Class CassandraAuthorizer

  • All Implemented Interfaces:
    IAuthorizer

    public class CassandraAuthorizer
    extends java.lang.Object
    implements IAuthorizer
    CassandraAuthorizer is an IAuthorizer implementation that keeps user permissions internally in C* using the system_auth.role_permissions table.
    • Constructor Detail

      • CassandraAuthorizer

        public CassandraAuthorizer()
    • Method Detail

      • authorize

        public java.util.Set<Permission> authorize​(AuthenticatedUser user,
                                                   IResource resource)
        Description copied from interface: IAuthorizer
        Returns a set of permissions of a user on a resource. Since Roles were introduced in version 2.2, Cassandra does not distinguish in any meaningful way between users and roles. A role may or may not have login privileges and roles may be granted to other roles. In fact, Cassandra does not really have the concept of a user, except to link a client session to role. AuthenticatedUser can be thought of as a manifestation of a role, linked to a specific client connection.
        Specified by:
        authorize in interface IAuthorizer
        Parameters:
        user - Authenticated user requesting authorization.
        resource - Resource for which the authorization is being requested. @see DataResource.
        Returns:
        Set of permissions of the user on the resource. Should never return null. Use Permission.NONE instead.
      • revokeAllFrom

        public void revokeAllFrom​(RoleResource revokee)
        Description copied from interface: IAuthorizer
        Called before deleting a role with DROP ROLE statement (or the alias provided for compatibility, DROP USER) so that a new role with the same name wouldn't inherit permissions of the deleted one in the future. This removes all permissions granted to the Role in question. This method is optional and may be called internally, so implementations which do not support it should be sure to throw UnsupportedOperationException.
        Specified by:
        revokeAllFrom in interface IAuthorizer
        Parameters:
        revokee - The role to revoke all permissions from.
      • revokeAllOn

        public void revokeAllOn​(IResource droppedResource)
        Description copied from interface: IAuthorizer
        This method is called after a resource is removed (i.e. keyspace, table or role is dropped) and revokes all permissions granted on the IResource in question. This method is optional and may be called internally, so implementations which do not support it should be sure to throw UnsupportedOperationException.
        Specified by:
        revokeAllOn in interface IAuthorizer
        Parameters:
        droppedResource - The resource to revoke all permissions on.
      • list

        public java.util.Set<PermissionDetails> list​(AuthenticatedUser performer,
                                                     java.util.Set<Permission> permissions,
                                                     IResource resource,
                                                     RoleResource grantee)
                                              throws RequestValidationException,
                                                     RequestExecutionException
        Description copied from interface: IAuthorizer
        Returns a list of permissions on a resource granted to a role. This method is optional and may be called internally, so implementations which do not support it should be sure to throw UnsupportedOperationException.
        Specified by:
        list in interface IAuthorizer
        Parameters:
        performer - User who wants to see the permissions.
        permissions - Set of Permission values the user is interested in. The result should only include the matching ones.
        resource - The resource on which permissions are requested. Can be null, in which case permissions on all resources should be returned.
        grantee - The role whose permissions are requested. Can be null, in which case permissions of every role should be returned.
        Returns:
        All of the matching permission that the requesting user is authorized to know about.
        Throws:
        RequestValidationException
        RequestExecutionException
      • protectedResources

        public java.util.Set<DataResource> protectedResources()
        Description copied from interface: IAuthorizer
        Set of resources that should be made inaccessible to users and only accessible internally.
        Specified by:
        protectedResources in interface IAuthorizer
        Returns:
        Keyspaces, column families that will be unmodifiable by users; other resources.
      • setup

        public void setup()
        Description copied from interface: IAuthorizer
        Setup is called once upon system startup to initialize the IAuthorizer. For example, use this method to create any required keyspaces/column families.
        Specified by:
        setup in interface IAuthorizer