2019-11-09 15:33:07 +00:00
|
|
|
#include <Access/AccessControlManager.h>
|
|
|
|
#include <Access/MultipleAccessStorage.h>
|
|
|
|
#include <Access/MemoryAccessStorage.h>
|
2021-07-21 14:01:42 +00:00
|
|
|
#include <Access/ReplicatedAccessStorage.h>
|
2019-11-09 15:33:07 +00:00
|
|
|
#include <Access/UsersConfigAccessStorage.h>
|
2020-02-26 22:36:52 +00:00
|
|
|
#include <Access/DiskAccessStorage.h>
|
2020-07-23 17:55:24 +00:00
|
|
|
#include <Access/LDAPAccessStorage.h>
|
2020-03-07 17:37:38 +00:00
|
|
|
#include <Access/ContextAccess.h>
|
|
|
|
#include <Access/RoleCache.h>
|
|
|
|
#include <Access/RowPolicyCache.h>
|
|
|
|
#include <Access/QuotaCache.h>
|
2020-05-08 12:50:45 +00:00
|
|
|
#include <Access/QuotaUsage.h>
|
2020-03-04 22:27:03 +00:00
|
|
|
#include <Access/SettingsProfilesCache.h>
|
2020-05-27 21:06:33 +00:00
|
|
|
#include <Access/ExternalAuthenticators.h>
|
2020-03-07 17:37:38 +00:00
|
|
|
#include <Core/Settings.h>
|
2021-10-02 07:13:14 +00:00
|
|
|
#include <base/find_symbols.h>
|
2020-03-07 17:37:38 +00:00
|
|
|
#include <Poco/ExpireCache.h>
|
2020-07-28 23:39:18 +00:00
|
|
|
#include <boost/algorithm/string/join.hpp>
|
2020-12-01 21:07:20 +00:00
|
|
|
#include <boost/algorithm/string/split.hpp>
|
|
|
|
#include <boost/algorithm/string/trim.hpp>
|
2020-08-12 11:43:58 +00:00
|
|
|
#include <filesystem>
|
2020-03-07 17:37:38 +00:00
|
|
|
#include <mutex>
|
2019-11-09 15:33:07 +00:00
|
|
|
|
|
|
|
|
|
|
|
namespace DB
|
|
|
|
{
|
2020-07-28 23:39:18 +00:00
|
|
|
namespace ErrorCodes
|
|
|
|
{
|
2020-08-12 11:43:58 +00:00
|
|
|
extern const int UNKNOWN_ELEMENT_IN_CONFIG;
|
2020-07-28 23:39:18 +00:00
|
|
|
extern const int UNKNOWN_SETTING;
|
|
|
|
}
|
|
|
|
|
2019-11-09 15:33:07 +00:00
|
|
|
|
|
|
|
namespace
|
|
|
|
{
|
2020-08-12 11:43:58 +00:00
|
|
|
void checkForUsersNotInMainConfig(
|
|
|
|
const Poco::Util::AbstractConfiguration & config,
|
|
|
|
const std::string & config_path,
|
|
|
|
const std::string & users_config_path,
|
|
|
|
Poco::Logger * log)
|
2019-11-09 15:33:07 +00:00
|
|
|
{
|
2020-08-12 11:43:58 +00:00
|
|
|
if (config.getBool("skip_check_for_incorrect_settings", false))
|
|
|
|
return;
|
2020-04-05 16:40:35 +00:00
|
|
|
|
2020-08-12 11:43:58 +00:00
|
|
|
if (config.has("users") || config.has("profiles") || config.has("quotas"))
|
|
|
|
{
|
|
|
|
/// We cannot throw exception here, because we have support for obsolete 'conf.d' directory
|
|
|
|
/// (that does not correspond to config.d or users.d) but substitute configuration to both of them.
|
2020-07-23 17:55:24 +00:00
|
|
|
|
2020-08-12 11:43:58 +00:00
|
|
|
LOG_ERROR(log, "The <users>, <profiles> and <quotas> elements should be located in users config file: {} not in main config {}."
|
|
|
|
" Also note that you should place configuration changes to the appropriate *.d directory like 'users.d'.",
|
|
|
|
users_config_path, config_path);
|
|
|
|
}
|
2019-11-09 15:33:07 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2020-03-07 17:37:38 +00:00
|
|
|
class AccessControlManager::ContextAccessCache
|
|
|
|
{
|
|
|
|
public:
|
|
|
|
explicit ContextAccessCache(const AccessControlManager & manager_) : manager(manager_) {}
|
|
|
|
|
2020-06-20 22:44:52 +00:00
|
|
|
std::shared_ptr<const ContextAccess> getContextAccess(const ContextAccessParams & params)
|
2020-03-07 17:37:38 +00:00
|
|
|
{
|
|
|
|
std::lock_guard lock{mutex};
|
|
|
|
auto x = cache.get(params);
|
|
|
|
if (x)
|
2021-07-15 08:55:51 +00:00
|
|
|
{
|
|
|
|
if ((*x)->getUser())
|
|
|
|
return *x;
|
|
|
|
/// No user, probably the user has been dropped while it was in the cache.
|
|
|
|
cache.remove(params);
|
|
|
|
}
|
2020-03-07 17:37:38 +00:00
|
|
|
auto res = std::shared_ptr<ContextAccess>(new ContextAccess(manager, params));
|
|
|
|
cache.add(params, res);
|
|
|
|
return res;
|
|
|
|
}
|
|
|
|
|
|
|
|
private:
|
|
|
|
const AccessControlManager & manager;
|
|
|
|
Poco::ExpireCache<ContextAccess::Params, std::shared_ptr<const ContextAccess>> cache;
|
|
|
|
std::mutex mutex;
|
|
|
|
};
|
|
|
|
|
|
|
|
|
2020-07-28 23:39:18 +00:00
|
|
|
class AccessControlManager::CustomSettingsPrefixes
|
|
|
|
{
|
|
|
|
public:
|
|
|
|
void registerPrefixes(const Strings & prefixes_)
|
|
|
|
{
|
|
|
|
std::lock_guard lock{mutex};
|
|
|
|
registered_prefixes = prefixes_;
|
|
|
|
}
|
|
|
|
|
|
|
|
bool isSettingNameAllowed(const std::string_view & setting_name) const
|
|
|
|
{
|
|
|
|
if (Settings::hasBuiltin(setting_name))
|
|
|
|
return true;
|
|
|
|
|
|
|
|
std::lock_guard lock{mutex};
|
|
|
|
for (const auto & prefix : registered_prefixes)
|
|
|
|
{
|
|
|
|
if (setting_name.starts_with(prefix))
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
void checkSettingNameIsAllowed(const std::string_view & setting_name) const
|
|
|
|
{
|
|
|
|
if (isSettingNameAllowed(setting_name))
|
|
|
|
return;
|
|
|
|
|
|
|
|
std::lock_guard lock{mutex};
|
|
|
|
if (!registered_prefixes.empty())
|
|
|
|
{
|
|
|
|
throw Exception(
|
|
|
|
"Setting " + String{setting_name} + " is neither a builtin setting nor started with the prefix '"
|
|
|
|
+ boost::algorithm::join(registered_prefixes, "' or '") + "' registered for user-defined settings",
|
|
|
|
ErrorCodes::UNKNOWN_SETTING);
|
|
|
|
}
|
|
|
|
else
|
|
|
|
BaseSettingsHelpers::throwSettingNotFound(setting_name);
|
|
|
|
}
|
|
|
|
|
|
|
|
private:
|
|
|
|
Strings registered_prefixes;
|
|
|
|
mutable std::mutex mutex;
|
|
|
|
};
|
|
|
|
|
|
|
|
|
2019-11-09 15:33:07 +00:00
|
|
|
AccessControlManager::AccessControlManager()
|
2020-08-05 19:54:06 +00:00
|
|
|
: MultipleAccessStorage("user directories"),
|
2020-03-07 17:37:38 +00:00
|
|
|
context_access_cache(std::make_unique<ContextAccessCache>(*this)),
|
|
|
|
role_cache(std::make_unique<RoleCache>(*this)),
|
|
|
|
row_policy_cache(std::make_unique<RowPolicyCache>(*this)),
|
2020-03-04 22:27:03 +00:00
|
|
|
quota_cache(std::make_unique<QuotaCache>(*this)),
|
2020-07-11 17:06:01 +00:00
|
|
|
settings_profiles_cache(std::make_unique<SettingsProfilesCache>(*this)),
|
2020-07-28 23:39:18 +00:00
|
|
|
external_authenticators(std::make_unique<ExternalAuthenticators>()),
|
|
|
|
custom_settings_prefixes(std::make_unique<CustomSettingsPrefixes>())
|
2019-11-09 15:33:07 +00:00
|
|
|
{
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2020-03-08 21:53:03 +00:00
|
|
|
AccessControlManager::~AccessControlManager() = default;
|
2019-11-09 15:33:07 +00:00
|
|
|
|
2020-08-05 19:54:06 +00:00
|
|
|
void AccessControlManager::setUsersConfig(const Poco::Util::AbstractConfiguration & users_config_)
|
|
|
|
{
|
|
|
|
auto storages = getStoragesPtr();
|
|
|
|
for (const auto & storage : *storages)
|
|
|
|
{
|
|
|
|
if (auto users_config_storage = typeid_cast<std::shared_ptr<UsersConfigAccessStorage>>(storage))
|
|
|
|
{
|
|
|
|
users_config_storage->setConfig(users_config_);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
addUsersConfigStorage(users_config_);
|
|
|
|
}
|
|
|
|
|
|
|
|
void AccessControlManager::addUsersConfigStorage(const Poco::Util::AbstractConfiguration & users_config_)
|
2020-02-26 22:36:52 +00:00
|
|
|
{
|
2020-08-05 19:54:06 +00:00
|
|
|
addUsersConfigStorage(UsersConfigAccessStorage::STORAGE_TYPE, users_config_);
|
2020-02-26 22:36:52 +00:00
|
|
|
}
|
|
|
|
|
2020-08-05 19:54:06 +00:00
|
|
|
void AccessControlManager::addUsersConfigStorage(const String & storage_name_, const Poco::Util::AbstractConfiguration & users_config_)
|
2020-02-26 22:36:52 +00:00
|
|
|
{
|
2020-08-05 19:54:06 +00:00
|
|
|
auto check_setting_name_function = [this](const std::string_view & setting_name) { checkSettingNameIsAllowed(setting_name); };
|
|
|
|
auto new_storage = std::make_shared<UsersConfigAccessStorage>(storage_name_, check_setting_name_function);
|
|
|
|
new_storage->setConfig(users_config_);
|
|
|
|
addStorage(new_storage);
|
2020-10-22 16:47:52 +00:00
|
|
|
LOG_DEBUG(getLogger(), "Added {} access storage '{}', path: {}", String(new_storage->getStorageType()), new_storage->getStorageName(), new_storage->getPath());
|
2020-02-26 22:36:52 +00:00
|
|
|
}
|
|
|
|
|
2020-08-05 19:54:06 +00:00
|
|
|
void AccessControlManager::addUsersConfigStorage(
|
|
|
|
const String & users_config_path_,
|
|
|
|
const String & include_from_path_,
|
|
|
|
const String & preprocessed_dir_,
|
|
|
|
const zkutil::GetZooKeeper & get_zookeeper_function_)
|
2020-06-10 22:48:15 +00:00
|
|
|
{
|
2020-08-05 19:54:06 +00:00
|
|
|
addUsersConfigStorage(
|
|
|
|
UsersConfigAccessStorage::STORAGE_TYPE, users_config_path_, include_from_path_, preprocessed_dir_, get_zookeeper_function_);
|
2020-06-10 22:48:15 +00:00
|
|
|
}
|
|
|
|
|
2020-08-05 19:54:06 +00:00
|
|
|
void AccessControlManager::addUsersConfigStorage(
|
|
|
|
const String & storage_name_,
|
|
|
|
const String & users_config_path_,
|
|
|
|
const String & include_from_path_,
|
|
|
|
const String & preprocessed_dir_,
|
|
|
|
const zkutil::GetZooKeeper & get_zookeeper_function_)
|
|
|
|
{
|
2020-09-11 16:54:22 +00:00
|
|
|
auto storages = getStoragesPtr();
|
|
|
|
for (const auto & storage : *storages)
|
|
|
|
{
|
|
|
|
if (auto users_config_storage = typeid_cast<std::shared_ptr<UsersConfigAccessStorage>>(storage))
|
|
|
|
{
|
2020-09-14 22:51:53 +00:00
|
|
|
if (users_config_storage->isPathEqual(users_config_path_))
|
2020-09-11 16:54:22 +00:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
}
|
2020-08-05 19:54:06 +00:00
|
|
|
auto check_setting_name_function = [this](const std::string_view & setting_name) { checkSettingNameIsAllowed(setting_name); };
|
|
|
|
auto new_storage = std::make_shared<UsersConfigAccessStorage>(storage_name_, check_setting_name_function);
|
|
|
|
new_storage->load(users_config_path_, include_from_path_, preprocessed_dir_, get_zookeeper_function_);
|
|
|
|
addStorage(new_storage);
|
2020-10-22 16:47:52 +00:00
|
|
|
LOG_DEBUG(getLogger(), "Added {} access storage '{}', path: {}", String(new_storage->getStorageType()), new_storage->getStorageName(), new_storage->getPath());
|
2020-08-05 19:54:06 +00:00
|
|
|
}
|
2020-06-10 22:48:15 +00:00
|
|
|
|
2020-08-05 19:54:06 +00:00
|
|
|
void AccessControlManager::reloadUsersConfigs()
|
2019-11-09 15:33:07 +00:00
|
|
|
{
|
2020-08-05 19:54:06 +00:00
|
|
|
auto storages = getStoragesPtr();
|
|
|
|
for (const auto & storage : *storages)
|
|
|
|
{
|
|
|
|
if (auto users_config_storage = typeid_cast<std::shared_ptr<UsersConfigAccessStorage>>(storage))
|
|
|
|
users_config_storage->reload();
|
|
|
|
}
|
|
|
|
}
|
2020-02-26 22:36:52 +00:00
|
|
|
|
2020-08-05 19:54:06 +00:00
|
|
|
void AccessControlManager::startPeriodicReloadingUsersConfigs()
|
2020-06-10 22:48:15 +00:00
|
|
|
{
|
2020-08-05 19:54:06 +00:00
|
|
|
auto storages = getStoragesPtr();
|
|
|
|
for (const auto & storage : *storages)
|
|
|
|
{
|
|
|
|
if (auto users_config_storage = typeid_cast<std::shared_ptr<UsersConfigAccessStorage>>(storage))
|
|
|
|
users_config_storage->startPeriodicReloading();
|
|
|
|
}
|
2020-06-10 22:48:15 +00:00
|
|
|
}
|
|
|
|
|
2021-07-21 14:01:42 +00:00
|
|
|
void AccessControlManager::addReplicatedStorage(
|
|
|
|
const String & storage_name_,
|
|
|
|
const String & zookeeper_path_,
|
|
|
|
const zkutil::GetZooKeeper & get_zookeeper_function_)
|
|
|
|
{
|
|
|
|
auto storages = getStoragesPtr();
|
|
|
|
for (const auto & storage : *storages)
|
|
|
|
{
|
|
|
|
if (auto replicated_storage = typeid_cast<std::shared_ptr<ReplicatedAccessStorage>>(storage))
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
auto new_storage = std::make_shared<ReplicatedAccessStorage>(storage_name_, zookeeper_path_, get_zookeeper_function_);
|
|
|
|
addStorage(new_storage);
|
|
|
|
LOG_DEBUG(getLogger(), "Added {} access storage '{}'", String(new_storage->getStorageType()), new_storage->getStorageName());
|
|
|
|
new_storage->startup();
|
|
|
|
}
|
2020-06-10 22:48:15 +00:00
|
|
|
|
2020-08-05 19:54:06 +00:00
|
|
|
void AccessControlManager::addDiskStorage(const String & directory_, bool readonly_)
|
2019-11-09 15:33:07 +00:00
|
|
|
{
|
2020-09-11 16:54:22 +00:00
|
|
|
addDiskStorage(DiskAccessStorage::STORAGE_TYPE, directory_, readonly_);
|
2020-08-05 19:54:06 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void AccessControlManager::addDiskStorage(const String & storage_name_, const String & directory_, bool readonly_)
|
|
|
|
{
|
2020-09-11 16:54:22 +00:00
|
|
|
auto storages = getStoragesPtr();
|
|
|
|
for (const auto & storage : *storages)
|
|
|
|
{
|
|
|
|
if (auto disk_storage = typeid_cast<std::shared_ptr<DiskAccessStorage>>(storage))
|
|
|
|
{
|
2020-09-14 22:51:53 +00:00
|
|
|
if (disk_storage->isPathEqual(directory_))
|
2020-09-11 16:54:22 +00:00
|
|
|
{
|
|
|
|
if (readonly_)
|
|
|
|
disk_storage->setReadOnly(readonly_);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2020-10-22 16:47:52 +00:00
|
|
|
auto new_storage = std::make_shared<DiskAccessStorage>(storage_name_, directory_, readonly_);
|
|
|
|
addStorage(new_storage);
|
|
|
|
LOG_DEBUG(getLogger(), "Added {} access storage '{}', path: {}", String(new_storage->getStorageType()), new_storage->getStorageName(), new_storage->getPath());
|
2020-08-05 19:54:06 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
void AccessControlManager::addMemoryStorage(const String & storage_name_)
|
|
|
|
{
|
2020-09-11 16:54:22 +00:00
|
|
|
auto storages = getStoragesPtr();
|
|
|
|
for (const auto & storage : *storages)
|
|
|
|
{
|
|
|
|
if (auto memory_storage = typeid_cast<std::shared_ptr<MemoryAccessStorage>>(storage))
|
|
|
|
return;
|
|
|
|
}
|
2020-10-23 06:13:26 +00:00
|
|
|
auto new_storage = std::make_shared<MemoryAccessStorage>(storage_name_);
|
2020-10-22 16:47:52 +00:00
|
|
|
addStorage(new_storage);
|
|
|
|
LOG_DEBUG(getLogger(), "Added {} access storage '{}'", String(new_storage->getStorageType()), new_storage->getStorageName());
|
2020-08-05 19:54:06 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2020-08-18 10:54:02 +00:00
|
|
|
void AccessControlManager::addLDAPStorage(const String & storage_name_, const Poco::Util::AbstractConfiguration & config_, const String & prefix_)
|
|
|
|
{
|
2020-10-22 16:47:52 +00:00
|
|
|
auto new_storage = std::make_shared<LDAPAccessStorage>(storage_name_, this, config_, prefix_);
|
|
|
|
addStorage(new_storage);
|
|
|
|
LOG_DEBUG(getLogger(), "Added {} access storage '{}', LDAP server name: {}", String(new_storage->getStorageType()), new_storage->getStorageName(), new_storage->getLDAPServerName());
|
2020-08-18 10:54:02 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2020-08-12 11:43:58 +00:00
|
|
|
void AccessControlManager::addStoragesFromUserDirectoriesConfig(
|
|
|
|
const Poco::Util::AbstractConfiguration & config,
|
|
|
|
const String & key,
|
|
|
|
const String & config_dir,
|
|
|
|
const String & dbms_dir,
|
|
|
|
const String & include_from_path,
|
|
|
|
const zkutil::GetZooKeeper & get_zookeeper_function)
|
|
|
|
{
|
|
|
|
Strings keys_in_user_directories;
|
|
|
|
config.keys(key, keys_in_user_directories);
|
|
|
|
|
|
|
|
for (const String & key_in_user_directories : keys_in_user_directories)
|
|
|
|
{
|
|
|
|
String prefix = key + "." + key_in_user_directories;
|
|
|
|
|
|
|
|
String type = key_in_user_directories;
|
2020-09-20 22:51:38 +00:00
|
|
|
if (size_t bracket_pos = type.find('['); bracket_pos != String::npos)
|
2020-08-12 11:43:58 +00:00
|
|
|
type.resize(bracket_pos);
|
|
|
|
if ((type == "users_xml") || (type == "users_config"))
|
|
|
|
type = UsersConfigAccessStorage::STORAGE_TYPE;
|
|
|
|
else if ((type == "local") || (type == "local_directory"))
|
|
|
|
type = DiskAccessStorage::STORAGE_TYPE;
|
2020-08-18 10:54:02 +00:00
|
|
|
else if (type == "ldap")
|
|
|
|
type = LDAPAccessStorage::STORAGE_TYPE;
|
2020-08-12 11:43:58 +00:00
|
|
|
|
|
|
|
String name = config.getString(prefix + ".name", type);
|
|
|
|
|
|
|
|
if (type == MemoryAccessStorage::STORAGE_TYPE)
|
|
|
|
{
|
|
|
|
addMemoryStorage(name);
|
|
|
|
}
|
|
|
|
else if (type == UsersConfigAccessStorage::STORAGE_TYPE)
|
|
|
|
{
|
|
|
|
String path = config.getString(prefix + ".path");
|
|
|
|
if (std::filesystem::path{path}.is_relative() && std::filesystem::exists(config_dir + path))
|
|
|
|
path = config_dir + path;
|
|
|
|
addUsersConfigStorage(name, path, include_from_path, dbms_dir, get_zookeeper_function);
|
|
|
|
}
|
|
|
|
else if (type == DiskAccessStorage::STORAGE_TYPE)
|
|
|
|
{
|
|
|
|
String path = config.getString(prefix + ".path");
|
|
|
|
bool readonly = config.getBool(prefix + ".readonly", false);
|
|
|
|
addDiskStorage(name, path, readonly);
|
|
|
|
}
|
2020-08-18 10:54:02 +00:00
|
|
|
else if (type == LDAPAccessStorage::STORAGE_TYPE)
|
|
|
|
{
|
|
|
|
addLDAPStorage(name, config, prefix);
|
|
|
|
}
|
2021-07-21 14:01:42 +00:00
|
|
|
else if (type == ReplicatedAccessStorage::STORAGE_TYPE)
|
|
|
|
{
|
|
|
|
String zookeeper_path = config.getString(prefix + ".zookeeper_path");
|
|
|
|
addReplicatedStorage(name, zookeeper_path, get_zookeeper_function);
|
|
|
|
}
|
2020-08-12 11:43:58 +00:00
|
|
|
else
|
|
|
|
throw Exception("Unknown storage type '" + type + "' at " + prefix + " in config", ErrorCodes::UNKNOWN_ELEMENT_IN_CONFIG);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
void AccessControlManager::addStoragesFromMainConfig(
|
|
|
|
const Poco::Util::AbstractConfiguration & config,
|
|
|
|
const String & config_path,
|
|
|
|
const zkutil::GetZooKeeper & get_zookeeper_function)
|
|
|
|
{
|
|
|
|
String config_dir = std::filesystem::path{config_path}.remove_filename().string();
|
|
|
|
String dbms_dir = config.getString("path", DBMS_DEFAULT_PATH);
|
|
|
|
String include_from_path = config.getString("include_from", "/etc/metrika.xml");
|
2020-08-21 15:47:37 +00:00
|
|
|
bool has_user_directories = config.has("user_directories");
|
2020-08-12 11:43:58 +00:00
|
|
|
|
2020-08-21 15:47:37 +00:00
|
|
|
/// If path to users' config isn't absolute, try guess its root (current) dir.
|
|
|
|
/// At first, try to find it in dir of main config, after will use current dir.
|
|
|
|
String users_config_path = config.getString("users_config", "");
|
|
|
|
if (users_config_path.empty())
|
2020-08-12 11:43:58 +00:00
|
|
|
{
|
2020-08-21 15:47:37 +00:00
|
|
|
if (!has_user_directories)
|
2020-08-12 11:43:58 +00:00
|
|
|
users_config_path = config_path;
|
2020-08-21 15:47:37 +00:00
|
|
|
}
|
|
|
|
else if (std::filesystem::path{users_config_path}.is_relative() && std::filesystem::exists(config_dir + users_config_path))
|
|
|
|
users_config_path = config_dir + users_config_path;
|
2020-08-12 11:43:58 +00:00
|
|
|
|
2020-08-21 15:47:37 +00:00
|
|
|
if (!users_config_path.empty())
|
|
|
|
{
|
2020-08-12 11:43:58 +00:00
|
|
|
if (users_config_path != config_path)
|
|
|
|
checkForUsersNotInMainConfig(config, config_path, users_config_path, getLogger());
|
|
|
|
|
|
|
|
addUsersConfigStorage(users_config_path, include_from_path, dbms_dir, get_zookeeper_function);
|
|
|
|
}
|
2020-08-21 15:47:37 +00:00
|
|
|
|
|
|
|
String disk_storage_dir = config.getString("access_control_path", "");
|
|
|
|
if (!disk_storage_dir.empty())
|
|
|
|
addDiskStorage(disk_storage_dir);
|
|
|
|
|
|
|
|
if (has_user_directories)
|
|
|
|
addStoragesFromUserDirectoriesConfig(config, "user_directories", config_dir, dbms_dir, include_from_path, get_zookeeper_function);
|
2020-07-23 17:55:24 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2021-03-11 20:41:10 +00:00
|
|
|
UUID AccessControlManager::login(const Credentials & credentials, const Poco::Net::IPAddress & address) const
|
2020-09-17 09:58:34 +00:00
|
|
|
{
|
2021-03-11 20:41:10 +00:00
|
|
|
return MultipleAccessStorage::login(credentials, address, *external_authenticators);
|
2020-09-17 09:58:34 +00:00
|
|
|
}
|
|
|
|
|
2020-07-23 17:55:24 +00:00
|
|
|
void AccessControlManager::setExternalAuthenticatorsConfig(const Poco::Util::AbstractConfiguration & config)
|
|
|
|
{
|
|
|
|
external_authenticators->setConfiguration(config, getLogger());
|
2019-11-09 15:33:07 +00:00
|
|
|
}
|
|
|
|
|
2019-11-04 19:17:27 +00:00
|
|
|
|
2020-03-04 22:27:03 +00:00
|
|
|
void AccessControlManager::setDefaultProfileName(const String & default_profile_name)
|
|
|
|
{
|
|
|
|
settings_profiles_cache->setDefaultProfileName(default_profile_name);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2020-07-28 23:39:18 +00:00
|
|
|
void AccessControlManager::setCustomSettingsPrefixes(const Strings & prefixes)
|
|
|
|
{
|
|
|
|
custom_settings_prefixes->registerPrefixes(prefixes);
|
|
|
|
}
|
|
|
|
|
|
|
|
void AccessControlManager::setCustomSettingsPrefixes(const String & comma_separated_prefixes)
|
|
|
|
{
|
|
|
|
Strings prefixes;
|
|
|
|
splitInto<','>(prefixes, comma_separated_prefixes);
|
|
|
|
setCustomSettingsPrefixes(prefixes);
|
|
|
|
}
|
|
|
|
|
|
|
|
bool AccessControlManager::isSettingNameAllowed(const std::string_view & setting_name) const
|
|
|
|
{
|
|
|
|
return custom_settings_prefixes->isSettingNameAllowed(setting_name);
|
|
|
|
}
|
|
|
|
|
|
|
|
void AccessControlManager::checkSettingNameIsAllowed(const std::string_view & setting_name) const
|
|
|
|
{
|
|
|
|
custom_settings_prefixes->checkSettingNameIsAllowed(setting_name);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2020-03-07 17:37:38 +00:00
|
|
|
std::shared_ptr<const ContextAccess> AccessControlManager::getContextAccess(
|
2020-02-21 00:17:07 +00:00
|
|
|
const UUID & user_id,
|
2021-02-26 22:37:00 +00:00
|
|
|
const std::vector<UUID> & current_roles,
|
2020-02-21 00:17:07 +00:00
|
|
|
bool use_default_roles,
|
|
|
|
const Settings & settings,
|
|
|
|
const String & current_database,
|
|
|
|
const ClientInfo & client_info) const
|
2020-01-12 21:00:55 +00:00
|
|
|
{
|
2020-06-20 22:44:52 +00:00
|
|
|
ContextAccessParams params;
|
|
|
|
params.user_id = user_id;
|
2021-02-26 22:37:00 +00:00
|
|
|
params.current_roles.insert(current_roles.begin(), current_roles.end());
|
2020-06-20 22:44:52 +00:00
|
|
|
params.use_default_roles = use_default_roles;
|
|
|
|
params.current_database = current_database;
|
|
|
|
params.readonly = settings.readonly;
|
|
|
|
params.allow_ddl = settings.allow_ddl;
|
|
|
|
params.allow_introspection = settings.allow_introspection_functions;
|
|
|
|
params.interface = client_info.interface;
|
|
|
|
params.http_method = client_info.http_method;
|
|
|
|
params.address = client_info.current_address.host();
|
|
|
|
params.quota_key = client_info.quota_key;
|
2020-12-01 21:07:20 +00:00
|
|
|
|
|
|
|
/// Extract the last entry from comma separated list of X-Forwarded-For addresses.
|
|
|
|
/// Only the last proxy can be trusted (if any).
|
|
|
|
Strings forwarded_addresses;
|
|
|
|
boost::split(forwarded_addresses, client_info.forwarded_for, boost::is_any_of(","));
|
|
|
|
if (!forwarded_addresses.empty())
|
|
|
|
{
|
|
|
|
String & last_forwarded_address = forwarded_addresses.back();
|
|
|
|
boost::trim(last_forwarded_address);
|
|
|
|
params.forwarded_address = last_forwarded_address;
|
|
|
|
}
|
|
|
|
|
2020-06-20 22:44:52 +00:00
|
|
|
return getContextAccess(params);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
std::shared_ptr<const ContextAccess> AccessControlManager::getContextAccess(const ContextAccessParams & params) const
|
|
|
|
{
|
|
|
|
return context_access_cache->getContextAccess(params);
|
2020-01-12 21:00:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2020-03-07 17:37:38 +00:00
|
|
|
std::shared_ptr<const EnabledRoles> AccessControlManager::getEnabledRoles(
|
2021-02-26 22:37:00 +00:00
|
|
|
const std::vector<UUID> & current_roles,
|
|
|
|
const std::vector<UUID> & current_roles_with_admin_option) const
|
2019-11-04 19:17:27 +00:00
|
|
|
{
|
2020-03-07 17:37:38 +00:00
|
|
|
return role_cache->getEnabledRoles(current_roles, current_roles_with_admin_option);
|
2020-02-21 00:17:07 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2020-04-29 19:35:56 +00:00
|
|
|
std::shared_ptr<const EnabledRowPolicies> AccessControlManager::getEnabledRowPolicies(const UUID & user_id, const boost::container::flat_set<UUID> & enabled_roles) const
|
2020-02-21 00:17:07 +00:00
|
|
|
{
|
2020-03-07 17:37:38 +00:00
|
|
|
return row_policy_cache->getEnabledRowPolicies(user_id, enabled_roles);
|
2019-11-04 19:17:27 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2020-03-07 17:37:38 +00:00
|
|
|
std::shared_ptr<const EnabledQuota> AccessControlManager::getEnabledQuota(
|
2020-12-01 21:07:20 +00:00
|
|
|
const UUID & user_id,
|
|
|
|
const String & user_name,
|
|
|
|
const boost::container::flat_set<UUID> & enabled_roles,
|
|
|
|
const Poco::Net::IPAddress & address,
|
|
|
|
const String & forwarded_address,
|
|
|
|
const String & custom_quota_key) const
|
2019-11-04 19:17:27 +00:00
|
|
|
{
|
2020-12-01 21:07:20 +00:00
|
|
|
return quota_cache->getEnabledQuota(user_id, user_name, enabled_roles, address, forwarded_address, custom_quota_key);
|
2019-11-04 19:17:27 +00:00
|
|
|
}
|
2019-11-17 11:57:02 +00:00
|
|
|
|
2020-02-21 00:17:07 +00:00
|
|
|
|
2020-05-08 12:50:45 +00:00
|
|
|
std::vector<QuotaUsage> AccessControlManager::getAllQuotasUsage() const
|
2019-11-17 11:57:02 +00:00
|
|
|
{
|
2020-05-08 12:50:45 +00:00
|
|
|
return quota_cache->getAllQuotasUsage();
|
2019-11-17 11:57:02 +00:00
|
|
|
}
|
|
|
|
|
2020-03-04 22:27:03 +00:00
|
|
|
|
|
|
|
std::shared_ptr<const EnabledSettings> AccessControlManager::getEnabledSettings(
|
|
|
|
const UUID & user_id,
|
|
|
|
const SettingsProfileElements & settings_from_user,
|
2020-04-29 19:35:56 +00:00
|
|
|
const boost::container::flat_set<UUID> & enabled_roles,
|
2020-03-04 22:27:03 +00:00
|
|
|
const SettingsProfileElements & settings_from_enabled_roles) const
|
|
|
|
{
|
|
|
|
return settings_profiles_cache->getEnabledSettings(user_id, settings_from_user, enabled_roles, settings_from_enabled_roles);
|
|
|
|
}
|
|
|
|
|
2021-07-22 16:07:03 +00:00
|
|
|
std::shared_ptr<const SettingsProfilesInfo> AccessControlManager::getSettingsProfileInfo(const UUID & profile_id)
|
2020-03-04 22:27:03 +00:00
|
|
|
{
|
2021-07-22 16:07:03 +00:00
|
|
|
return settings_profiles_cache->getSettingsProfileInfo(profile_id);
|
2020-03-04 22:27:03 +00:00
|
|
|
}
|
|
|
|
|
2021-07-22 16:07:03 +00:00
|
|
|
|
2020-07-11 17:06:01 +00:00
|
|
|
const ExternalAuthenticators & AccessControlManager::getExternalAuthenticators() const
|
2020-05-27 21:06:33 +00:00
|
|
|
{
|
2020-07-11 17:06:01 +00:00
|
|
|
return *external_authenticators;
|
2020-05-27 21:06:33 +00:00
|
|
|
}
|
|
|
|
|
2019-11-09 15:33:07 +00:00
|
|
|
}
|