FalconAuthorizationFilter.java

/**
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.apache.falcon.security;

import org.apache.falcon.FalconException;
import org.apache.falcon.entity.EntityNotRegisteredException;
import org.apache.falcon.entity.EntityUtil;
import org.apache.falcon.entity.v0.Entity;
import org.apache.falcon.entity.v0.EntityType;
import org.apache.falcon.util.Servlets;
import org.apache.hadoop.security.UserGroupInformation;
import org.apache.hadoop.security.authorize.AuthorizationException;
import org.codehaus.jettison.json.JSONException;
import org.codehaus.jettison.json.JSONObject;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.ws.rs.HttpMethod;
import javax.ws.rs.core.MediaType;
import java.io.IOException;

/**
 * This enforces authorization as part of the filter before processing the request.
 */
public class FalconAuthorizationFilter implements Filter {

    private static final Logger LOG = LoggerFactory.getLogger(FalconAuthorizationFilter.class);
    private static final String DO_AS_PARAM = "doAs";

    private boolean isAuthorizationEnabled;
    private AuthorizationProvider authorizationProvider;

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        try {
            isAuthorizationEnabled = SecurityUtil.isAuthorizationEnabled();
            if (isAuthorizationEnabled) {
                LOG.info("Falcon is running with authorization enabled");
            }

            authorizationProvider = SecurityUtil.getAuthorizationProvider();
        } catch (FalconException e) {
            throw new ServletException(e);
        }
    }

    @Override
    public void doFilter(ServletRequest request,
                         ServletResponse response,
                         FilterChain filterChain) throws IOException, ServletException {
        if (isAuthorizationEnabled) {
            HttpServletRequest httpRequest = (HttpServletRequest) request;
            RequestParts requestParts = getUserRequest(httpRequest);
            LOG.info("Authorizing user={} against request={}", CurrentUser.getUser(), requestParts);

            try {
                final UserGroupInformation authenticatedUGI = CurrentUser.getAuthenticatedUGI();
                authorizationProvider.authorizeResource(requestParts.getResource(),
                        requestParts.getAction(), requestParts.getEntityType(),
                        requestParts.getEntityName(), authenticatedUGI);
                String doAsUser = request.getParameter(DO_AS_PARAM);
                tryProxy(authenticatedUGI,
                    requestParts.getEntityType(), requestParts.getEntityName(), doAsUser);
                LOG.info("Authorization succeeded for user={}, proxy={}",
                    authenticatedUGI.getShortUserName(), CurrentUser.getUser());
            } catch (AuthorizationException e) {
                sendError((HttpServletResponse) response,
                    HttpServletResponse.SC_FORBIDDEN, e.getMessage());
                return; // do not continue processing
            } catch (EntityNotRegisteredException e) {
                if (!httpRequest.getMethod().equals(HttpMethod.DELETE)) {
                    sendError((HttpServletResponse) response,
                            HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
                    return; // do not continue processing
                } // else Falcon deletes a non-existing entity and returns success (idempotent operation).
            } catch (IllegalArgumentException e) {
                sendError((HttpServletResponse) response,
                    HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
                return; // do not continue processing
            }
        }

        // continue processing if there was no authorization error
        filterChain.doFilter(request, response);
    }

    @Override
    public void destroy() {
        authorizationProvider = null;
    }

    /**
     * Returns the resource and action for the given request.
     *
     * @param httpRequest    an HTTP servlet request
     * @return the parts of a path
     */
    private static RequestParts getUserRequest(HttpServletRequest httpRequest) {
        String pathInfo = httpRequest.getPathInfo();
        final String[] pathSplits = pathInfo.substring(1).split("/");

        final String resource = pathSplits[0];
        final String action = pathSplits[1];
        if (resource.equalsIgnoreCase("entities") || resource.equalsIgnoreCase("instance")) {
            final String entityType = pathSplits.length > 2 ? pathSplits[2] : null;
            final String entityName = pathSplits.length > 3 ? pathSplits[3] : null;
            return new RequestParts(resource, action, entityName, entityType);
        } else {
            return new RequestParts(resource, action, null, null);
        }
    }

    private void tryProxy(UserGroupInformation authenticatedUGI,
                          String entityType, String entityName,
                          final String doAsUser) throws IOException {
        if (entityType == null || entityName == null) {
            return;
        }

        try {
            EntityType type = EntityType.getEnum(entityType);
            Entity entity = EntityUtil.getEntity(type, entityName);
            SecurityUtil.tryProxy(entity, doAsUser);
        } catch (FalconException ignore) {
            // do nothing
        }
    }

    private void sendError(HttpServletResponse httpResponse,
                           int errorCode, String errorMessage) throws IOException {
        LOG.error("Authorization failed : {}/{}", errorCode, errorMessage);
        if (!httpResponse.isCommitted()) { // handle authorization error
            httpResponse.setStatus(errorCode);
            httpResponse.setContentType(MediaType.APPLICATION_JSON);
            httpResponse.getOutputStream().print(getJsonResponse(errorCode, errorMessage));
        }
    }

    private String getJsonResponse(int errorCode, String errorMessage) throws IOException {
        try {
            JSONObject response = new JSONObject();
            response.put("errorCode", errorCode);
            response.put("errorMessage", errorMessage);
            response.put(Servlets.REQUEST_ID, Thread.currentThread().getName());
            return response.toString();
        } catch (JSONException e) {
            throw new IOException(e);
        }
    }

    private static class RequestParts {
        private final String resource;
        private final String action;
        private final String entityName;
        private final String entityType;

        public RequestParts(String resource, String action,
                            String entityName, String entityType) {
            this.resource = resource;
            this.action = action;
            this.entityName = entityName;
            this.entityType = entityType;
        }

        public String getResource() {
            return resource;
        }

        public String getAction() {
            return action;
        }

        public String getEntityName() {
            return entityName;
        }

        public String getEntityType() {
            return entityType;
        }

        @Override
        public String toString() {
            StringBuilder sb = new StringBuilder();
            sb.append("RequestParts{")
                    .append("resource='").append(resource).append("'")
                    .append(", action='").append(action).append("'");
            if (entityName != null) {
                sb.append(", entityName='").append(entityName).append("'");
            }
            if (entityType != null) {
                sb.append(", entityType='").append(entityType).append("'");
            }
            sb.append("}");
            return sb.toString();
        }
    }
}