IGNITE-9560

[dgarus]

No description provided.

[yzhdanov]

Guys,

I have looked through the PR and left couple of comments through the code. Please take a look.

The biggest issue for me was to understand logic behind classes hierarchy and relationships between IgniteSecurity, GridSecurityProcessor, IgniteSecurityProcessor, etc. It is still unclear for me. I would appreciate if someone creates a wiki page with design description. Then I take a look once again.

One more question - do we really need "withContext()" notation? Is that true that we never need to call withContext() several times wrapping and unwrapping the context multiple times? If yes and we do it only once on message processing start then logic behind wrapping and unwrapping can be simplified a lot. Do you agree?

Also note that adding 16 bytes field to IO message may affect performance for cases when security is off. Please suggest another solution.

There are also several comments from Nikolay Izhikov still unresolved. Please address all of them.

Please also review English in javadocs.

[yzhdanov]

Why not extending ProcessorAdapter?

[dgarus]

IgniteSecurityProcessor delegates all methods of GridProcessor to inner GridSecurityProcessor.
Adapter as a parent usage may lead to a situation when some delegation broke (no-op implementation from adapter used).

[dgarus]

@yzhdanov hello!
Answers for questions:

1. The biggest issue for me was to understand logic behind classes hierarchy and
   relationships between IgniteSecurity, GridSecurityProcessor, IgniteSecurityProcessor, etc.

Answer:
IgniteSecurity is an interface that AI is used to authorize operations.
Developers can obtain IgniteSecurity through GridKernalContext#security method.

There are two implementations of IgniteSecurity:

• NoOpIgniteSecurityProcessor - is used when security is in disabled mode.
• IgniteSecurityProcessor - is used when security is enabled.
  IgniteSecurityProcessor gets an instance of GridSecurityProcessor while constructing and delegate it performing of authorizing operations.

Which GridSecurityProcessor should be used is defined through plugin as it was earlier.

2. do we really need "withContext()" notation?
   Is that true that we never need to call withContext() several times wrapping and unwrapping the context multiple times?

Answer: That's not true, regular case is to start processing with the node's context,
then switch to request's context or listener creator's context, and then restore the node's context.
Seems, also possible case is to call withContext() inside another withContext() when you have user1's task causes user2's task,
but, currently we had no such feature at Ignite as far as I know.