Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

KNOX-2788 - Implementing EmptyVerifier and Cleaning background thread #620

Merged
merged 9 commits into from Aug 22, 2022

Conversation

MrtnBalazs
Copy link
Contributor

What changes were proposed in this pull request?

I added an empty implementation of the ConcurrentSessionVerifier (EmptyConcurrentSessionVerifier), now it is the default so users do not waste resources when they forget to configure the verifier. If they need the InMemoryConcurrentSessionVerifier implementation they need to configure it and pay attention to configure at least one user in at least one of the groups.
For example:

<property>
        <name>gateway.privileged.users</name>
        <value>admin</value>
</property>
<property>
        <name>gateway.service.concurrentsessionverifier.impl</name>
        <value>org.apache.knox.gateway.session.control.InMemoryConcurrentSessionVerifier</value>
</property>

I also added a background thread which cleans out the expired tokens from the InMemoryConcurrentSessionVerifier to save some resources. The default cleaning time is 30 minutes, but it can be configured by adding how many minutes we want the cleaning period to be:

<property>
        <name>gateway.session.verification.expired.tokens.cleaning.period</name>
        <value>80</value>
</property>
<property>
        <name>gateway.privileged.users</name>
        <value>admin</value>
</property>
<property>
        <name>gateway.service.concurrentsessionverifier.impl</name>
        <value>org.apache.knox.gateway.session.control.InMemoryConcurrentSessionVerifier</value>
</property>

How was this patch tested?

I have written unit tests for the ConcurrentSessionVeriferFactory to test that the factory gives back the right implementation for the right configuration.
I also added a unit test into InMemoryConcurrentSessionVerifierTest to test the background thread removing the expired tokens.
I also added stress tests to InMemoryConcurrentSessionVerifierTest to test whether the locking is working and the InMemoryConcurrentSessionVerifier is truly thread safe.

I also tested the behaviour with the following configurations:

  1. Nothing
  2. Empty String
<property>
        <name>gateway.service.concurrentsessionverifier.impl</name>
        <value></value>
</property>
  1. Empty implementation
<property>
        <name>gateway.service.concurrentsessionverifier.impl</name>
        <value>org.apache.knox.gateway.session.control.EmptyConcurrentSessionVerifier</value>
</property>
  1. InMemory implementation without groups configured
<property>
        <name>gateway.service.concurrentsessionverifier.impl</name>
        <value>org.apache.knox.gateway.session.control.InMemoryConcurrentSessionVerifier</value>
</property>
  1. InMemory fully configured
<property>
        <name>gateway.non.privileged.users</name>
        <value>tom,guest</value>
</property>
<property>
        <name>gateway.privileged.users</name>
        <value>admin</value>
</property>
<property>
        <name>gateway.privileged.users.concurrent.session.limit</name>
        <value>2</value>
</property>
<property>
        <name>gateway.non.privileged.users.concurrent.session.limit</name>
        <value>1</value>
</property>
<property>
        <name>gateway.session.verification.expired.tokens.cleaning.period</name>
        <value>80</value>
</property>
<property>
        <name>gateway.service.concurrentsessionverifier.impl</name>
        <value>org.apache.knox.gateway.session.control.InMemoryConcurrentSessionVerifier</value>
</property>

@MrtnBalazs
Copy link
Contributor Author

@zeroflag @smolnar82

Copy link
Contributor

@smolnar82 smolnar82 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@smolnar82 smolnar82 changed the title Knox 2788 - Implementing EmptyVerifier and Cleaning background thread KNOX-2788 - Implementing EmptyVerifier and Cleaning background thread Aug 22, 2022
@smolnar82 smolnar82 merged commit 6601240 into apache:master Aug 22, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
3 participants