yujunjun/OpenMetadata
1
0
Fork 0
mirror of https://github.com/open-metadata/OpenMetadata.git synced 2025-10-11 16:58:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixes #8313 Deprecate botPrincipals from open metadata configuration (#8314)

Browse Source
This commit is contained in:
Suresh Srinivas 2022-10-21 20:49:41 -07:00 committed by GitHub
parent 268d1171f1
commit 0d75eb9ff2
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
23 changed files with 18 additions and 61 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
conf/openmetadata.yaml
View File

@ -137,7 +137,6 @@ authorizerConfiguration:
containerRequestFilter: ${AUTHORIZER_REQUEST_FILTER:-org.openmetadata.service.security.JwtFilter}
adminPrincipals: ${AUTHORIZER_ADMIN_PRINCIPALS:-[admin]}
allowedEmailRegistrationDomains: ${AUTHORIZER_ALLOWED_REGISTRATION_DOMAIN:-["all"]}
botPrincipals: ${AUTHORIZER_INGESTION_PRINCIPALS:-[ingestion-bot]}
principalDomain: ${AUTHORIZER_PRINCIPAL_DOMAIN:-"openmetadata.org"}
enforcePrincipalDomain: ${AUTHORIZER_ENFORCE_PRINCIPAL_DOMAIN:-false}
enableSecureSocketConnection : ${AUTHORIZER_ENABLE_SECURE_SOCKET:-false}

1
openmetadata-docs/content/deployment/kubernetes/values.md
View File

@ -27,7 +27,6 @@ This page list all the supported helm values for OpenMetadata Helm Charts.
| global.authorizer.enforcePrincipalDomain | bool | `false` |
| global.authorizer.enableSecureSocketConnection | bool | `false` |
| global.authorizer.initialAdmins | list | `[admin]` |
| global.authorizer.botPrincipals | list | `[ingestion-bot]` |
| global.authorizer.principalDomain | string | `open-metadata.org` |
| global.airflow.auth.password.secretRef | string | `airflow-secrets` |
| global.airflow.auth.password.secretKey | string | `openmetadata-airflow-password` |

2
openmetadata-docs/content/deployment/security/amazon-cognito-sso/bare-metal.md
View File

@ -33,8 +33,6 @@ authorizerConfiguration:
adminPrincipals:
- "user1"
- "user2"
botPrincipals:
- "ingestion-bot"
principalDomain: "open-metadata.org"
```

2
openmetadata-docs/content/deployment/security/amazon-cognito-sso/kubernetes.md
View File

@ -18,8 +18,6 @@ global:
initialAdmins:
- "user1"
- "user2"
botPrincipals:
- "<service_application_client_id>"
principalDomain: "open-metadata.org"
authentication:
provider: "google"

2
openmetadata-docs/content/deployment/security/auth0/bare-metal.md
View File

@ -31,8 +31,6 @@ authorizerConfiguration:
adminPrincipals:
- "user1"
- "user2"
botPrincipals:
- "ingestion-bot"
principalDomain: "open-metadata.org"
```

2
openmetadata-docs/content/deployment/security/auth0/kubernetes.md
View File

@ -19,8 +19,6 @@ global:
containerRequestFilter: "org.openmetadata.service.security.JwtFilter"
initialAdmins:
- "suresh"
botPrincipals:
- "<client_id>"
principalDomain: "open-metadata.org"
authentication:
provider: "auth0"

2
openmetadata-docs/content/deployment/security/azure/bare-metal.md
View File

@ -33,8 +33,6 @@ authorizerConfiguration:
adminPrincipals:
- "user1"
- "user2"
botPrincipals:
- "ingestion-bot"
principalDomain: "open-metadata.org"
```

4
openmetadata-docs/content/deployment/security/azure/kubernetes.md
View File

@ -30,8 +30,6 @@ global:
initialAdmins:
- "user1"
- "user2"
botPrincipals:
- "<object-id-for-azure-service-application-enterprise-application>"
principalDomain: "open-metadata.org"
authentication:
provider: "azure"
@ -62,8 +60,6 @@ global:
initialAdmins:
- "user1"
- "user2"
botPrincipals:
- "ingestion-bot"
principalDomain: "open-metadata.org"
authentication:
provider: "azure"

2
openmetadata-docs/content/deployment/security/custom-oidc/bare-metal.md
View File

@ -36,8 +36,6 @@ authorizerConfiguration:
adminPrincipals:
- "user1"
- "user2"
botPrincipals:
- "ingestion-bot"
principalDomain: "open-metadata.org"
```

4
openmetadata-docs/content/deployment/security/custom-oidc/kubernetes.md
View File

@ -20,8 +20,6 @@ global:
initialAdmins:
- "user1"
- "user2"
botPrincipals:
- "<service_application_client_id>"
principalDomain: "open-metadata.org"
authentication:
provider: "custom-oidc"
@ -50,8 +48,6 @@ global:
initialAdmins:
- "user1"
- "user2"
botPrincipals:
- "<service_application_client_id>"
principalDomain: "open-metadata.org"
authentication:
provider: "custom-oidc"

2
openmetadata-docs/content/deployment/security/google/bare-metal.md
View File

@ -31,8 +31,6 @@ authorizerConfiguration:
adminPrincipals:
- "user1"
- "user2"
botPrincipals:
- "ingestion-bot"
principalDomain: "open-metadata.org"
```

2
openmetadata-docs/content/deployment/security/google/kubernetes.md
View File

@ -20,8 +20,6 @@ global:
initialAdmins:
- "user1"
- "user2"
botPrincipals:
- "<service_application_client_id>"
principalDomain: "open-metadata.org"
authentication:
provider: "google"

3
openmetadata-docs/content/deployment/security/keycloak/bare-metal.md
View File

@ -36,9 +36,6 @@ authorizerConfiguration:
containerRequestFilter: "org.openmetadata.service.security.JwtFilter"
adminPrincipals:
- "admin-user"
botPrincipals:
- "ingestion-bot"
- "service-account-open-metadata"
principalDomain: "open-metadata.org"
```

6
openmetadata-docs/content/deployment/security/keycloak/kubernetes.md
View File

@ -26,9 +26,6 @@ global:
containerRequestFilter: "org.openmetadata.service.security.JwtFilter"
initialAdmins:
- "admin-user"
botPrincipals:
- "ingestion-bot"
- "service-account-open-metadata"
principalDomain: "open-metadata.org"
authentication:
provider: "custom-oidc"
@ -57,9 +54,6 @@ global:
containerRequestFilter: "org.openmetadata.service.security.JwtFilter"
initialAdmins:
- "admin-user"
botPrincipals:
- "ingestion-bot"
- "service-account-open-metadata"
principalDomain: "open-metadata.org"
authentication:
provider: "custom-oidc"

4
openmetadata-docs/content/deployment/security/okta/bare-metal.md
View File

@ -22,7 +22,6 @@ authenticationConfiguration:
Then,
- Update `authorizerConfiguration` to add login names of the admin users in `adminPrincipals` section as shown below.
- Update the `principalDomain` to your company domain name.
- update the `botPrincipals`, add the Ingestion Client ID for the Service application. This can be found in Okta -> Applications -> Applications, Refer to Step 3 for `Creating Service Application`.
```yaml
authorizerConfiguration:
@ -32,9 +31,6 @@ authorizerConfiguration:
adminPrincipals:
- "user1"
- "user2"
botPrincipals:
- "ingestion-bot"
- "<service_application_client_id>"
principalDomain: "open-metadata.org"
```

4
openmetadata-docs/content/deployment/security/okta/kubernetes.md
View File

@ -10,7 +10,6 @@ Check the Helm information [here](https://artifacthub.io/packages/search?repo=op
Once the `Client Id` and `Client Secret` are generated, see the snippet below for an example of where to
place the client id value and update the authorizer configurations in the `values.yaml`.
Note: Make sure to add the Ingestion Client ID for the Service application in `botPrincipals`.
This can be found in Okta -> Applications -> Applications, Refer to Step 3 for `Creating Service Application`.
### Before 0.12.1
@ -23,9 +22,6 @@ global:
initialAdmins:
- "user1"
- "user2"
botPrincipals:
- ingestion-bot
- "<service_application_client_id>"
principalDomain: "open-metadata.org"
authentication:
provider: "okta"

2
openmetadata-docs/content/deployment/security/one-login/bare-metal.md
View File

@ -36,8 +36,6 @@ authorizerConfiguration:
adminPrincipals:
- "user1"
- "user2"
botPrincipals:
- "ingestion-bot"
principalDomain: "open-metadata.org"
```

4
openmetadata-docs/content/deployment/security/one-login/kubernetes.md
View File

@ -20,8 +20,6 @@ global:
containerRequestFilter: "org.openmetadata.service.security.JwtFilter"
initialAdmins:
- "suresh"
botPrincipals:
- "ingestion-bot"
principalDomain: "open-metadata.org"
authentication:
provider: "custom-oidc"
@ -50,8 +48,6 @@ global:
containerRequestFilter: "org.openmetadata.service.security.JwtFilter"
initialAdmins:
- "suresh"
botPrincipals:
- "ingestion-bot"
principalDomain: "open-metadata.org"
authentication:
provider: "custom-oidc"

17
openmetadata-service/src/main/java/org/openmetadata/service/OpenMetadataApplication.java
View File

@ -40,6 +40,7 @@ import java.lang.reflect.InvocationTargetException;
import java.time.temporal.ChronoUnit;
import java.util.EnumSet;
import java.util.Optional;
import javax.naming.ConfigurationException;
import javax.servlet.DispatcherType;
import javax.servlet.FilterRegistration;
import javax.servlet.ServletException;
@ -94,7 +95,9 @@ public class OpenMetadataApplication extends Application<OpenMetadataApplication
@Override
public void run(OpenMetadataApplicationConfig catalogConfig, Environment environment)
throws ClassNotFoundException, IllegalAccessException, InstantiationException, NoSuchMethodException,
InvocationTargetException, IOException {
InvocationTargetException, IOException, ConfigurationException {
validateConfiguration(catalogConfig);
// init email Util for handling
if (catalogConfig.getSmtpSettings() != null && catalogConfig.getSmtpSettings().getEnableSmtpServer()) {
EmailUtil.EmailUtilBuilder.build(catalogConfig.getSmtpSettings());
@ -156,7 +159,7 @@ public class OpenMetadataApplication extends Application<OpenMetadataApplication
FilterRegistration.Dynamic micrometerFilter =
environment.servlets().addFilter("MicrometerHttpFilter", new MicrometerHttpFilter());
micrometerFilter.addMappingForUrlPatterns(EnumSet.allOf(DispatcherType.class), true, "/*");
intializeWebsockets(catalogConfig, environment);
initializeWebsockets(catalogConfig, environment);
}
private Jdbi createAndSetupJDBI(Environment environment, DataSourceFactory dbFactory) {
@ -227,6 +230,14 @@ public class OpenMetadataApplication extends Application<OpenMetadataApplication
}
}
private void validateConfiguration(OpenMetadataApplicationConfig catalogConfig) throws ConfigurationException {
if (catalogConfig.getAuthorizerConfiguration().getBotPrincipals() != null) {
throw new ConfigurationException(
"'botPrincipals' configuration is deprecated. Please remove it from "
+ "'openmetadata.yaml and restart the server");
}
}
private void registerAuthorizer(OpenMetadataApplicationConfig catalogConfig, Environment environment)
throws NoSuchMethodException, ClassNotFoundException, IllegalAccessException, InvocationTargetException,
InstantiationException {
@ -280,7 +291,7 @@ public class OpenMetadataApplication extends Application<OpenMetadataApplication
environment.getApplicationContext().setErrorHandler(eph);
}
private void intializeWebsockets(OpenMetadataApplicationConfig catalogConfig, Environment environment) {
private void initializeWebsockets(OpenMetadataApplicationConfig catalogConfig, Environment environment) {
SocketAddressFilter socketAddressFilter;
String pathSpec = "/api/v1/push/feed/*";
if (catalogConfig.getAuthorizerConfiguration() != null) {

1
openmetadata-service/src/test/java/org/openmetadata/service/resources/config/ConfigResourceTest.java
View File

@ -73,7 +73,6 @@ class ConfigResourceTest extends OpenMetadataApplicationTest {
assertEquals(config.getAuthorizerConfiguration().getClassName(), auth.getClassName());
assertEquals(config.getAuthorizerConfiguration().getPrincipalDomain(), auth.getPrincipalDomain());
assertEquals(config.getAuthorizerConfiguration().getAdminPrincipals(), auth.getAdminPrincipals());
assertEquals(config.getAuthorizerConfiguration().getBotPrincipals(), auth.getBotPrincipals());
assertEquals(config.getAuthorizerConfiguration().getContainerRequestFilter(), auth.getContainerRequestFilter());
assertEquals(
config.getAuthorizerConfiguration().getEnableSecureSocketConnection(), auth.getEnableSecureSocketConnection());

2
openmetadata-service/src/test/resources/openmetadata-secure-test.yaml
View File

@ -132,8 +132,6 @@ authorizerConfiguration:
containerRequestFilter: "org.openmetadata.service.security.CatalogOpenIdAuthorizationRequestFilter"
adminPrincipals:
- "admin"
botPrincipals:
- "ingestion-bot"
# Added only for test purposes and not for production setup
testPrincipals:
- "test"

7
openmetadata-spec/src/main/resources/json/schema/configuration/authorizerConfiguration.json
View File

@ -23,12 +23,13 @@
"uniqueItems": true
},
"botPrincipals": {
"description": "List of unique bot principals",
"description": "**@Deprecated** List of unique bot principals",
"type": "array",
"items": {
"type": "string"
},
"uniqueItems": true
"uniqueItems": true,
"default": null
},
"testPrincipals": {
"description": "List of unique principals used as test users. **NOTE THIS IS ONLY FOR TEST SETUP AND NOT TO BE USED IN PRODUCTION SETUP**",
@ -59,6 +60,6 @@
"type": "boolean"
}
},
"required": ["className", "containerRequestFilter", "adminPrincipals", "botPrincipals", "principalDomain", "enforcePrincipalDomain", "enableSecureSocketConnection"],
"required": ["className", "containerRequestFilter", "adminPrincipals", "principalDomain", "enforcePrincipalDomain", "enableSecureSocketConnection"],
"additionalProperties": false
}

3
openmetadata-ui/src/main/resources/ui/mock-api/v1/config/authorizer/GET.json
View File

@ -4,8 +4,5 @@
"adminPrincipals": [
"admin"
],
"botPrincipals": [
"ingestion-bot"
],
"principalDomain": ""
}