Fix the regression from apache#6428 (apache#7241)

### Motivation In apache#6708, we change to use `isSuperUser(String, AuthenticationDataSource, ServiceConfiguration)` for the dynamic check of superuser using AuthenticationDataSource. And apache#6428 is using old method `isSuperUser(String, ServiceConfiguration)`, This change tries to change it back. ### Modifications switch `isSuperUser(String, ServiceConfiguration)` to `isSuperUser(String, AuthenticationDataSource, ServiceConfiguration)`
zxw7606 · Jun 24, 2020 · 45afb56 · 45afb56
1 parent 3708c93
commit 45afb56
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 11 deletions.
diff --git a/...er-common/src/main/java/org/apache/pulsar/broker/authorization/AuthorizationProvider.java b/...er-common/src/main/java/org/apache/pulsar/broker/authorization/AuthorizationProvider.java
@@ -47,25 +47,27 @@ public interface AuthorizationProvider extends Closeable {
     /**
      * Check if specified role is a super user
      * @param role the role to check
+     * @param authenticationData authentication data related to the role
      * @return a CompletableFuture containing a boolean in which true means the role is a super user
      * and false if it is not
      */
-    default CompletableFuture<Boolean> isSuperUser(String role, ServiceConfiguration serviceConfiguration) {
+    default CompletableFuture<Boolean> isSuperUser(String role,
+                                                   AuthenticationDataSource authenticationData,
+                                                   ServiceConfiguration serviceConfiguration) {
         Set<String> superUserRoles = serviceConfiguration.getSuperUserRoles();
         return CompletableFuture.completedFuture(role != null && superUserRoles.contains(role) ? true : false);
     }
 
     /**
+     * @deprecated Use method {@link #isSuperUser(String, AuthenticationDataSource, ServiceConfiguration)}
      * Check if specified role is a super user
      * @param role the role to check
-     * @param authenticationData authentication data related to the role
      * @return a CompletableFuture containing a boolean in which true means the role is a super user
      * and false if it is not
      */
-    default CompletableFuture<Boolean> isSuperUser(String role,
-                                                   AuthenticationDataSource authenticationData,
-                                                   ServiceConfiguration serviceConfiguration) {
-        return isSuperUser(role, serviceConfiguration);
+    default CompletableFuture<Boolean> isSuperUser(String role, ServiceConfiguration serviceConfiguration) {
+        Set<String> superUserRoles = serviceConfiguration.getSuperUserRoles();
+        return CompletableFuture.completedFuture(role != null && superUserRoles.contains(role) ? true : false);
     }
 
     /**

diff --git a/...mon/src/main/java/org/apache/pulsar/broker/authorization/PulsarAuthorizationProvider.java b/...mon/src/main/java/org/apache/pulsar/broker/authorization/PulsarAuthorizationProvider.java
@@ -322,7 +322,7 @@ public CompletableFuture<Void> revokeSubscriptionPermissionAsync(NamespaceName n
             String role, String authDataJson) {
         return updateSubscriptionPermissionAsync(namespace, subscriptionName, Collections.singleton(role), true);
     }
-    
+
     private CompletableFuture<Void> updateSubscriptionPermissionAsync(NamespaceName namespace, String subscriptionName, Set<String> roles,
             boolean remove) {
         CompletableFuture<Void> result = new CompletableFuture<>();
@@ -549,7 +549,7 @@ public CompletableFuture<Boolean> allowTopicOperationAsync(TopicName topicName,
                     new IllegalStateException("TopicOperation is not supported."));
         }
 
-        CompletableFuture<Boolean> isSuperUserFuture = isSuperUser(role, conf);
+        CompletableFuture<Boolean> isSuperUserFuture = isSuperUser(role, authData, conf);
 
         return isSuperUserFuture
                 .thenCombine(isAuthorizedFuture, (isSuperUser, isAuthorized) -> isSuperUser || isAuthorized);
@@ -573,14 +573,14 @@ private CompletableFuture<Boolean> validateTenantAdminAccess(String tenantName,
 
             if (role != null && conf.getProxyRoles().contains(role)) {
                 // role check
-                CompletableFuture<Boolean> isRoleSuperUserFuture = isSuperUser(role, conf);
+                CompletableFuture<Boolean> isRoleSuperUserFuture = isSuperUser(role, authData, conf);
                 CompletableFuture<Boolean> isRoleTenantAdminFuture = isTenantAdmin(tenantName, role, tenantInfo, authData);
                 CompletableFuture<Boolean> isRoleAuthorizedFuture = isRoleSuperUserFuture
                         .thenCombine(isRoleTenantAdminFuture, (isRoleSuperUser, isRoleTenantAdmin) ->
                                 isRoleSuperUser || isRoleTenantAdmin);
 
                 // originalRole check
-                CompletableFuture<Boolean> isOriginalRoleSuperUserFuture = isSuperUser(originalRole, conf);
+                CompletableFuture<Boolean> isOriginalRoleSuperUserFuture = isSuperUser(originalRole, authData, conf);
                 CompletableFuture<Boolean> isOriginalRoleTenantAdminFuture = isTenantAdmin(tenantName, originalRole,
                         tenantInfo, authData);
                 CompletableFuture<Boolean> isOriginalRoleAuthorizedFuture = isOriginalRoleSuperUserFuture
@@ -593,7 +593,7 @@ private CompletableFuture<Boolean> validateTenantAdminAccess(String tenantName,
                                 isRoleAuthorized && isOriginalRoleAuthorized);
             } else {
                 // role check
-                CompletableFuture<Boolean> isRoleSuperUserFuture = isSuperUser(role, conf);
+                CompletableFuture<Boolean> isRoleSuperUserFuture = isSuperUser(role, authData, conf);
                 CompletableFuture<Boolean> isRoleTenantAdminFuture = isTenantAdmin(tenantName, role, tenantInfo, authData);
                 return isRoleSuperUserFuture
                         .thenCombine(isRoleTenantAdminFuture, (isRoleSuperUser, isRoleTenantAdmin) ->