ISPN-5790 AuthorizationManager rework #3726

tristantarrant · 2015-09-24T15:35:37Z

https://issues.jboss.org/browse/ISPN-5790

use an internal cache instead of the Cluster Registry
add a GlobalSecurityManager with the ability to flush acl caches
don't cache per-cache acl masks
add a role check in addition to the existing permission check

pruivo · 2015-10-06T10:26:22Z

core/src/main/java/org/infinispan/security/impl/AuthorizationHelper.java

         }
+         int permissionMask = requiredPermission.getMask();
+         return (subjectMask & permissionMask) == permissionMask && requestedRole.map(r -> subjectACL.roles.contains(r)).orElse(true);


nitpick: lambda could be replaced by subjectACL.roles::contains

tristantarrant · 2015-10-08T07:54:19Z

I have made some further changes:

the ACL cache is disabled if the global securityCacheTimeout is set to 0 (as per discussion with @Sanne yesterday on IRC) for cases where users need real-time enforcement of user permissions changes. The global security mbean has an MBean op to flush the ACL cache manually.
the key in the ACL cache is now a combination of cache and the Subject's user principal
the ACL mask for a subject is precomputed and cached
The ACL cache is a "simple cache", since it is local-only

pruivo · 2015-10-08T10:16:54Z

some nitpick about GlobalSecurityManagerImpl:

you could use a ConcurrentHashMap when expiration is not needed.
Instead of storing the CacheManager and a boolean, you can store the reference to the map.

pruivo · 2015-10-08T10:20:24Z

core/src/main/java/org/infinispan/security/impl/CachePrincipalPair.java

+   private int computeHashCode() {
+      final int prime = 31;
+      int result = 1;
+      result = prime * result + ((cacheName == null) ? 0 : cacheName.hashCode());


can the cacheName or the principalName be null?

That is an interesting question, but I guess not a big deal either way.

Sanne · 2015-10-08T10:36:58Z

A cache based on the Principals's name is only effective if you assume there is a limited number of principals accessing, otherwise you're risking to store a lot of data for no good reason - and probably still have a low hit rate.
I think that's another good reason to keep the ACL cache disabled by default.

tristantarrant · 2015-10-08T10:48:54Z

@Sanne not really if we assume that a principal will perform operations on the cache in bursts: you want to cache the ACL on the first op so that subsequent ops can reuse it. Set a low expiration for this case.
Another case where the ACL cache is an advantage is when principals are used to coarsely identify applications and not nominal users. So few principals, lots of repeated access.

tristantarrant · 2015-10-08T10:50:01Z

@Sanne I see the use-case of lots of individual principals less practical / useful in the real world.

tristantarrant · 2015-10-12T15:01:41Z

@pruivo Regarding the GlobalSecurityManagerImpl nitpicks:
Unfortunately I cannot retrieve the cache in the @Inject, since it may not be available yet at that stage. That is why I have that "cacheEnabled" boolean (which, I agree, is not very nice).

danberindei · 2015-10-29T15:16:26Z

core/src/main/java/org/infinispan/registry/InternalCacheRegistry.java

+   /**
+    * Removes the internal caches from the specified set of cache names
+    */
+   void filterPrivateCaches(Set<String> names);


Why the name change? The javadoc still mentions internal caches...

The javadoc is wrong and the actual implementation was filtering the private caches :) I'll fix this

tristantarrant · 2015-10-29T16:48:59Z

@danberindei ready to go !

tristantarrant · 2015-10-29T18:34:24Z

@danberindei repushed :)

wburns · 2015-10-29T18:36:19Z

...c/main/java/org/infinispan/configuration/global/GlobalSecurityConfigurationChildBuilder.java

@@ -12,7 +12,8 @@
    */
   GlobalAuthorizationConfigurationBuilder authorization();
   /**
-    * Defines the timeout in milliseconds for which to cache user access roles
+    * Defines the timeout in milliseconds for which to cache user access roles. A value of -1 means the entries


I know this might be too late now. But was there a reason we forced this to be milliseconds and didn't just do the new common method of passing a long and a TimeUnit?

Fixed it. Added a new method and deprecated the old one

wburns · 2015-10-29T18:45:41Z

core/src/main/java/org/infinispan/security/impl/AuthorizationHelper.java

+   private SubjectACL computeSubjectACL(Subject subject, AuthorizationConfiguration configuration) {
+      PrincipalRoleMapper roleMapper = globalConfiguration.authorization().principalRoleMapper();
+      Set<Principal> principals = subject.getPrincipals();
+      Set<String> allRoles = new HashSet<>(principals.size());


Couldn't there be a lot more roles than # of principals? How many principals would a subject have normally? I wonder if we just use the default constructor which sizes the array to 16 might be better?

I would say that maybe not all principals would map to a role. The case where a principal might map to multiple roles is unlikely in my experience.

wburns · 2015-10-29T18:57:43Z

Just some minor things, otherwise looks good 👍

tristantarrant · 2015-10-29T19:55:21Z

@wburns I addressed your comments (unless where noted)

danberindei · 2015-11-02T09:14:50Z

@tristantarrant more test failures...

tristantarrant · 2015-11-02T09:19:42Z

@danberindei only one test failure is security related, but it's to do with JGroups SASL authentication, so not connected to this PR.

- use an internal cache instead of the Cluster Registry - add a GlobalSecurityManager with the ability to flush acl caches - don't cache per-cache acl masks - add a role check in addition to the existing permission check

danberindei · 2015-11-02T13:07:45Z

Integrated at long last! Thanks Tristan!

tristantarrant added the Ready for Review label Sep 24, 2015

tristantarrant added this to the 8.1.0.Alpha2 milestone Sep 24, 2015

pruivo reviewed Oct 6, 2015
View reviewed changes

pruivo added Changes Suggested Changes Required and removed Ready for Review labels Oct 6, 2015

tristantarrant force-pushed the ISPN-5790/authz_manager_rework branch from 4b92575 to e310c8e Compare October 8, 2015 07:47

tristantarrant added Ready for Review and removed Changes Required Changes Suggested labels Oct 8, 2015

tristantarrant force-pushed the ISPN-5790/authz_manager_rework branch from e310c8e to 84ed93f Compare October 8, 2015 08:22

pruivo reviewed Oct 8, 2015
View reviewed changes

pruivo added Changes Suggested Question labels Oct 9, 2015

tristantarrant force-pushed the ISPN-5790/authz_manager_rework branch 2 times, most recently from 754d61e to e6e534f Compare October 12, 2015 15:01

danberindei reviewed Oct 29, 2015
View reviewed changes

tristantarrant force-pushed the ISPN-5790/authz_manager_rework branch 2 times, most recently from 24525ca to eca499d Compare October 29, 2015 16:41

danberindei added Changes Suggested and removed Ready for Review labels Oct 29, 2015

tristantarrant added Ready for Review and removed Changes Suggested labels Oct 29, 2015

tristantarrant force-pushed the ISPN-5790/authz_manager_rework branch from eca499d to 33204d6 Compare October 29, 2015 18:33

wburns reviewed Oct 29, 2015
View reviewed changes

tristantarrant force-pushed the ISPN-5790/authz_manager_rework branch from 33204d6 to c37756d Compare October 29, 2015 18:43

wburns reviewed Oct 29, 2015
View reviewed changes

tristantarrant force-pushed the ISPN-5790/authz_manager_rework branch from c37756d to d597935 Compare October 29, 2015 19:53

danberindei added Changes Required and removed Ready for Review labels Nov 2, 2015

ISPN-5790 AuthorizationManager rework

32bf1df

- use an internal cache instead of the Cluster Registry - add a GlobalSecurityManager with the ability to flush acl caches - don't cache per-cache acl masks - add a role check in addition to the existing permission check

tristantarrant force-pushed the ISPN-5790/authz_manager_rework branch from d597935 to 32bf1df Compare November 2, 2015 12:54

danberindei closed this Nov 2, 2015

tristantarrant deleted the ISPN-5790/authz_manager_rework branch November 5, 2015 19:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ISPN-5790 AuthorizationManager rework #3726

ISPN-5790 AuthorizationManager rework #3726

tristantarrant commented Sep 24, 2015

pruivo Oct 6, 2015

tristantarrant commented Oct 8, 2015

pruivo commented Oct 8, 2015

pruivo Oct 8, 2015

wburns Oct 29, 2015

Sanne commented Oct 8, 2015

tristantarrant commented Oct 8, 2015

tristantarrant commented Oct 8, 2015

tristantarrant commented Oct 12, 2015

danberindei Oct 29, 2015

tristantarrant Oct 29, 2015

tristantarrant commented Oct 29, 2015

tristantarrant commented Oct 29, 2015

wburns Oct 29, 2015

tristantarrant Oct 29, 2015

wburns Oct 29, 2015

tristantarrant Oct 29, 2015

wburns commented Oct 29, 2015

tristantarrant commented Oct 29, 2015

danberindei commented Nov 2, 2015

tristantarrant commented Nov 2, 2015

danberindei commented Nov 2, 2015

ISPN-5790 AuthorizationManager rework #3726

ISPN-5790 AuthorizationManager rework #3726

Conversation

tristantarrant commented Sep 24, 2015

Choose a reason for hiding this comment

tristantarrant commented Oct 8, 2015

pruivo commented Oct 8, 2015

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Sanne commented Oct 8, 2015

tristantarrant commented Oct 8, 2015

tristantarrant commented Oct 8, 2015

tristantarrant commented Oct 12, 2015

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tristantarrant commented Oct 29, 2015

tristantarrant commented Oct 29, 2015

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wburns commented Oct 29, 2015

tristantarrant commented Oct 29, 2015

danberindei commented Nov 2, 2015

tristantarrant commented Nov 2, 2015

danberindei commented Nov 2, 2015