Package org.apache.cassandra.auth

Class CassandraRoleManager

java.lang.Object
org.apache.cassandra.auth.CassandraRoleManager
All Implemented Interfaces:
AuthCache.BulkLoader<RoleResource,Set<Role>>, IRoleManager
public class CassandraRoleManager extends Object implements IRoleManager
Responsible for the creation, maintenance and deletion of roles for the purposes of authentication and authorization. Role data is stored internally, using the roles and role_members tables in the system_auth keyspace. Additionally, if org.apache.cassandra.auth.PasswordAuthenticator is used, encrypted passwords are also stored in the system_auth.roles table. This coupling between the IAuthenticator and IRoleManager implementations exists because setting a role's password via CQL is done with a CREATE ROLE or ALTER ROLE statement, the processing of which is handled by IRoleManager. As IAuthenticator is concerned only with credentials checking and has no means to modify passwords, PasswordAuthenticator depends on CassandraRoleManager for those functions. Alternative IAuthenticator implementations may be used in conjunction with CassandraRoleManager, but WITH PASSWORD = 'password' will not be supported in CREATE/ALTER ROLE statements. Such a configuration could be implemented using a custom IRoleManager that extends CassandraRoleManager and which includes Option.PASSWORD in the Set<Option> returned from supportedOptions/alterableOptions. Any additional processing of the password itself (such as storing it in an alternative location) would be added in overridden createRole and alterRole implementations.

  • Field Details

  • Constructor Details

    • CassandraRoleManager

      public CassandraRoleManager()

  • Method Details

    • updatePasswordUpdateMinInterval

      public static void updatePasswordUpdateMinInterval(int newInterval)

    • setup

      public void setup()
      Description copied from interface: IRoleManager
      Hook to perform implementation specific initialization, called once upon system startup. For example, use this method to create any required keyspaces/column families.
      Specified by:
      setup in interface IRoleManager

    • roleForIdentity

      public String roleForIdentity(String identity)
      Description copied from interface: IRoleManager
      Each valid identity is associated with a role in the identity_to_role table, this method returns role of a given identity
      Specified by:
      roleForIdentity in interface IRoleManager
      Parameters:
      identity - identity whose role to be retrieved
      Returns:
      role of the given identity

    • authorizedIdentities

      public Map<String,String> authorizedIdentities()
      Description copied from interface: IRoleManager
      Returns all the authorized identities from the identity_to_role table
      Specified by:
      authorizedIdentities in interface IRoleManager
      Returns:
      Map of identity -> roles

    • addIdentity

      public void addIdentity(String identity, String role)
      Description copied from interface: IRoleManager
      Adds a row (identity, role) to the identity_to_role table
      Specified by:
      addIdentity in interface IRoleManager
      Parameters:
      identity - identity to be added
      role - role that is associated with the identity

    • isExistingIdentity

      public boolean isExistingIdentity(String identity)
      Description copied from interface: IRoleManager
      Returns if an identity exists in the identity_to_role
      Specified by:
      isExistingIdentity in interface IRoleManager
      Parameters:
      identity - identity whose existence to verify
      Returns:

    • dropIdentity

      public void dropIdentity(String identity)
      Description copied from interface: IRoleManager
      Called on the execution of DROP IDENTITY statement for removing a given identity from the identity_role table. This implies we want to revoke the access for the given identity.
      Specified by:
      dropIdentity in interface IRoleManager
      Parameters:
      identity - identity that has to be removed from the table

    • loadRoleStatement

      protected final void loadRoleStatement()

    • loadIdentityStatement

      protected void loadIdentityStatement()

    • supportedOptions

      public Set<IRoleManager.Option> supportedOptions()
      Description copied from interface: IRoleManager
      Set of options supported by CREATE ROLE and ALTER ROLE queries. Should never return null - always return an empty set instead.
      Specified by:
      supportedOptions in interface IRoleManager

    • alterableOptions

      public Set<IRoleManager.Option> alterableOptions()
      Description copied from interface: IRoleManager
      Subset of supportedOptions that users are allowed to alter when performing ALTER ROLE [themselves]. Should never return null - always return an empty set instead.
      Specified by:
      alterableOptions in interface IRoleManager

    • createRole

      public void createRole(AuthenticatedUser performer, RoleResource role, RoleOptions options) throws RequestValidationException, RequestExecutionException
      Description copied from interface: IRoleManager
      Called during execution of a CREATE ROLE statement. options are guaranteed to be a subset of supportedOptions().
      Specified by:
      createRole in interface IRoleManager
      Parameters:
      performer - User issuing the create role statement.
      role - Rolei being created
      options - Options the role will be created with
      Throws:
      RequestValidationException
      RequestExecutionException

    • dropRole

      public void dropRole(AuthenticatedUser performer, RoleResource role) throws RequestValidationException, RequestExecutionException
      Description copied from interface: IRoleManager
      Called during execution of DROP ROLE statement, as well we removing any main record of the role from the system this implies that we want to revoke this role from all other roles that it has been granted to.
      Specified by:
      dropRole in interface IRoleManager
      Parameters:
      performer - User issuing the drop role statement.
      role - Role to be dropped.
      Throws:
      RequestValidationException
      RequestExecutionException

    • alterRole

      public void alterRole(AuthenticatedUser performer, RoleResource role, RoleOptions options)
      Description copied from interface: IRoleManager
      Called during execution of ALTER ROLE statement. options are always guaranteed to be a subset of supportedOptions(). Furthermore, if the actor performing the query is not a superuser and is altering themself, then options are guaranteed to be a subset of alterableOptions(). Keep the body of the method blank if your implementation doesn't support modification of any options.
      Specified by:
      alterRole in interface IRoleManager
      Parameters:
      performer - User issuing the alter role statement.
      role - Role that will be altered.
      options - Options to alter.

    • grantRole

      public void grantRole(AuthenticatedUser performer, RoleResource role, RoleResource grantee) throws RequestValidationException, RequestExecutionException
      Description copied from interface: IRoleManager
      Called during execution of GRANT ROLE query. Grant an role to another existing role. A grantee that has a role granted to it will inherit any permissions of the granted role.
      Specified by:
      grantRole in interface IRoleManager
      Parameters:
      performer - User issuing the grant statement.
      role - Role to be granted to the grantee.
      grantee - Role acting as the grantee.
      Throws:
      RequestValidationException
      RequestExecutionException

    • revokeRole

      public void revokeRole(AuthenticatedUser performer, RoleResource role, RoleResource revokee) throws RequestValidationException, RequestExecutionException
      Description copied from interface: IRoleManager
      Called during the execution of a REVOKE ROLE query. Revoke an granted role from an existing role. The revokee will lose any permissions inherited from the role being revoked.
      Specified by:
      revokeRole in interface IRoleManager
      Parameters:
      performer - User issuing the revoke statement.
      role - Role to be revoked.
      revokee - Role from which the granted role is to be revoked.
      Throws:
      RequestValidationException
      RequestExecutionException

    • getRoles

      public Set<RoleResource> getRoles(RoleResource grantee, boolean includeInherited) throws RequestValidationException, RequestExecutionException
      Description copied from interface: IRoleManager
      Called during execution of a LIST ROLES query. Returns a set of roles that have been granted to the grantee using GRANT ROLE.
      Specified by:
      getRoles in interface IRoleManager
      Parameters:
      grantee - Role whose granted roles will be listed.
      includeInherited - if True will list inherited roles as well as those directly granted to the grantee.
      Returns:
      A list containing the granted roles for the user.
      Throws:
      RequestValidationException
      RequestExecutionException

    • getRoleDetails

      public Set<Role> getRoleDetails(RoleResource grantee)
      Description copied from interface: IRoleManager
      Used to retrieve detailed role info on the full set of roles granted to a grantee. This method was not part of the V1 IRoleManager API, so a default impl is supplied which uses the V1 methods to retrieve the detailed role info for the grantee. This is essentially what clients of this interface would have to do themselves. Implementations can provide optimized versions of this method where the details can be retrieved more efficiently.
      Specified by:
      getRoleDetails in interface IRoleManager
      Parameters:
      grantee - identifies the role whose granted roles are retrieved
      Returns:
      A set of Role objects detailing the roles granted to the grantee, either directly or through inheritance.

    • getAllRoles

      public Set<RoleResource> getAllRoles() throws RequestValidationException, RequestExecutionException
      We hard-code this query to Quorum regardless of the role or auth credentials of the queryer given the nature of this query: we expect to know *all* roles across the entire cluster when we query this, not just local quorum or on a single node.
      Specified by:
      getAllRoles in interface IRoleManager
      Returns:
      the set of all roles in the system.
      Throws:
      RequestValidationException
      RequestExecutionException

    • isSuper

      public boolean isSuper(RoleResource role)
      Description copied from interface: IRoleManager
      Return true if there exists a Role with the given name that also has superuser status. Superuser status may be inherited from another granted role, so this method should return true if either the named Role, or any other Role it is transitively granted has superuser status.
      Specified by:
      isSuper in interface IRoleManager
      Parameters:
      role - Role whose superuser status to verify
      Returns:
      true if the role exists and has superuser status, either directly or transitively, otherwise false.

    • canLogin

      public boolean canLogin(RoleResource role)
      Description copied from interface: IRoleManager
      Return true if there exists a Role with the given name which has login privileges. Such privileges is not inherited from other granted Roles and so must be directly granted to the named Role with the LOGIN option of CREATE ROLE or ALTER ROLE
      Specified by:
      canLogin in interface IRoleManager
      Parameters:
      role - Role whose login privileges to verify
      Returns:
      true if the role exists and is permitted to login, otherwise false

    • getCustomOptions

      public Map<String,String> getCustomOptions(RoleResource role)
      Description copied from interface: IRoleManager
      Where an implementation supports OPTIONS in CREATE and ALTER operations this method should return the Map<String, String> representing the custom options associated with the role, as supplied to CREATE or ALTER. It should never return null; if the implementation does not support OPTIONS or if none were supplied then it should return an empty map.
      Specified by:
      getCustomOptions in interface IRoleManager
      Parameters:
      role - Role whose custom options are required
      Returns:
      Key/Value pairs representing the custom options for the Role

    • isExistingRole

      public boolean isExistingRole(RoleResource role)
      Description copied from interface: IRoleManager
      Return true is a Role with the given name exists in the system.
      Specified by:
      isExistingRole in interface IRoleManager
      Parameters:
      role - Role whose existence to verify
      Returns:
      true if the name identifies an extant Role in the system, otherwise false

    • protectedResources

      public Set<? extends IResource> protectedResources()
      Description copied from interface: IRoleManager
      Set of resources that should be made inaccessible to users and only accessible internally.
      Specified by:
      protectedResources in interface IRoleManager
      Returns:
      Keyspaces and column families that will be unmodifiable by users; other resources.

    • validateConfiguration

      public void validateConfiguration() throws ConfigurationException
      Description copied from interface: IRoleManager
      Hook to perform validation of an implementation's configuration (if supported).
      Specified by:
      validateConfiguration in interface IRoleManager
      Throws:
      ConfigurationException

    • createDefaultRoleQuery

      public static String createDefaultRoleQuery()

    • hasExistingRoles

      public static boolean hasExistingRoles() throws RequestExecutionException
      Throws:
      RequestExecutionException

    • scheduleSetupTask

      protected void scheduleSetupTask(Callable<Void> setupTask)

    • consistencyForRole

      protected static ConsistencyLevel consistencyForRole(String role)

    • consistencyForRoleWrite

      protected static ConsistencyLevel consistencyForRoleWrite(String role)
      Allows selective overriding of the consistency level for specific roles.

    • consistencyForRoleRead

      protected static ConsistencyLevel consistencyForRoleRead(String role)

    • bulkLoader

      public Supplier<Map<RoleResource,Set<Role>>> bulkLoader()
      Specified by:
      bulkLoader in interface AuthCache.BulkLoader<RoleResource,Set<Role>>