Skip to content

Commit 115bd8d

Browse files
SpriCoderSpriCoder
authored
[IOTDB-5134] Fix Auth Module Contain (#10545)
1 parent a9c615d commit 115bd8d

File tree

9 files changed

+69
-61
lines changed

9 files changed

+69
-61
lines changed

‎docs/UserGuide/Administration-Management/Administration.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ The SQL statement will not be executed and the corresponding error prompt is giv
9191

9292
```
9393
IoTDB> INSERT INTO root.ln.wf01.wt01(timestamp,status) values(1509465600000,true)
94-
Msg: 602: No permissions for this operation, please add privilege INSERT_TIMESERIES.
94+
Msg: 602: No permissions for this operation, please add privilege WRITE_DATA.
9595
```
9696

9797
Now, we use root user to grant the two users write privileges to the corresponding databases.
@@ -144,7 +144,7 @@ Msg: The statement is executed successfully.
144144
After revoking, ln_write_user has no permission to writing data to root.ln.**
145145
```
146146
INSERT INTO root.ln.wf01.wt01(timestamp, status) values(1509465600000, true)
147-
Msg: 602: No permissions for this operation, please add privilege INSERT_TIMESERIES.
147+
Msg: 602: No permissions for this operation, please add privilege WRITE_DATA.
148148
```
149149

150150
### SQL Statements

‎docs/zh/UserGuide/Administration-Management/Administration.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ INSERT INTO root.ln.wf01.wt01(timestamp,status) values(1509465600000,true)
9090

9191
```
9292
IoTDB> INSERT INTO root.ln.wf01.wt01(timestamp,status) values(1509465600000,true)
93-
Msg: 602: No permissions for this operation, please add privilege INSERT_TIMESERIES.
93+
Msg: 602: No permissions for this operation, please add privilege WRITE_DATA.
9494
```
9595

9696
现在，我们用root用户分别赋予他们向对应 database 数据的写入权限.
@@ -143,7 +143,7 @@ Msg: The statement is executed successfully.
143143
撤销权限后，ln_write_user就没有向root.ln.**写入数据的权限了。
144144
```
145145
INSERT INTO root.ln.wf01.wt01(timestamp, status) values(1509465600000, true)
146-
Msg: 602: No permissions for this operation, please add privilege INSERT_TIMESERIES.
146+
Msg: 602: No permissions for this operation, please add privilege WRITE_DATA.
147147
```
148148

149149
### SQL 语句

‎docs/zh/UserGuide/Deployment-and-Maintenance/Security-Management.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ INSERT INTO root.ln.wf01.wt01(timestamp,status) values(1509465600000,true)
9595

9696
```
9797
IoTDB> INSERT INTO root.ln.wf01.wt01(timestamp,status) values(1509465600000,true)
98-
Msg: 602: No permissions for this operation, please add privilege INSERT_TIMESERIES.
98+
Msg: 602: No permissions for this operation, please add privilege WRITE_DATA.
9999
```
100100

101101
现在，我们用root用户分别赋予他们向对应 database 数据的写入权限.
@@ -151,7 +151,7 @@ Msg: The statement is executed successfully.
151151

152152
```
153153
INSERT INTO root.ln.wf01.wt01(timestamp, status) values(1509465600000, true)
154-
Msg: 602: No permissions for this operation, please add privilege INSERT_TIMESERIES.
154+
Msg: 602: No permissions for this operation, please add privilege WRITE_DATA.
155155
```
156156

157157
#### SQL 语句

‎docs/zh/UserGuide/SQL-Manual/SQL-Manual.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2051,7 +2051,7 @@ INSERT INTO root.ln.wf01.wt01(timestamp,status) values(1509465600000,true)
20512051

20522052
IoTDB> INSERT INTO root.ln.wf01.wt01(timestamp,status) values(1509465600000,true)
20532053

2054-
Msg: 602: No permissions for this operation, please add privilege INSERT_TIMESERIES.
2054+
Msg: 602: No permissions for this operation, please add privilege WRITE_DATA.
20552055

20562056
用root用户分别赋予他们向对应 database 数据的写入权限
20572057

@@ -2081,7 +2081,7 @@ REVOKE USER `ln_write_user` PRIVILEGES CREATE_USER
20812081

20822082
INSERT INTO root.ln.wf01.wt01(timestamp, status) values(1509465600000, true)
20832083

2084-
Msg: 602: No permissions for this operation, please add privilege INSERT_TIMESERIES.
2084+
Msg: 602: No permissions for this operation, please add privilege WRITE_DATA.
20852085

20862086
### 5、SQL 语句
20872087

‎docs/zh/UserGuide/User-Manuel/Authority-Management.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ INSERT INTO root.ln.wf01.wt01(timestamp,status) values(1509465600000,true)
9393

9494
```
9595
IoTDB> INSERT INTO root.ln.wf01.wt01(timestamp,status) values(1509465600000,true)
96-
Msg: 602: No permissions for this operation, please add privilege INSERT_TIMESERIES.
96+
Msg: 602: No permissions for this operation, please add privilege WRITE_DATA.
9797
```
9898

9999
现在，我们用root用户分别赋予他们向对应 database 数据的写入权限.
@@ -149,7 +149,7 @@ Msg: The statement is executed successfully.
149149

150150
```
151151
INSERT INTO root.ln.wf01.wt01(timestamp, status) values(1509465600000, true)
152-
Msg: 602: No permissions for this operation, please add privilege INSERT_TIMESERIES.
152+
Msg: 602: No permissions for this operation, please add privilege WRITE_DATA.
153153
```
154154

155155
### SQL 语句

‎integration-test/src/test/java/org/apache/iotdb/db/it/IoTDBAuthIT.java‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -362,7 +362,7 @@ public void rolePrivilegeTest() throws SQLException {
362362

363363
adminStmt.execute("CREATE ROLE admin");
364364
adminStmt.execute(
365-
"GRANT ROLE admin PRIVILEGES MANAGE_DATABASE,WRITE_SCHEMA,READ_DATA,WRITE_DATA on root.**");
365+
"GRANT ROLE admin PRIVILEGES MANAGE_DATABASE,WRITE_SCHEMA,WRITE_DATA on root.**");
366366
adminStmt.execute("GRANT admin TO tempuser");
367367

368368
userStmt.execute("CREATE DATABASE root.a");
@@ -495,15 +495,15 @@ public void testListUserPrivileges() throws SQLException {
495495
String ans =
496496
",root.a.b : READ_SCHEMA"
497497
+ ",\n"
498-
+ "role1,root.a.b.c : READ_DATA WRITE_DATA READ_SCHEMA"
498+
+ "role1,root.a.b.c : WRITE_DATA READ_SCHEMA"
499499
+ ",\n"
500-
+ "role1,root.d.b.c : READ_DATA WRITE_DATA READ_SCHEMA"
500+
+ "role1,root.d.b.c : WRITE_DATA READ_SCHEMA"
501501
+ ",\n";
502502
try {
503503
validateResultSet(resultSet, ans);
504504

505505
resultSet = adminStmt.executeQuery("LIST PRIVILEGES USER user1 ON root.a.b.c");
506-
ans = "role1,root.a.b.c : READ_DATA WRITE_DATA READ_SCHEMA,\n";
506+
ans = "role1,root.a.b.c : WRITE_DATA READ_SCHEMA,\n";
507507
validateResultSet(resultSet, ans);
508508

509509
adminStmt.execute("REVOKE role1 from user1");
@@ -540,19 +540,17 @@ public void testListRolePrivileges() throws SQLException {
540540
adminStmt.execute("GRANT ROLE role1 PRIVILEGES READ_SCHEMA,WRITE_DATA ON root.a.b.c");
541541
adminStmt.execute("GRANT ROLE role1 PRIVILEGES READ_SCHEMA,WRITE_DATA ON root.d.b.c");
542542
resultSet = adminStmt.executeQuery("LIST PRIVILEGES ROLE role1");
543-
ans =
544-
"root.a.b.c : READ_DATA WRITE_DATA READ_SCHEMA,\n"
545-
+ "root.d.b.c : READ_DATA WRITE_DATA READ_SCHEMA,\n";
543+
ans = "root.a.b.c : WRITE_DATA READ_SCHEMA,\n" + "root.d.b.c : WRITE_DATA READ_SCHEMA,\n";
546544
validateResultSet(resultSet, ans);
547545

548546
resultSet = adminStmt.executeQuery("LIST PRIVILEGES ROLE role1 ON root.a.b.c");
549-
ans = "root.a.b.c : READ_DATA WRITE_DATA READ_SCHEMA,\n";
547+
ans = "root.a.b.c : WRITE_DATA READ_SCHEMA,\n";
550548
validateResultSet(resultSet, ans);
551549

552550
adminStmt.execute("REVOKE ROLE role1 PRIVILEGES READ_SCHEMA,WRITE_DATA ON root.a.b.c");
553551

554552
resultSet = adminStmt.executeQuery("LIST PRIVILEGES ROLE role1");
555-
ans = "root.d.b.c : READ_DATA WRITE_DATA READ_SCHEMA,\n";
553+
ans = "root.d.b.c : WRITE_DATA READ_SCHEMA,\n";
556554
validateResultSet(resultSet, ans);
557555

558556
resultSet = adminStmt.executeQuery("LIST PRIVILEGES ROLE role1 ON root.a.b.c");

‎iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/AuthorityChecker.java‎

Lines changed: 48 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -72,26 +72,31 @@ public static boolean checkPermission(
7272
return true;
7373
}
7474

75-
int permission = translateToPermissionId(type);
76-
if (permission == -1) {
77-
return false;
78-
} else if (permission == PrivilegeType.ALTER_PASSWORD.ordinal()
79-
&& username.equals(targetUser)) {
80-
// A user can modify his own password
81-
return true;
82-
}
75+
int[] permissions = translateToPermissionId(type);
76+
for (int permission : permissions) {
77+
if (permission == -1) {
78+
continue;
79+
} else if (permission == PrivilegeType.ALTER_PASSWORD.ordinal()
80+
&& username.equals(targetUser)) {
81+
// A user can modify his own password
82+
return true;
83+
}
8384

84-
List<PartialPath> allPath = new ArrayList<>();
85-
if (paths != null && !paths.isEmpty()) {
86-
for (PartialPath path : paths) {
87-
allPath.add(path == null ? AuthUtils.ROOT_PATH_PRIVILEGE_PATH : path);
85+
List<PartialPath> allPath = new ArrayList<>();
86+
if (paths != null && !paths.isEmpty()) {
87+
for (PartialPath path : paths) {
88+
allPath.add(path == null ? AuthUtils.ROOT_PATH_PRIVILEGE_PATH : path);
89+
}
90+
} else {
91+
allPath.add(AuthUtils.ROOT_PATH_PRIVILEGE_PATH);
8892
}
89-
} else {
90-
allPath.add(AuthUtils.ROOT_PATH_PRIVILEGE_PATH);
91-
}
9293

93-
TSStatus status = authorizerManager.checkPath(username, allPath, permission);
94-
return status.getCode() == TSStatusCode.SUCCESS_STATUS.getStatusCode();
94+
TSStatus status = authorizerManager.checkPath(username, allPath, permission);
95+
if (status.getCode() == TSStatusCode.SUCCESS_STATUS.getStatusCode()) {
96+
return true;
97+
}
98+
}
99+
return false;
95100
}
96101

97102
private static boolean checkOnePath(String username, PartialPath path, int permission)
@@ -113,11 +118,16 @@ public static TSStatus checkAuthority(Statement statement, IClientSession sessio
113118
long startTime = System.nanoTime();
114119
try {
115120
if (!checkAuthorization(statement, session.getUsername())) {
116-
return RpcUtils.getStatus(
117-
TSStatusCode.NO_PERMISSION,
118-
"No permissions for this operation, please add privilege "
119-
+ PrivilegeType.values()[
120-
AuthorityChecker.translateToPermissionId(statement.getType())]);
121+
StringBuilder prompt =
122+
new StringBuilder("No permissions for this operation, please add privilege ");
123+
int[] permissions = translateToPermissionId(statement.getType());
124+
for (int i = 0; i < permissions.length; i++) {
125+
if (i != 0) {
126+
prompt.append(" or ");
127+
}
128+
prompt.append(PrivilegeType.values()[permissions[i]]);
129+
}
130+
return RpcUtils.getStatus(TSStatusCode.NO_PERMISSION, prompt.toString());
121131
}
122132
} catch (AuthException e) {
123133
logger.warn("Meets error while checking authorization.", e);
@@ -150,16 +160,18 @@ public static boolean checkAuthorization(Statement statement, String username)
150160
username, statement.getPaths(), statement.getType(), targetUser);
151161
}
152162

153-
private static int translateToPermissionId(StatementType type) {
163+
private static int[] translateToPermissionId(StatementType type) {
154164
switch (type) {
155165
case SHOW_SCHEMA_TEMPLATE:
156166
case SHOW_NODES_IN_SCHEMA_TEMPLATE:
157167
case SHOW_PATH_SET_SCHEMA_TEMPLATE:
158168
case SHOW_PATH_USING_SCHEMA_TEMPLATE:
159-
return PrivilegeType.READ_SCHEMA.ordinal();
169+
return new int[] {
170+
PrivilegeType.READ_SCHEMA.ordinal(), PrivilegeType.WRITE_SCHEMA.ordinal()
171+
};
160172
case STORAGE_GROUP_SCHEMA:
161173
case DELETE_STORAGE_GROUP:
162-
return PrivilegeType.MANAGE_DATABASE.ordinal();
174+
return new int[] {PrivilegeType.MANAGE_DATABASE.ordinal()};
163175
case TTL:
164176
case CREATE_TIMESERIES:
165177
case CREATE_ALIGNED_TIMESERIES:
@@ -177,7 +189,7 @@ private static int translateToPermissionId(StatementType type) {
177189
case ALTER_LOGICAL_VIEW:
178190
case RENAME_LOGICAL_VIEW:
179191
case DELETE_LOGICAL_VIEW:
180-
return PrivilegeType.WRITE_SCHEMA.ordinal();
192+
return new int[] {PrivilegeType.WRITE_SCHEMA.ordinal()};
181193
case SHOW:
182194
case QUERY:
183195
case GROUP_BY_TIME:
@@ -192,7 +204,7 @@ private static int translateToPermissionId(StatementType type) {
192204
case COUNT:
193205
case CREATE_FUNCTION:
194206
case DROP_FUNCTION:
195-
return PrivilegeType.READ_DATA.ordinal();
207+
return new int[] {PrivilegeType.READ_DATA.ordinal(), PrivilegeType.WRITE_DATA.ordinal()};
196208
case INSERT:
197209
case DELETE:
198210
case LOAD_DATA:
@@ -201,35 +213,35 @@ private static int translateToPermissionId(StatementType type) {
201213
case BATCH_INSERT_ONE_DEVICE:
202214
case BATCH_INSERT_ROWS:
203215
case MULTI_BATCH_INSERT:
204-
return PrivilegeType.WRITE_DATA.ordinal();
216+
return new int[] {PrivilegeType.WRITE_DATA.ordinal()};
205217
case CREATE_USER:
206218
case DELETE_USER:
207219
case LIST_USER:
208220
case LIST_USER_ROLES:
209221
case LIST_USER_PRIVILEGE:
210-
return PrivilegeType.MANAGE_USER.ordinal();
222+
return new int[] {PrivilegeType.MANAGE_USER.ordinal()};
211223
case CREATE_ROLE:
212224
case DELETE_ROLE:
213225
case LIST_ROLE:
214226
case LIST_ROLE_USERS:
215227
case LIST_ROLE_PRIVILEGE:
216-
return PrivilegeType.MANAGE_ROLE.ordinal();
228+
return new int[] {PrivilegeType.MANAGE_ROLE.ordinal()};
217229
case MODIFY_PASSWORD:
218-
return PrivilegeType.ALTER_PASSWORD.ordinal();
230+
return new int[] {PrivilegeType.ALTER_PASSWORD.ordinal()};
219231
case GRANT_USER_PRIVILEGE:
220232
case REVOKE_USER_PRIVILEGE:
221233
case GRANT_ROLE_PRIVILEGE:
222234
case REVOKE_ROLE_PRIVILEGE:
223235
case GRANT_USER_ROLE:
224236
case REVOKE_USER_ROLE:
225-
return PrivilegeType.GRANT_PRIVILEGE.ordinal();
237+
return new int[] {PrivilegeType.GRANT_PRIVILEGE.ordinal()};
226238
case CREATE_TRIGGER:
227239
case DROP_TRIGGER:
228-
return PrivilegeType.USE_TRIGGER.ordinal();
240+
return new int[] {PrivilegeType.USE_TRIGGER.ordinal()};
229241
case CREATE_CONTINUOUS_QUERY:
230242
case DROP_CONTINUOUS_QUERY:
231243
case SHOW_CONTINUOUS_QUERIES:
232-
return PrivilegeType.USE_CQ.ordinal();
244+
return new int[] {PrivilegeType.USE_CQ.ordinal()};
233245
case CREATE_PIPEPLUGIN:
234246
case DROP_PIPEPLUGIN:
235247
case SHOW_PIPEPLUGINS:
@@ -238,10 +250,10 @@ private static int translateToPermissionId(StatementType type) {
238250
case STOP_PIPE:
239251
case DROP_PIPE:
240252
case SHOW_PIPES:
241-
return PrivilegeType.USE_PIPE.ordinal();
253+
return new int[] {PrivilegeType.USE_PIPE.ordinal()};
242254
default:
243255
logger.error("Unrecognizable operator type ({}) for AuthorityChecker.", type);
244-
return -1;
256+
return new int[] {-1};
245257
}
246258
}
247259
}

‎iotdb-core/datanode/src/test/java/org/apache/iotdb/db/auth/authorizer/LocalFileAuthorizerTest.java‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -200,10 +200,8 @@ public void testUserRole() throws AuthException {
200200

201201
// a user can get all role permissions.
202202
Set<Integer> permissions = authorizer.getPrivileges(user.getName(), nodeName);
203-
assertEquals(4, permissions.size());
204-
assertTrue(permissions.contains(0));
203+
assertEquals(2, permissions.size());
205204
assertTrue(permissions.contains(1));
206-
assertTrue(permissions.contains(2));
207205
assertTrue(permissions.contains(3));
208206
assertFalse(permissions.contains(4));
209207

@@ -215,7 +213,7 @@ public void testUserRole() throws AuthException {
215213
// revoke a role from a user, the user will lose all role's permission
216214
authorizer.revokeRoleFromUser(roleName, user.getName());
217215
Set<Integer> revokeRolePermissions = authorizer.getPrivileges(user.getName(), nodeName);
218-
assertEquals(2, revokeRolePermissions.size());
216+
assertEquals(1, revokeRolePermissions.size());
219217
assertTrue(revokeRolePermissions.contains(1));
220218
assertFalse(revokeRolePermissions.contains(2));
221219

‎iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/auth/entity/PrivilegeType.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,9 @@
2929
/** This enum class contains all available privileges in IoTDB. */
3030
public enum PrivilegeType {
3131
READ_DATA(true),
32-
WRITE_DATA(true, true, READ_DATA),
32+
WRITE_DATA(true),
3333
READ_SCHEMA(true),
34-
WRITE_SCHEMA(true, true, READ_SCHEMA),
34+
WRITE_SCHEMA(true),
3535
MANAGE_USER,
3636
MANAGE_ROLE,
3737
GRANT_PRIVILEGE,

0 commit comments

Comments
 (0)