@Test public void testCheckUserAuthorizationByMappedDn() { final NiFiProperties nifiProperties = mock(NiFiProperties.class); final String mapKey = ".dn"; Set<String> propertyKeys = new LinkedHashSet<>(); propertyKeys.add(NiFiProperties.SECURITY_IDENTITY_MAPPING_PATTERN_PREFIX + mapKey); propertyKeys.add(NiFiProperties.SECURITY_IDENTITY_MAPPING_VALUE_PREFIX + mapKey); doReturn(propertyKeys).when(nifiProperties).getPropertyKeys(); final String mapPattern = "^CN=(.*?), OU=(.*?)$"; final String mapValue = "$1@$2"; doReturn(mapPattern).when(nifiProperties).getProperty(eq(NiFiProperties.SECURITY_IDENTITY_MAPPING_PATTERN_PREFIX + mapKey)); doReturn(mapValue).when(nifiProperties).getProperty(eq(NiFiProperties.SECURITY_IDENTITY_MAPPING_VALUE_PREFIX + mapKey)); final RootGroupPort port = createRootGroupPort(nifiProperties); PortAuthorizationResult authResult = port.checkUserAuthorization("CN=node2, OU=nifi.test"); Assert.assertFalse(authResult.isAuthorized()); authResult = port.checkUserAuthorization("CN=node1, OU=nifi.test"); Assert.assertTrue(authResult.isAuthorized()); }
@Override public PortAuthorizationResult checkUserAuthorization(final String dn) { if (!secure) { return new StandardPortAuthorizationResult(true, "Site-to-Site is not Secure"); } if (dn == null) { final String message = String.format("%s authorization failed for user %s because the DN is unknown", this, dn); logger.warn(message); eventReporter.reportEvent(Severity.WARNING, CATEGORY, message); return new StandardPortAuthorizationResult(false, "User DN is not known"); } final String identity = IdentityMappingUtil.mapIdentity(dn, identityMappings); return checkUserAuthorization(new StandardNiFiUser(identity)); }
StandardRootGroupPort extends AbstractPort implements RootGroupPort { @Override public PortAuthorizationResult checkUserAuthorization(final String dn) { if (!secure) { return new StandardPortAuthorizationResult(true, "Site-to-Site is not Secure"); } if (dn == null) { final String message = String.format("%s authorization failed for user %s because the DN is unknown", this, dn); logger.warn(message); eventReporter.reportEvent(Severity.WARNING, CATEGORY, message); return new StandardPortAuthorizationResult(false, "User DN is not known"); } final String identity = IdentityMappingUtil.mapIdentity(dn, identityMappings); return checkUserAuthorization(new StandardNiFiUser(identity)); } }
StandardRootGroupPort extends AbstractPort implements RootGroupPort { @Override public PortAuthorizationResult checkUserAuthorization(final String dn) { if (!secure) { return new StandardPortAuthorizationResult(true, "Site-to-Site is not Secure"); } if (dn == null) { final String message = String.format("%s authorization failed for user %s because the DN is unknown", this, dn); logger.warn(message); eventReporter.reportEvent(Severity.WARNING, CATEGORY, message); return new StandardPortAuthorizationResult(false, "User DN is not known"); } final String identity = IdentityMappingUtil.mapIdentity(dn, identityMappings); return checkUserAuthorization(new StandardNiFiUser(identity)); } StandardRootGroupPort(final String id, final String name, final ProcessGroup processGroup,
            final TransferDirection direction, final ConnectableType type, final Authorizer authorizer,
            final BulletinRepository bulletinRepository, final ProcessScheduler scheduler, final boolean secure,
            final NiFiProperties nifiProperties); }
StandardRootGroupPort extends AbstractPort implements RootGroupPort { @Override public PortAuthorizationResult checkUserAuthorization(final String dn) { if (!secure) { return new StandardPortAuthorizationResult(true, "Site-to-Site is not Secure"); } if (dn == null) { final String message = String.format("%s authorization failed for user %s because the DN is unknown", this, dn); logger.warn(message); eventReporter.reportEvent(Severity.WARNING, CATEGORY, message); return new StandardPortAuthorizationResult(false, "User DN is not known"); } final String identity = IdentityMappingUtil.mapIdentity(dn, identityMappings); return checkUserAuthorization(new StandardNiFiUser(identity)); } StandardRootGroupPort(final String id, final String name, final ProcessGroup processGroup,
            final TransferDirection direction, final ConnectableType type, final Authorizer authorizer,
            final BulletinRepository bulletinRepository, final ProcessScheduler scheduler, final boolean secure,
            final NiFiProperties nifiProperties); @Override Collection<Relationship> getRelationships(); @Override boolean isTriggerWhenEmpty(); @Override void onTrigger(final ProcessContext context, final ProcessSessionFactory sessionFactory); @Override void onTrigger(ProcessContext context, ProcessSession session); @Override boolean isValid(); @Override Collection<ValidationResult> getValidationErrors(); @Override boolean isTransmitting(); @Override void setGroupAccessControl(Set<String> groups); @Override Set<String> getGroupAccessControl(); @Override void setUserAccessControl(Set<String> users); @Override Set<String> getUserAccessControl(); @Override void shutdown(); @Override void onSchedulingStart(); @Override PortAuthorizationResult checkUserAuthorization(final String dn); @Override PortAuthorizationResult checkUserAuthorization(NiFiUser user); @Override int receiveFlowFiles(final Peer peer, final ServerProtocol serverProtocol); @Override int transferFlowFiles(final Peer peer, final ServerProtocol serverProtocol); @Override SchedulingStrategy getSchedulingStrategy(); @Override boolean isSideEffectFree(); @Override String getComponentType(); }
StandardRootGroupPort extends AbstractPort implements RootGroupPort { @Override public PortAuthorizationResult checkUserAuthorization(final String dn) { if (!secure) { return new StandardPortAuthorizationResult(true, "Site-to-Site is not Secure"); } if (dn == null) { final String message = String.format("%s authorization failed for user %s because the DN is unknown", this, dn); logger.warn(message); eventReporter.reportEvent(Severity.WARNING, CATEGORY, message); return new StandardPortAuthorizationResult(false, "User DN is not known"); } final String identity = IdentityMappingUtil.mapIdentity(dn, identityMappings); return checkUserAuthorization(new StandardNiFiUser(identity)); } StandardRootGroupPort(final String id, final String name, final ProcessGroup processGroup,
            final TransferDirection direction, final ConnectableType type, final Authorizer authorizer,
            final BulletinRepository bulletinRepository, final ProcessScheduler scheduler, final boolean secure,
            final NiFiProperties nifiProperties); @Override Collection<Relationship> getRelationships(); @Override boolean isTriggerWhenEmpty(); @Override void onTrigger(final ProcessContext context, final ProcessSessionFactory sessionFactory); @Override void onTrigger(ProcessContext context, ProcessSession session); @Override boolean isValid(); @Override Collection<ValidationResult> getValidationErrors(); @Override boolean isTransmitting(); @Override void setGroupAccessControl(Set<String> groups); @Override Set<String> getGroupAccessControl(); @Override void setUserAccessControl(Set<String> users); @Override Set<String> getUserAccessControl(); @Override void shutdown(); @Override void onSchedulingStart(); @Override PortAuthorizationResult checkUserAuthorization(final String dn); @Override PortAuthorizationResult checkUserAuthorization(NiFiUser user); @Override int receiveFlowFiles(final Peer peer, final ServerProtocol serverProtocol); @Override int transferFlowFiles(final Peer peer, final ServerProtocol serverProtocol); @Override SchedulingStrategy getSchedulingStrategy(); @Override boolean isSideEffectFree(); @Override String getComponentType();  }