Skip to content

Commit c92ef24

Browse files
qyryqqyryq
authored
Check EnforceUserTokenRequirement together with RequireCredentialsInNewProtocol (and set the latter's default to false) (#12411)
1 parent 3297bd9 commit c92ef24

File tree

11 files changed

+19
-19
lines changed

11 files changed

+19
-19
lines changed

‎ydb/core/protos/pqconfig.proto‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ message TPQConfig {
6262

6363
optional NKikimrClient.TKeyValueRequest.ETactic Tactic = 13 [default = MAX_THROUGHPUT];
6464

65-
optional bool RequireCredentialsInNewProtocol = 14 [default = true];
65+
optional bool RequireCredentialsInNewProtocol = 14 [default = false];
6666

6767
optional string ClusterTablePath = 15 [default = ""];
6868
optional string VersionTablePath = 16 [default = ""];

‎ydb/services/datastreams/datastreams_proxy.cpp‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -950,7 +950,7 @@ namespace NKikimr::NDataStreams::V1 {
950950
}
951951

952952
if (this->Request_->GetSerializedToken().empty()) {
953-
if (AppData(ctx)->PQConfig.GetRequireCredentialsInNewProtocol()) {
953+
if (AppData(ctx)->EnforceUserTokenRequirement || AppData(ctx)->PQConfig.GetRequireCredentialsInNewProtocol()) {
954954
return ReplyWithError(Ydb::StatusIds::UNAUTHORIZED, NYds::EErrorCodes::BAD_REQUEST,
955955
"Unauthenticated access is forbidden, please provide credentials", ctx);
956956
}
@@ -1434,7 +1434,7 @@ namespace NKikimr::NDataStreams::V1 {
14341434
const NSchemeCache::TSchemeCacheNavigate* navigate = ev->Get()->Request.Get();
14351435
auto topicInfo = navigate->ResultSet.begin();
14361436
StreamName = NKikimr::CanonizePath(topicInfo->Path);
1437-
if (AppData(ActorContext())->PQConfig.GetRequireCredentialsInNewProtocol()) {
1437+
if (AppData(ActorContext())->EnforceUserTokenRequirement || AppData(ActorContext())->PQConfig.GetRequireCredentialsInNewProtocol()) {
14381438
NACLib::TUserToken token(this->Request_->GetSerializedToken());
14391439

14401440
if (!topicInfo->SecurityObject->CheckAccess(NACLib::EAccessRights::SelectRow,
@@ -1601,7 +1601,7 @@ namespace NKikimr::NDataStreams::V1 {
16011601
const auto &result = ev->Get()->Request.Get();
16021602
const auto response = result->ResultSet.front();
16031603

1604-
if (AppData(ActorContext())->PQConfig.GetRequireCredentialsInNewProtocol()) {
1604+
if (AppData(ActorContext())->EnforceUserTokenRequirement || AppData(ActorContext())->PQConfig.GetRequireCredentialsInNewProtocol()) {
16051605
NACLib::TUserToken token(this->Request_->GetSerializedToken());
16061606

16071607
if (!response.SecurityObject->CheckAccess(NACLib::EAccessRights::SelectRow,
@@ -1861,7 +1861,7 @@ namespace NKikimr::NDataStreams::V1 {
18611861

18621862
const NSchemeCache::TSchemeCacheNavigate* navigate = ev->Get()->Request.Get();
18631863
auto topicInfo = navigate->ResultSet.front();
1864-
if (AppData(ctx)->PQConfig.GetRequireCredentialsInNewProtocol()) {
1864+
if (AppData(ctx)->EnforceUserTokenRequirement || AppData(ctx)->PQConfig.GetRequireCredentialsInNewProtocol()) {
18651865
NACLib::TUserToken token(this->Request_->GetSerializedToken());
18661866

18671867
if (!topicInfo.SecurityObject->CheckAccess(NACLib::EAccessRights::SelectRow,

‎ydb/services/datastreams/put_records_actor.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -286,7 +286,7 @@ namespace NKikimr::NDataStreams::V1 {
286286
}
287287

288288
if (this->Request_->GetSerializedToken().empty()) {
289-
if (AppData(ctx)->PQConfig.GetRequireCredentialsInNewProtocol()) {
289+
if (AppData(ctx)->EnforceUserTokenRequirement || AppData(ctx)->PQConfig.GetRequireCredentialsInNewProtocol()) {
290290
return this->ReplyWithError(Ydb::StatusIds::UNAUTHORIZED,
291291
Ydb::PersQueue::ErrorCode::ACCESS_DENIED,
292292
TStringBuilder() << "Access to stream "
@@ -324,7 +324,7 @@ namespace NKikimr::NDataStreams::V1 {
324324

325325
const NSchemeCache::TSchemeCacheNavigate* navigate = ev->Get()->Request.Get();
326326
auto topicInfo = navigate->ResultSet.begin();
327-
if (AppData(this->ActorContext())->PQConfig.GetRequireCredentialsInNewProtocol()) {
327+
if (AppData(this->ActorContext())->EnforceUserTokenRequirement || AppData(this->ActorContext())->PQConfig.GetRequireCredentialsInNewProtocol()) {
328328
NACLib::TUserToken token(this->Request_->GetSerializedToken());
329329
if (!topicInfo->SecurityObject->CheckAccess(NACLib::EAccessRights::UpdateRow, token)) {
330330
return this->ReplyWithError(Ydb::StatusIds::UNAUTHORIZED,

‎ydb/services/deprecated/persqueue_v0/grpc_pq_read_actor.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -705,7 +705,7 @@ void TReadSessionActor::Handle(TEvPQProxy::TEvReadInit::TPtr& ev, const TActorCo
705705
if (SessionsWithoutAuth) {
706706
++(*SessionsWithoutAuth);
707707
}
708-
if (AppData(ctx)->PQConfig.GetRequireCredentialsInNewProtocol()) {
708+
if (AppData(ctx)->EnforceUserTokenRequirement || AppData(ctx)->PQConfig.GetRequireCredentialsInNewProtocol()) {
709709
CloseSession("Unauthenticated access is forbidden, please provide credentials", NPersQueue::NErrorCode::ACCESS_DENIED, ctx);
710710
return;
711711
}

‎ydb/services/deprecated/persqueue_v0/grpc_pq_write_actor.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -405,7 +405,7 @@ void TWriteSessionActor::Handle(TEvDescribeTopicsResponse::TPtr& ev, const TActo
405405
LOG_WARN_S(ctx, NKikimrServices::PQ_WRITE_PROXY, "session without AuthInfo : " << DiscoveryConverter->GetPrintableString()
406406
<< " sourceId " << SourceId << " from " << PeerName);
407407
SessionsWithoutAuth.Inc();
408-
if (AppData(ctx)->PQConfig.GetRequireCredentialsInNewProtocol()) {
408+
if (AppData(ctx)->EnforceUserTokenRequirement || AppData(ctx)->PQConfig.GetRequireCredentialsInNewProtocol()) {
409409
CloseSession("Unauthenticated access is forbidden, please provide credentials", NPersQueue::NErrorCode::ACCESS_DENIED, ctx);
410410
return;
411411
}

‎ydb/services/lib/actors/pq_schema_actor.h‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -320,7 +320,7 @@ namespace NKikimr::NGRpcProxy::V1 {
320320
SetDatabase(proposal.get(), *this->Request_);
321321

322322
if (this->Request_->GetSerializedToken().empty()) {
323-
if (AppData(ctx)->PQConfig.GetRequireCredentialsInNewProtocol()) {
323+
if (AppData(ctx)->EnforceUserTokenRequirement || AppData(ctx)->PQConfig.GetRequireCredentialsInNewProtocol()) {
324324
return ReplyWithError(Ydb::StatusIds::UNAUTHORIZED, Ydb::PersQueue::ErrorCode::ACCESS_DENIED,
325325
"Unauthenticated access is forbidden, please provide credentials");
326326
}
@@ -344,7 +344,7 @@ namespace NKikimr::NGRpcProxy::V1 {
344344
request->UserToken = new NACLib::TUserToken(token);
345345
return true;
346346
}
347-
return !(AppData()->PQConfig.GetRequireCredentialsInNewProtocol());
347+
return !(AppData()->EnforceUserTokenRequirement || AppData()->PQConfig.GetRequireCredentialsInNewProtocol());
348348
}
349349

350350
bool ProcessCdc(const NSchemeCache::TSchemeCacheNavigate::TEntry& response) override {
@@ -572,7 +572,7 @@ namespace NKikimr::NGRpcProxy::V1 {
572572

573573
bool SetRequestToken(NSchemeCache::TSchemeCacheNavigate* request) const override {
574574
if (Request.Token.empty()) {
575-
return !(AppData()->PQConfig.GetRequireCredentialsInNewProtocol());
575+
return !(AppData()->EnforceUserTokenRequirement || AppData()->PQConfig.GetRequireCredentialsInNewProtocol());
576576
} else {
577577
request->UserToken = new NACLib::TUserToken(Request.Token);
578578
return true;

‎ydb/services/persqueue_v1/actors/commit_offset_actor.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ void TCommitOffsetActor::Bootstrap(const TActorContext& ctx) {
4444

4545
TIntrusivePtr<NACLib::TUserToken> token;
4646
if (Request_->GetSerializedToken().empty()) {
47-
if (AppData(ctx)->PQConfig.GetRequireCredentialsInNewProtocol()) {
47+
if (AppData(ctx)->EnforceUserTokenRequirement || AppData(ctx)->PQConfig.GetRequireCredentialsInNewProtocol()) {
4848
AnswerError("Unauthenticated access is forbidden, please provide credentials", PersQueue::ErrorCode::ACCESS_DENIED, ctx);
4949
return;
5050
}

‎ydb/services/persqueue_v1/actors/direct_read_actor.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -246,7 +246,7 @@ void TDirectReadSessionActor::Handle(TEvPQProxy::TEvInitDirectRead::TPtr& ev, co
246246
}
247247

248248
if (Request->GetSerializedToken().empty()) {
249-
if (AppData(ctx)->PQConfig.GetRequireCredentialsInNewProtocol()) {
249+
if (AppData(ctx)->EnforceUserTokenRequirement || AppData(ctx)->PQConfig.GetRequireCredentialsInNewProtocol()) {
250250
return CloseSession(PersQueue::ErrorCode::ACCESS_DENIED,
251251
"unauthenticated access is forbidden, please provide credentials");
252252
}

‎ydb/services/persqueue_v1/actors/read_info_actor.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ void TReadInfoActor::Bootstrap(const TActorContext& ctx) {
4545

4646
TIntrusivePtr<NACLib::TUserToken> token;
4747
if (Request_->GetSerializedToken().empty()) {
48-
if (AppData(ctx)->PQConfig.GetRequireCredentialsInNewProtocol()) {
48+
if (AppData(ctx)->EnforceUserTokenRequirement || AppData(ctx)->PQConfig.GetRequireCredentialsInNewProtocol()) {
4949
AnswerError("Unauthenticated access is forbidden, please provide credentials", PersQueue::ErrorCode::ACCESS_DENIED, ctx);
5050
return;
5151
}

‎ydb/services/persqueue_v1/actors/read_session_actor.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -809,7 +809,7 @@ void TReadSessionActor<UseMigrationProtocol>::Handle(typename TEvReadInit::TPtr&
809809
}
810810

811811
if (Request->GetSerializedToken().empty()) {
812-
if (AppData(ctx)->PQConfig.GetRequireCredentialsInNewProtocol()) {
812+
if (AppData(ctx)->EnforceUserTokenRequirement || AppData(ctx)->PQConfig.GetRequireCredentialsInNewProtocol()) {
813813
return CloseSession(PersQueue::ErrorCode::ACCESS_DENIED,
814814
"unauthenticated access is forbidden, please provide credentials", ctx);
815815
}

0 commit comments

Comments
 (0)