search

Chaffelson / nipyapi

A convenient Python wrapper for Apache NiFi
Other
244 stars 76 forks source link

Creating policies for specific bucket #241

Open iMajna opened 3 years ago

iMajna commented 3 years ago

Description

I'm trying to create policies for newly created bucket which is connected to process group. If bucket has no policies and neither one policy has even been assign to it code will fail with either:

What I Did

bucket_id: b488d2fa-6f0c-4fd2-9d6c-911a012a7811

Executing this: 

nipyapi.security.get_access_policy_for_resource(
          resource='buckets',
          action='read', 
          r_id='b488d2fa-6f0c-4fd2-9d6c-911a012a7811', 
          service='registry', 
          auto_create=True)

Results in: HTTP response body: No policy found for action='read', resource='/buckets/b488d2fa-6f0c-4fd2-9d6c-911a012a7811'

Which is fine, because there aren't any policies. Since there are no policies you would like to create new policies so what you do:

nipyapi.security.create_access_policy(
         resource='buckets',
         action='read',
         r_id='b488d2fa-6f0c-4fd2-9d6c-911a012a7811', 
        service='registry')

and then this results in: ValueError: Found multiple policies for '/buckets' with 'read'.

So, from what I see, it searches and tries to create read policy in /buckets instead of /buckets/b488d2fa-6f0c-4fd2-9d6c-911a012a7811.

Based on documentation

r_id (optional[str]) – if NiFi, the resource ID of the resource

it can really be that you cannot create policy for specific bucket and this can be feature proposal then?

On the other side it also says:

r_id (Optional[str]) – The UUID of the resource, valid only if targeting NiFi resources

for nipyapi.security.get_access_policy_for_resource but check "Extra" below because it worked for "registry" as well

Extra When I try to manually create policy for bucket in Registry (through UI), immediately delete same policy and follow with execution of:

$ reg_policy_rw = nipyapi.security.get_access_policy_for_resource(
                                        resource='buckets',
                                        action='read',
                                        r_id='b488d2fa-6f0c-4fd2-9d6c-911a012a7811', 
                                        service='registry', 
                                        auto_create=True)

$ nipyapi.security.add_user_group_to_access_policy(
                    reg_group_rw_identity,
                    policy=reg_policy_rw,
                    service='registry'
                    )

Creation of policy for specific group would work, but well, my automation doesn't make any sense then :D

Urgency

Well, it's not urgent, but it would be nice to have to complete automation cycle.

iMajna commented 3 years ago

I think this is fixable with extending this one: https://github.com/Chaffelson/nipyapi/blob/e13e1f35cdc313d139d687ee7feb30cf9af6490b/nipyapi/security.py#L698 to this: resource='/'.join([r, r_id]) if r_id else r

Checked on my side and this did a trick. @Chaffelson if you agree I can go through tests and make a PR.

Chaffelson commented 3 years ago

This makes good sense, if you want to go ahead and implement that would be great. Sorry I hadn't seen this until now, not sure what has happened to my notifications lately.

cgmckeever commented 3 years ago

This is still open, yet the change seems to be present, however Im still getting the same error

create_access_policy

ValueError: Found multiple policies for '/buckets' with 'read'.

get_access_policy_for_resource("buckets"

No policy found for action='read', resource='/buckets/a570c091-f05d-456e-95a
pip3 show nipyapi
Name: nipyapi
Version: 0.16.2
Summary: Nifi-Python-Api: A convenient Python wrapper for the Apache NiFi Rest API
Home-page: https://github.com/Chaffelson/nipyapi
Author: Daniel Chaffelson
Author-email: chaffelson@gmail.com
License: Apache Software License 2.0
Location: /usr/local/lib/python3.9/site-packages
Requires: lxml, requests, future, setuptools, packaging, ruamel.yaml, pysocks, docker, xmltodict, six
Required-by:

@iMajna

cgmckeever commented 3 years ago

I've found a NASTY workaround 

ap = nipyapi.security.create_access_policy("buckets/" + service_buckets[bucket_name].identifier,
                        "read",
                        r_id=None,
                        service=registry)
iMajna commented 3 years ago

@cgmckeever, its on my local branch 👎

Give me a day to test it one more time although it is already working for us, but just whether I changed anything else then I'll make PR and hopefully it will be accepted and merged :)

Chaffelson commented 10 months ago

Returning to this old issue - can you please advise if this needs to be revisited

cgmckeever commented 10 months ago

wowo -- thanks for digging this back up. Two things