.get("jwkEndpointURI"); | ||
|
|
||
| // Provide a custom endpoint to retrieve certificates | ||
| authProvider = | ||
| new JwtAuthenticationProvider(NimbusJwtDecoder.withJwkSetUri(jwkEndpointURI).build()); | ||
| authProvider.setJwtAuthenticationConverter(new JwtAuthenticationConverter()); | ||
| } | ||
|
|
||
| /** | ||
| * Authenticate a request based on its Spring Security Authentication object | ||
| * | ||
| * @param authentication Authentication object which contains a JWT to validate | ||
| * @return Returns the same authentication object after authentication | ||
| */ | ||
| @Override | ||
| public Authentication authenticate(Authentication authentication) throws AuthenticationException { | ||
| return authProvider.authenticate(authentication); | ||
| } | ||
|
|
||
| @Override | ||
| public boolean supports(Class<?> aClass) { | ||
| return authProvider.supports(aClass); | ||
| } | ||
| } |
35 changes: 35 additions & 0 deletions
35
core/src/main/java/feast/core/auth/authorization/AuthorizationProvider.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| /* | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * Copyright 2018-2020 The Feast Authors | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * https://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package feast.core.auth.authorization; | ||
|
|
||
| import org.springframework.security.core.Authentication; | ||
|
|
||
| /** | ||
| * AuthorizationProvider is the base interface that each AuthorizationProvider needs to implement in | ||
| * order to authorize requests to Feast Core | ||
| */ | ||
| public interface AuthorizationProvider { | ||
|
|
||
| /** | ||
| * Validates whether a user is allowed access to the project | ||
| * | ||
| * @param project Name of the Feast project | ||
| * @param authentication Spring Security Authentication object | ||
| * @return AuthorizationResult result of authorization query | ||
| */ | ||
| AuthorizationResult checkAccess(String project, Authentication authentication); | ||
| } |
66 changes: 66 additions & 0 deletions
66
core/src/main/java/feast/core/auth/authorization/AuthorizationResult.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| /* | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * Copyright 2018-2020 The Feast Authors | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * https://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package feast.core.auth.authorization; | ||
|
|
||
| import java.util.Optional; | ||
| import javax.annotation.Nullable; | ||
| import lombok.AllArgsConstructor; | ||
| import lombok.Getter; | ||
|
|
||
| /** | ||
| * Implementation of AuthorizationProvider will return AuthorizationResult after validating incoming | ||
| * requests to Feast Core. AuthorizationResult provides methods to check if user is authorized to | ||
| * perform an action or not. | ||
| */ | ||
| @Getter | ||
| @AllArgsConstructor | ||
| public class AuthorizationResult { | ||
|
|
||
| /** | ||
| * Method to create AuthorizationResult Object. | ||
| * | ||
| * @param allowed True If user is authorized, False otherwise. | ||
| * @param failureReason Reason for authorization failure, if any | ||
| * @return AuthorizationResult Object. | ||
| */ | ||
| public static AuthorizationResult create( | ||
| @Nullable boolean allowed, @Nullable String failureReason) { | ||
| return new AuthorizationResult(allowed, Optional.ofNullable(failureReason)); | ||
| } | ||
|
|
||
| /** | ||
| * Method to create failed AuthorizationResult Object. | ||
| * | ||
| * @param failureReason Reason for authorization failure, if any or Null | ||
| * @return AuthorizationResult Object. | ||
| */ | ||
| public static AuthorizationResult failed(@Nullable String failureReason) { | ||
| return new AuthorizationResult(false, Optional.ofNullable(failureReason)); | ||
| } | ||
|
|
||
| /** | ||
| * Method to create Success AuthorizationResult Object. | ||
| * | ||
| * @return AuthorizationResult Object. | ||
| */ | ||
| public static AuthorizationResult success() { | ||
| return new AuthorizationResult(true, Optional.empty()); | ||
| } | ||
|
|
||
| private boolean allowed; | ||
| private Optional<String> failureReason; | ||
| } |
Oops, something went wrong.