CASSSIDECAR-407 Pluggable withCredentials provider for file access #318
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,64 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one | ||
| * or more contributor license agreements. See the NOTICE file | ||
| * distributed with this work for additional information | ||
| * regarding copyright ownership. The ASF licenses this file | ||
| * to you under the Apache License, Version 2.0 (the | ||
| * "License"); you may not use this file except in compliance | ||
| * with the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package org.apache.cassandra.sidecar.cluster.auth; | ||
|
|
||
| import java.util.Map; | ||
| import java.util.Objects; | ||
|
|
||
| import org.apache.cassandra.sidecar.exceptions.ConfigurationException; | ||
|
|
||
| /** | ||
| * Loads CQL username/password directly from auth_provider parameters. | ||
| */ | ||
| public class ConfigProvider implements CqlAuthProvider | ||
| { | ||
| static final String USERNAME_PARAM = "username"; | ||
| static final String PASSWORD_PARAM = "password"; | ||
|
|
||
| private final String username; | ||
| private final String password; | ||
|
|
||
| public ConfigProvider(Map<String, String> parameters) | ||
| { | ||
| Objects.requireNonNull(parameters, "parameters must not be null"); | ||
| this.username = requiredParameter(parameters, USERNAME_PARAM); | ||
| this.password = requiredParameter(parameters, PASSWORD_PARAM); | ||
| } | ||
|
|
||
| private static String requiredParameter(Map<String, String> parameters, String key) | ||
| { | ||
| if (!parameters.containsKey(key)) | ||
| { | ||
| throw new ConfigurationException("Missing required auth_provider parameter \"" + key + "\""); | ||
| } | ||
| return parameters.get(key); | ||
| } | ||
|
|
||
| @Override | ||
| public String username() | ||
| { | ||
| return username; | ||
| } | ||
|
|
||
| @Override | ||
| public String password() | ||
| { | ||
| return password; | ||
| } | ||
|
yifan-c marked this conversation as resolved.
|
||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one | ||
| * or more contributor license agreements. See the NOTICE file | ||
| * distributed with this work for additional information | ||
| * regarding copyright ownership. The ASF licenses this file | ||
| * to you under the Apache License, Version 2.0 (the | ||
| * "License"); you may not use this file except in compliance | ||
| * with the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package org.apache.cassandra.sidecar.cluster.auth; | ||
|
|
||
| /** | ||
| * Provides authentication details used by Sidecar's internal Cassandra CQL client. | ||
| */ | ||
| public interface CqlAuthProvider | ||
| { | ||
| /** | ||
| * @return username for the CQL connection | ||
| */ | ||
| String username(); | ||
|
|
||
| /** | ||
| * @return password for the CQL connection | ||
| */ | ||
| String password(); | ||
|
yifan-c marked this conversation as resolved.
|
||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one | ||
| * or more contributor license agreements. See the NOTICE file | ||
| * distributed with this work for additional information | ||
| * regarding copyright ownership. The ASF licenses this file | ||
| * to you under the Apache License, Version 2.0 (the | ||
| * "License"); you may not use this file except in compliance | ||
| * with the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package org.apache.cassandra.sidecar.cluster.auth; | ||
|
|
||
| import java.io.IOException; | ||
| import java.nio.file.Files; | ||
| import java.nio.file.InvalidPathException; | ||
| import java.nio.file.Path; | ||
| import java.nio.file.Paths; | ||
| import java.util.Map; | ||
| import java.util.Objects; | ||
|
|
||
| import org.apache.cassandra.sidecar.exceptions.ConfigurationException; | ||
|
|
||
| /** | ||
| * Loads CQL username/password from files. | ||
| */ | ||
| public class FileProvider implements CqlAuthProvider | ||
| { | ||
| static final String USERNAME_PATH_PARAM = "username_path"; | ||
| static final String PASSWORD_PATH_PARAM = "password_path"; | ||
|
|
||
| private final Path usernamePath; | ||
| private final Path passwordPath; | ||
|
|
||
| public FileProvider(Map<String, String> parameters) | ||
| { | ||
| Objects.requireNonNull(parameters, "parameters must not be null"); | ||
| this.usernamePath = resolvePath(parameters, USERNAME_PATH_PARAM); | ||
| this.passwordPath = resolvePath(parameters, PASSWORD_PATH_PARAM); | ||
| } | ||
|
|
||
| private static Path resolvePath(Map<String, String> parameters, String key) | ||
| { | ||
| if (!parameters.containsKey(key)) | ||
| { | ||
| throw new ConfigurationException("Missing required auth_provider parameter \"" + key + "\""); | ||
| } | ||
|
|
||
| try | ||
| { | ||
| return Paths.get(parameters.get(key)); | ||
| } | ||
| catch (InvalidPathException e) | ||
| { | ||
| throw new ConfigurationException("Invalid path in auth_provider parameter \"" + key + "\"", e); | ||
| } | ||
| } | ||
|
|
||
| private static String readSecret(Path path, String key) | ||
| { | ||
| try | ||
| { | ||
| String secret = Files.readString(path).trim(); | ||
| if (secret.isEmpty()) | ||
| { | ||
| throw new ConfigurationException("Empty content in auth_provider file for parameter \"" + key + "\""); | ||
| } | ||
| return secret; | ||
| } | ||
| catch (IOException e) | ||
| { | ||
| throw new ConfigurationException("Unable to read auth_provider file for parameter \"" + key + "\"", e); | ||
| } | ||
| } | ||
|
|
||
| @Override | ||
| public String username() | ||
| { | ||
| return readSecret(usernamePath, USERNAME_PATH_PARAM); | ||
| } | ||
|
|
||
| @Override | ||
| public String password() | ||
| { | ||
| return readSecret(passwordPath, PASSWORD_PATH_PARAM); | ||
| } | ||
|
Comment on lines
+84
to
+93
Contributor
There was a problem hiding this comment. It reads from the file every single time per call. Do you expect the username/password to change? And the indentation is wrong.
Author
There was a problem hiding this comment. I'd expect the password/username to be modifiable, yes. Same as with TLS secrets. But if you want, I can modify this to be read-once and need to restart sidecar for changes. Why isn't there automated test for the indentations and a formatter?
Contributor
There was a problem hiding this comment. There is an "opinionated" guide on setting up the project in IntellJ (https://github.com/apache/cassandra-sidecar/blob/trunk/CONTRIBUTING.md#integration-with-intellij-idea). It should take care of the indentation.
Contributor
There was a problem hiding this comment.
ok. I guess it is for the scenarios such as password rotation. |
||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
tiny NIT:
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This would cause NPE if the username/password is null, which is acceptable (and something the tests do). Map.of requires non-null for all values.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
good catch!