-
-
Notifications
You must be signed in to change notification settings - Fork 147
BE: RBAC: Impl default role #1056
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi seono! 👋
Welcome, and thank you for opening your first PR in the repo!
Please wait for triaging by our maintainers.
Please take a look at our contributing guide.
- add test code and comment
# Conflicts: # api/src/main/java/io/kafbat/ui/service/rbac/AccessControlService.java
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi, thanks for PR!
Please check my comments.
api/src/main/java/io/kafbat/ui/config/auth/RoleBasedAccessControlProperties.java
Outdated
Show resolved
Hide resolved
api/src/main/java/io/kafbat/ui/service/rbac/AccessControlService.java
Outdated
Show resolved
Hide resolved
api/src/main/java/io/kafbat/ui/service/rbac/AccessControlService.java
Outdated
Show resolved
Hide resolved
api/src/main/java/io/kafbat/ui/service/rbac/AccessControlService.java
Outdated
Show resolved
Hide resolved
api/src/main/java/io/kafbat/ui/service/rbac/extractor/CognitoAuthorityExtractor.java
Outdated
Show resolved
Hide resolved
api/src/main/java/io/kafbat/ui/service/rbac/extractor/OauthAuthorityExtractor.java
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@germanosin
Thanks for the review.
I applied the following updates:
- use jakarta
- remove changes from extractors
- add DefaultRole class.
- let DefaultRole need cluster definition
I updated the code to work with the RBAC definition below.
...
rbac:
default-role:
name: read-only
clusters:
- dev-cluster
permissions:
- resource: clusterconfig
actions: [ "view" ]
- resource: topic
value: ".*"
actions:
- VIEW
- MESSAGES_READ
- resource: consumer
value: ".*"
actions: [ view ]
- resource: schema
value: ".*"
actions: [ view ]
- resource: connect
value: ".*"
actions: [ view ]
- resource: acl
actions: [ view ]
roles:
- name: admin
clusters:
- dev-cluster
- prod-cluster
subjects:
- provider: oauth_github
type: user
value: "seono"
...
I’ve opened a draft PR. If this approach looks okay, I’ll follow up with tests and documentation.
What changes did you make? (Give an overview)
Implement default role
#344
Is there anything you'd like reviewers to focus on?
I updated each extractor’s extract method to return the defaultRole if it’s present, but I’m not sure if this aligns with the original intention of how extract is supposed to be used.
I tested it using the configuration below
How Has This Been Tested? (put an "x" (case-sensitive!) next to an item)
Checklist (put an "x" (case-sensitive!) next to all the items, otherwise the build will fail)
Check out Contributing and Code of Conduct
A picture of a cute animal (not mandatory but encouraged)