Support for filtering authorized models based on the defined RBAC rules. #575
Conversation
Signed-off-by: Mohammad Ghazanfar Ali Danish <ghazanfar.danish@iese.fraunhofer.de>
Signed-off-by: Mohammad Ghazanfar Ali Danish <ghazanfar.danish@iese.fraunhofer.de>
Signed-off-by: Mohammad Ghazanfar Ali Danish <ghazanfar.danish@iese.fraunhofer.de>
Signed-off-by: Mohammad Ghazanfar Ali Danish <ghazanfar.danish@iese.fraunhofer.de>
Signed-off-by: Mohammad Ghazanfar Ali Danish <ghazanfar.danish@iese.fraunhofer.de>
Signed-off-by: Mohammad Ghazanfar Ali Danish <ghazanfar.danish@iese.fraunhofer.de>
Signed-off-by: Mohammad Ghazanfar Ali Danish <ghazanfar.danish@iese.fraunhofer.de>
Signed-off-by: Mohammad Ghazanfar Ali Danish <ghazanfar.danish@iese.fraunhofer.de>
Signed-off-by: Mohammad Ghazanfar Ali Danish <ghazanfar.danish@iese.fraunhofer.de>
Signed-off-by: Mohammad Ghazanfar Ali Danish <ghazanfar.danish@iese.fraunhofer.de>
Signed-off-by: Mohammad Ghazanfar Ali Danish <ghazanfar.danish@iese.fraunhofer.de>
Signed-off-by: Mohammad Ghazanfar Ali Danish <ghazanfar.danish@iese.fraunhofer.de>
Signed-off-by: Mohammad Ghazanfar Ali Danish <ghazanfar.danish@iese.fraunhofer.de>
Signed-off-by: Mohammad Ghazanfar Ali Danish <ghazanfar.danish@iese.fraunhofer.de>
Signed-off-by: Mohammad Ghazanfar Ali Danish <ghazanfar.danish@iese.fraunhofer.de>
Signed-off-by: Mohammad Ghazanfar Ali Danish <ghazanfar.danish@iese.fraunhofer.de>
Signed-off-by: Mohammad Ghazanfar Ali Danish <ghazanfar.danish@iese.fraunhofer.de>
Signed-off-by: Mohammad Ghazanfar Ali Danish <ghazanfar.danish@iese.fraunhofer.de>
…ltered-models-in-auth
Signed-off-by: Mohammad Ghazanfar Ali Danish <ghazanfar.danish@iese.fraunhofer.de>
| try { | ||
| return getAasDescriptor(id); | ||
| } catch (Exception e) { | ||
| return null; | ||
| } |
There was a problem hiding this comment.
Here, logging could be added for better debugging in the case of a failed execution of getAasDescriptor. What do you think?
| } | ||
| }).filter(Objects::nonNull).collect(Collectors.toList()); | ||
|
|
||
| TreeMap<String, AssetAdministrationShellDescriptor> aasMap = aasDescriptors.stream().collect(Collectors.toMap(AssetAdministrationShellDescriptor::getId, aas -> aas, (a, b) -> a, TreeMap::new)); |
There was a problem hiding this comment.
Is a TreeMap actually necessary here or would be a HashMap sufficient. This would improve performance.
There was a problem hiding this comment.
same possible remarks as for AuthorizedAasRegistryStorage.java
|
|
||
| List<String> roles = roleAuthenticator.getRoles(); | ||
|
|
||
| List<RbacRule> filteredRbacRulesForTargetInfos = roles.stream().map(role -> RbacRuleKeyGenerator.generateKey(role, action.toString(), targetInformation.getClass().getName())).filter(rbacStorage::exist).map(rbacStorage::getRbacRule).collect(Collectors.toList()); |
There was a problem hiding this comment.
Potential exceptions that might arise from rbacStorage::exist and rbacStorage::getRbacRule are not handled here. Maybe use a try-catch block
There was a problem hiding this comment.
The method assumes that rbacStorage::getRbacRule will always return a non-null RbacRule. If it returns null, calling getTargetInformation() on null will cause a NullPointerException.
There was a problem hiding this comment.
same possible remarks as for AuthorizedAasRegistryStorage.java
There was a problem hiding this comment.
same possible remarks as for AuthorizedAasRegistryStorage.java
There was a problem hiding this comment.
same possible remarks as for AuthorizedAasRegistryStorage.java
Signed-off-by: Mohammad Ghazanfar Ali Danish <ghazanfar.danish@iese.fraunhofer.de>
…ltered-models-in-auth
Description of Changes
This PR adds support for filtering authorized models based on the access rules. Currently, only the admin or any user with target information as wildcard (*) can access the models (e.g., AAS/SM/CD). However, to better control the access there should be a mechanism to allow only the authorized models when getAll* endpoint is called. This is very important for the AAS GUI when authorization is enabled.
Please note that it can be replaced by #516, once #516 is ready and supports all filtering options to match the refactored filtering mechanism.