Package org.apache.cassandra.auth

Class AllowAllAuthorizer

java.lang.Object

org.apache.cassandra.auth.AllowAllAuthorizer

All Implemented Interfaces:

AuthCache.BulkLoader<Pair<AuthenticatedUser,IResource>,java.util.Set<Permission>>, IAuthorizer

public class AllowAllAuthorizer
extends java.lang.Object
implements IAuthorizer

Constructor Summary

Constructors

Constructor	Description
AllowAllAuthorizer()

Method Summary

Modifier and Type	Method	Description
java.util.Set<Permission>	authorize(AuthenticatedUser user, IResource resource)	Returns a set of permissions of a user on a resource.
java.util.Set<Permission>	grant(AuthenticatedUser performer, java.util.Set<Permission> permissions, IResource resource, RoleResource to)	Grants a set of permissions on a resource to a role.
java.util.Set<PermissionDetails>	list(AuthenticatedUser performer, java.util.Set<Permission> permissions, IResource resource, RoleResource of)	Returns a list of permissions on a resource granted to a role.
java.util.Set<IResource>	protectedResources()	Set of resources that should be made inaccessible to users and only accessible internally.
boolean	requireAuthorization()	Whether or not the authorizer will attempt authorization.
java.util.Set<Permission>	revoke(AuthenticatedUser performer, java.util.Set<Permission> permissions, IResource resource, RoleResource from)	Revokes a set of permissions on a resource from a user.
void	revokeAllFrom(RoleResource droppedRole)	Called before deleting a role with DROP ROLE statement (or the alias provided for compatibility, DROP USER) so that a new role with the same name wouldn't inherit permissions of the deleted one in the future.
void	revokeAllOn(IResource droppedResource)	This method is called after a resource is removed (i.e.
void	setup()	Setup is called once upon system startup to initialize the IAuthorizer.
void	validateConfiguration()	Validates configuration of IAuthorizer implementation (if configurable).

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.apache.cassandra.auth.AuthCache.BulkLoader

bulkLoader

Constructor Detail

AllowAllAuthorizer

public AllowAllAuthorizer()

Method Detail

requireAuthorization

public boolean requireAuthorization()

Description copied from interface: IAuthorizer

Whether or not the authorizer will attempt authorization. If false the authorizer will not be called for authorization of resources.

Specified by:

requireAuthorization in interface IAuthorizer

authorize

public java.util.Set<Permission> authorize(AuthenticatedUser user,
                                           IResource resource)

Description copied from interface: IAuthorizer

Returns a set of permissions of a user on a resource. Since Roles were introduced in version 2.2, Cassandra does not distinguish in any meaningful way between users and roles. A role may or may not have login privileges and roles may be granted to other roles. In fact, Cassandra does not really have the concept of a user, except to link a client session to role. AuthenticatedUser can be thought of as a manifestation of a role, linked to a specific client connection.

Specified by:

authorize in interface IAuthorizer

Parameters:

user - Authenticated user requesting authorization.

resource - Resource for which the authorization is being requested. @see DataResource.

Returns:

Set of permissions of the user on the resource. Should never return null. Use Permission.NONE instead.

grant

public java.util.Set<Permission> grant(AuthenticatedUser performer,
                                       java.util.Set<Permission> permissions,
                                       IResource resource,
                                       RoleResource to)

Description copied from interface: IAuthorizer

Grants a set of permissions on a resource to a role. The opposite of revoke(). This method is optional and may be called internally, so implementations which do not support it should be sure to throw UnsupportedOperationException.

Specified by:

grant in interface IAuthorizer

Parameters:

performer - User who grants the permissions.

permissions - Set of permissions to grant.

resource - Resource on which to grant the permissions.

to - Role to which the permissions are to be granted.

Returns:

the permissions that have been successfully granted, comprised by the requested permissions excluding those permissions that were already granted.

revoke

public java.util.Set<Permission> revoke(AuthenticatedUser performer,
                                        java.util.Set<Permission> permissions,
                                        IResource resource,
                                        RoleResource from)

Description copied from interface: IAuthorizer

Revokes a set of permissions on a resource from a user. The opposite of grant(). This method is optional and may be called internally, so implementations which do not support it should be sure to throw UnsupportedOperationException.

Specified by:

revoke in interface IAuthorizer

Parameters:

performer - User who revokes the permissions.

permissions - Set of permissions to revoke.

resource - Resource on which to revoke the permissions.

from - Role from which to the permissions are to be revoked.

Returns:

the permissions that have been successfully revoked, comprised by the requested permissions excluding those permissions that were already not granted.

revokeAllFrom

public void revokeAllFrom(RoleResource droppedRole)

Description copied from interface: IAuthorizer

Called before deleting a role with DROP ROLE statement (or the alias provided for compatibility, DROP USER) so that a new role with the same name wouldn't inherit permissions of the deleted one in the future. This removes all permissions granted to the Role in question. This method is optional and may be called internally, so implementations which do not support it should be sure to throw UnsupportedOperationException.

Specified by:

revokeAllFrom in interface IAuthorizer

Parameters:

droppedRole - The role to revoke all permissions from.

revokeAllOn

public void revokeAllOn(IResource droppedResource)

Description copied from interface: IAuthorizer

This method is called after a resource is removed (i.e. keyspace, table or role is dropped) and revokes all permissions granted on the IResource in question. This method is optional and may be called internally, so implementations which do not support it should be sure to throw UnsupportedOperationException.

Specified by:

revokeAllOn in interface IAuthorizer

Parameters:

droppedResource - The resource to revoke all permissions on.

list

public java.util.Set<PermissionDetails> list(AuthenticatedUser performer,
                                             java.util.Set<Permission> permissions,
                                             IResource resource,
                                             RoleResource of)

Description copied from interface: IAuthorizer

Returns a list of permissions on a resource granted to a role. This method is optional and may be called internally, so implementations which do not support it should be sure to throw UnsupportedOperationException.

Specified by:

list in interface IAuthorizer

Parameters:

performer - User who wants to see the permissions.

permissions - Set of Permission values the user is interested in. The result should only include the matching ones.

resource - The resource on which permissions are requested. Can be null, in which case permissions on all resources should be returned.

of - The role whose permissions are requested. Can be null, in which case permissions of every role should be returned.

Returns:

All of the matching permission that the requesting user is authorized to know about.

protectedResources

public java.util.Set<IResource> protectedResources()

Description copied from interface: IAuthorizer

Set of resources that should be made inaccessible to users and only accessible internally.

Specified by:

protectedResources in interface IAuthorizer

Returns:

Keyspaces, column families that will be unmodifiable by users; other resources.

validateConfiguration

public void validateConfiguration()

Description copied from interface: IAuthorizer

Validates configuration of IAuthorizer implementation (if configurable).

Specified by:

validateConfiguration in interface IAuthorizer

setup

public void setup()

Description copied from interface: IAuthorizer

Setup is called once upon system startup to initialize the IAuthorizer. For example, use this method to create any required keyspaces/column families.

Specified by:

setup in interface IAuthorizer