Skip to content

Commit 2b09d92

Browse files
jmelinavwoop
jmelinav
and
woop
authored
Authentication and Authorization into feast-auth module. (#856)
* Authentication and Authorization into feast auth module. * Reverted unnecessary change. * Fix typo * Fix formatting in pom.xml * Update properties to use getter Co-authored-by: Willem Pienaar <6728866+woop@users.noreply.github.com> Co-authored-by: Willem Pienaar <git@willem.co>
1 parent 2e7a00a commit 2b09d92

18 files changed

Lines changed: 213 additions & 116 deletions

File tree

‎auth/pom.xml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
<project xmlns="http://maven.apache.org/POM/4.0.0"
2+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
4+
<modelVersion>4.0.0</modelVersion>
5+
<parent>
6+
<groupId>dev.feast</groupId>
7+
<artifactId>feast-parent</artifactId>
8+
<version>${revision}</version>
9+
</parent>
10+
<artifactId>feast-auth</artifactId>
11+
12+
<name>Feast Authentication and Authorization</name>
13+
14+
<dependencies>
15+
<dependency>
16+
<groupId>dev.feast</groupId>
17+
<artifactId>feast-common</artifactId>
18+
<version>${project.version}</version>
19+
</dependency>
20+
<dependency>
21+
<groupId>net.devh</groupId>
22+
<artifactId>grpc-server-spring-boot-starter</artifactId>
23+
<version>2.4.0.RELEASE</version>
24+
</dependency>
25+
<dependency>
26+
<groupId>org.springframework.security</groupId>
27+
<artifactId>spring-security-oauth2-resource-server</artifactId>
28+
<version>5.3.0.RELEASE</version>
29+
</dependency>
30+
<dependency>
31+
<groupId>org.springframework.security</groupId>
32+
<artifactId>spring-security-oauth2-jose</artifactId>
33+
<version>5.3.0.RELEASE</version>
34+
</dependency>
35+
<dependency>
36+
<groupId>sh.ory.keto</groupId>
37+
<artifactId>keto-client</artifactId>
38+
<version>0.4.4-alpha.1</version>
39+
</dependency>
40+
<dependency>
41+
<groupId>org.projectlombok</groupId>
42+
<artifactId>lombok</artifactId>
43+
</dependency>
44+
<dependency>
45+
<groupId>org.hibernate.validator</groupId>
46+
<artifactId>hibernate-validator</artifactId>
47+
<version>6.1.2.Final</version>
48+
</dependency>
49+
</dependencies>
50+
51+
</project>

core/src/main/java/feast/core/auth/authentication/DefaultJwtAuthenticationProvider.java renamed to auth/src/main/java/feast/auth/authentication/DefaultJwtAuthenticationProvider.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
* See the License for the specific language governing permissions and
1515
* limitations under the License.
1616
*/
17-
package feast.core.auth.authentication;
17+
package feast.auth.authentication;
1818

1919
import java.util.Map;
2020
import org.springframework.security.authentication.AuthenticationProvider;

core/src/main/java/feast/core/auth/authorization/AuthorizationProvider.java renamed to auth/src/main/java/feast/auth/authorization/AuthorizationProvider.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
* See the License for the specific language governing permissions and
1515
* limitations under the License.
1616
*/
17-
package feast.core.auth.authorization;
17+
package feast.auth.authorization;
1818

1919
import org.springframework.security.core.Authentication;
2020

core/src/main/java/feast/core/auth/authorization/AuthorizationResult.java renamed to auth/src/main/java/feast/auth/authorization/AuthorizationResult.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
* See the License for the specific language governing permissions and
1515
* limitations under the License.
1616
*/
17-
package feast.core.auth.authorization;
17+
package feast.auth.authorization;
1818

1919
import java.util.Optional;
2020
import javax.annotation.Nullable;

core/src/main/java/feast/core/auth/authorization/Keto/KetoAuthorizationProvider.java renamed to auth/src/main/java/feast/auth/authorization/Keto/KetoAuthorizationProvider.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,10 @@
1414
* See the License for the specific language governing permissions and
1515
* limitations under the License.
1616
*/
17-
package feast.core.auth.authorization.Keto;
17+
package feast.auth.authorization.Keto;
1818

19-
import feast.core.auth.authorization.AuthorizationProvider;
20-
import feast.core.auth.authorization.AuthorizationResult;
19+
import feast.auth.authorization.AuthorizationProvider;
20+
import feast.auth.authorization.AuthorizationResult;
2121
import java.util.List;
2222
import java.util.Map;
2323
import org.hibernate.validator.internal.constraintvalidators.bv.EmailValidator;

core/src/main/java/feast/core/config/SecurityConfig.java renamed to auth/src/main/java/feast/auth/config/SecurityConfig.java

Lines changed: 6 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -14,21 +14,16 @@
1414
* See the License for the specific language governing permissions and
1515
* limitations under the License.
1616
*/
17-
package feast.core.config;
17+
package feast.auth.config;
1818

19-
import feast.core.auth.authentication.DefaultJwtAuthenticationProvider;
20-
import feast.core.auth.authorization.AuthorizationProvider;
21-
import feast.core.auth.authorization.Keto.KetoAuthorizationProvider;
22-
import feast.core.config.FeastProperties.SecurityProperties;
23-
import feast.proto.core.CoreServiceGrpc;
19+
import feast.auth.authentication.DefaultJwtAuthenticationProvider;
20+
import feast.auth.authorization.AuthorizationProvider;
21+
import feast.auth.authorization.Keto.KetoAuthorizationProvider;
2422
import java.util.ArrayList;
2523
import java.util.List;
2624
import net.devh.boot.grpc.server.security.authentication.BearerAuthenticationReader;
2725
import net.devh.boot.grpc.server.security.authentication.GrpcAuthenticationReader;
28-
import net.devh.boot.grpc.server.security.check.AccessPredicate;
2926
import net.devh.boot.grpc.server.security.check.AccessPredicateVoter;
30-
import net.devh.boot.grpc.server.security.check.GrpcSecurityMetadataSource;
31-
import net.devh.boot.grpc.server.security.check.ManualGrpcSecurityMetadataSource;
3227
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
3328
import org.springframework.context.annotation.Bean;
3429
import org.springframework.context.annotation.Configuration;
@@ -45,8 +40,8 @@ public class SecurityConfig {
4540

4641
private final SecurityProperties securityProperties;
4742

48-
public SecurityConfig(FeastProperties feastProperties) {
49-
this.securityProperties = feastProperties.getSecurity();
43+
public SecurityConfig(SecurityProperties securityProperties) {
44+
this.securityProperties = securityProperties;
5045
}
5146

5247
/**
@@ -86,26 +81,6 @@ GrpcAuthenticationReader authenticationReader() {
8681
return new BearerAuthenticationReader(BearerTokenAuthenticationToken::new);
8782
}
8883

89-
/**
90-
* Creates a SecurityMetadataSource when authentication is enabled. This allows for the
91-
* configuration of endpoint level security rules.
92-
*
93-
* @return GrpcSecurityMetadataSource
94-
*/
95-
@Bean
96-
@ConditionalOnProperty(prefix = "feast.security.authentication", name = "enabled")
97-
GrpcSecurityMetadataSource grpcSecurityMetadataSource() {
98-
final ManualGrpcSecurityMetadataSource source = new ManualGrpcSecurityMetadataSource();
99-
100-
// Authentication is enabled for all gRPC endpoints
101-
source.setDefault(AccessPredicate.authenticated());
102-
103-
// The following endpoints allow unauthenticated access
104-
source.set(CoreServiceGrpc.getGetFeastCoreVersionMethod(), AccessPredicate.permitAll());
105-
106-
return source;
107-
}
108-
10984
/**
11085
* Creates an AccessDecisionManager if authorization is enabled. This object determines the policy
11186
* used to make authorization decisions.

‎auth/src/main/java/feast/auth/config/SecurityProperties.java‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
/*
2+
* SPDX-License-Identifier: Apache-2.0
3+
* Copyright 2018-2020 The Feast Authors
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* https://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
package feast.auth.config;
18+
19+
import feast.common.validators.OneOfStrings;
20+
import java.util.Map;
21+
import lombok.Getter;
22+
import lombok.Setter;
23+
24+
@Getter
25+
@Setter
26+
public class SecurityProperties {
27+
private AuthenticationProperties authentication;
28+
private AuthorizationProperties authorization;
29+
30+
@Getter
31+
@Setter
32+
public static class AuthenticationProperties {
33+
34+
// Enable authentication
35+
private boolean enabled;
36+
37+
// Named authentication provider to use
38+
@OneOfStrings({"jwt"})
39+
private String provider;
40+
41+
// K/V options to initialize the provider with
42+
private Map<String, String> options;
43+
}
44+
45+
@Getter
46+
@Setter
47+
public static class AuthorizationProperties {
48+
49+
// Enable authorization. Authentication must be enabled if authorization is enabled.
50+
private boolean enabled;
51+
52+
// Named authorization provider to use.
53+
@OneOfStrings({"none", "keto"})
54+
private String provider;
55+
56+
// K/V options to initialize the provider with
57+
private Map<String, String> options;
58+
}
59+
}

‎common/pom.xml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,11 @@
5555
<groupId>org.projectlombok</groupId>
5656
<artifactId>lombok</artifactId>
5757
</dependency>
58+
<dependency>
59+
<groupId>javax.validation</groupId>
60+
<artifactId>validation-api</artifactId>
61+
<version>2.0.0.Final</version>
62+
</dependency>
5863
<dependency>
5964
<groupId>junit</groupId>
6065
<artifactId>junit</artifactId>

core/src/main/java/feast/core/validators/OneOfStringValidator.java renamed to common/src/main/java/feast/common/validators/OneOfStringValidator.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
* See the License for the specific language governing permissions and
1515
* limitations under the License.
1616
*/
17-
package feast.core.validators;
17+
package feast.common.validators;
1818

1919
import java.util.Arrays;
2020
import javax.validation.ConstraintValidator;

core/src/main/java/feast/core/validators/OneOfStrings.java renamed to common/src/main/java/feast/common/validators/OneOfStrings.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
* See the License for the specific language governing permissions and
1515
* limitations under the License.
1616
*/
17-
package feast.core.validators;
17+
package feast.common.validators;
1818

1919
import java.lang.annotation.*;
2020
import javax.validation.Constraint;

0 commit comments

Comments
 (0)