{"action":"created","comment":{"url":"https://api.github.com/repos/caskdata/cdap/pulls/comments/70304072","id":70304072,"diff_hunk":"@@ -39,6 +39,7 @@\n import co.cask.cdap.security.authorization.AuthorizationContextFactory;\n import co.cask.cdap.security.authorization.AuthorizerInstantiator;\n import co.cask.cdap.security.authorization.DefaultAuthorizationContext;\n+import co.cask.cdap.security.authorization.InMemoryAuthorizer;","path":"cdap-app-fabric/src/test/java/co/cask/cdap/gateway/handlers/AuthorizationHandlerTest.java","position":4,"original_position":4,"commit_id":"b7a92588c5d00cdaaee7c94f9db6f4e227b45286","original_commit_id":"b7a92588c5d00cdaaee7c94f9db6f4e227b45286","user":{"login":"bdmogal","id":3895099,"avatar_url":"https://avatars.githubusercontent.com/u/3895099?v=3","gravatar_id":"","url":"https://api.github.com/users/bdmogal","html_url":"https://github.com/bdmogal","followers_url":"https://api.github.com/users/bdmogal/followers","following_url":"https://api.github.com/users/bdmogal/following{/other_user}","gists_url":"https://api.github.com/users/bdmogal/gists{/gist_id}","starred_url":"https://api.github.com/users/bdmogal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bdmogal/subscriptions","organizations_url":"https://api.github.com/users/bdmogal/orgs","repos_url":"https://api.github.com/users/bdmogal/repos","events_url":"https://api.github.com/users/bdmogal/events{/privacy}","received_events_url":"https://api.github.com/users/bdmogal/received_events","type":"User","site_admin":false},"body":"no, I moved this class from ``cdap-app-fabric/src/main/test`` to ``cdap-security/src/main/test``. That's why we need the import now.","created_at":"2016-07-11T17:48:15Z","updated_at":"2016-07-11T17:48:15Z","html_url":"https://github.com/caskdata/cdap/pull/5972#discussion_r70304072","pull_request_url":"https://api.github.com/repos/caskdata/cdap/pulls/5972","_links":{"self":{"href":"https://api.github.com/repos/caskdata/cdap/pulls/comments/70304072"},"html":{"href":"https://github.com/caskdata/cdap/pull/5972#discussion_r70304072"},"pull_request":{"href":"https://api.github.com/repos/caskdata/cdap/pulls/5972"}}},"pull_request":{"url":"https://api.github.com/repos/caskdata/cdap/pulls/5972","id":76279040,"html_url":"https://github.com/caskdata/cdap/pull/5972","diff_url":"https://github.com/caskdata/cdap/pull/5972.diff","patch_url":"https://github.com/caskdata/cdap/pull/5972.patch","issue_url":"https://api.github.com/repos/caskdata/cdap/issues/5972","number":5972,"state":"open","locked":false,"title":"(CDAP-888) Dataset Authorization Part I: Created a service that cache…","user":{"login":"bdmogal","id":3895099,"avatar_url":"https://avatars.githubusercontent.com/u/3895099?v=3","gravatar_id":"","url":"https://api.github.com/users/bdmogal","html_url":"https://github.com/bdmogal","followers_url":"https://api.github.com/users/bdmogal/followers","following_url":"https://api.github.com/users/bdmogal/following{/other_user}","gists_url":"https://api.github.com/users/bdmogal/gists{/gist_id}","starred_url":"https://api.github.com/users/bdmogal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bdmogal/subscriptions","organizations_url":"https://api.github.com/users/bdmogal/orgs","repos_url":"https://api.github.com/users/bdmogal/repos","events_url":"https://api.github.com/users/bdmogal/events{/privacy}","received_events_url":"https://api.github.com/users/bdmogal/received_events","type":"User","site_admin":false},"body":"…s the privileges of the user running the program. The privileges are refreshed at a configurable time interval.\r\n\r\nIn this PR:\r\n1. Split ``enforce(EntityId, Principal, Action)`` into a separate ``AuthorizationEnforcer`` interface.\r\n2. ``Authorizer`` extends ``AuthorizationEnforcer``, so external authorizers still only have to implement a single interface - ``Authorizer``.\r\n3. Create a ``ProgramAuthorizationEnforcementService`` which maintains a cache of ``Map<Principal, Set<Privilege>``, to be used while accessing datasets from programs.\r\n4. The cache is updated once just before the program is started, so all privileges for the user running the program are cached. From then on, the cache is updated at a configurable time interval, and enforcement is only based on cached policies.\r\n\r\nFollow up work:\r\n1. Implement remote-style APIs being introduced in #5934 for listing user privileges, so communication with authorization backends can happen as the 'cdap' user (which would presumably be whitelisted).\r\n2. Test in conjunction with secure impersonation\r\n3. Test with Apache Sentry after 1.\r\n4. Integration with Read/Write dataset APIs\r\n4. Authorization enforcement for dataset REST APIs\r\n\r\nIssue: [CDAP-888](https://issues.cask.co/browse/CDAP-888)\r\nBuild: http://builds.cask.co/browse/CDAP-DUT4282","created_at":"2016-07-05T14:00:11Z","updated_at":"2016-07-11T17:48:15Z","closed_at":null,"merged_at":null,"merge_commit_sha":"ddc836b5d3ac25f5b551c0f0f0e23a356c15647a","assignee":{"login":"chtyim","id":885032,"avatar_url":"https://avatars.githubusercontent.com/u/885032?v=3","gravatar_id":"","url":"https://api.github.com/users/chtyim","html_url":"https://github.com/chtyim","followers_url":"https://api.github.com/users/chtyim/followers","following_url":"https://api.github.com/users/chtyim/following{/other_user}","gists_url":"https://api.github.com/users/chtyim/gists{/gist_id}","starred_url":"https://api.github.com/users/chtyim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chtyim/subscriptions","organizations_url":"https://api.github.com/users/chtyim/orgs","repos_url":"https://api.github.com/users/chtyim/repos","events_url":"https://api.github.com/users/chtyim/events{/privacy}","received_events_url":"https://api.github.com/users/chtyim/received_events","type":"User","site_admin":false},"assignees":[{"login":"chtyim","id":885032,"avatar_url":"https://avatars.githubusercontent.com/u/885032?v=3","gravatar_id":"","url":"https://api.github.com/users/chtyim","html_url":"https://github.com/chtyim","followers_url":"https://api.github.com/users/chtyim/followers","following_url":"https://api.github.com/users/chtyim/following{/other_user}","gists_url":"https://api.github.com/users/chtyim/gists{/gist_id}","starred_url":"https://api.github.com/users/chtyim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chtyim/subscriptions","organizations_url":"https://api.github.com/users/chtyim/orgs","repos_url":"https://api.github.com/users/chtyim/repos","events_url":"https://api.github.com/users/chtyim/events{/privacy}","received_events_url":"https://api.github.com/users/chtyim/received_events","type":"User","site_admin":false}],"milestone":null,"commits_url":"https://api.github.com/repos/caskdata/cdap/pulls/5972/commits","review_comments_url":"https://api.github.com/repos/caskdata/cdap/pulls/5972/comments","review_comment_url":"https://api.github.com/repos/caskdata/cdap/pulls/comments{/number}","comments_url":"https://api.github.com/repos/caskdata/cdap/issues/5972/comments","statuses_url":"https://api.github.com/repos/caskdata/cdap/statuses/b7a92588c5d00cdaaee7c94f9db6f4e227b45286","head":{"label":"caskdata:feature/auth-cache","ref":"feature/auth-cache","sha":"b7a92588c5d00cdaaee7c94f9db6f4e227b45286","user":{"login":"caskdata","id":8123023,"avatar_url":"https://avatars.githubusercontent.com/u/8123023?v=3","gravatar_id":"","url":"https://api.github.com/users/caskdata","html_url":"https://github.com/caskdata","followers_url":"https://api.github.com/users/caskdata/followers","following_url":"https://api.github.com/users/caskdata/following{/other_user}","gists_url":"https://api.github.com/users/caskdata/gists{/gist_id}","starred_url":"https://api.github.com/users/caskdata/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/caskdata/subscriptions","organizations_url":"https://api.github.com/users/caskdata/orgs","repos_url":"https://api.github.com/users/caskdata/repos","events_url":"https://api.github.com/users/caskdata/events{/privacy}","received_events_url":"https://api.github.com/users/caskdata/received_events","type":"Organization","site_admin":false},"repo":{"id":22542759,"name":"cdap","full_name":"caskdata/cdap","owner":{"login":"caskdata","id":8123023,"avatar_url":"https://avatars.githubusercontent.com/u/8123023?v=3","gravatar_id":"","url":"https://api.github.com/users/caskdata","html_url":"https://github.com/caskdata","followers_url":"https://api.github.com/users/caskdata/followers","following_url":"https://api.github.com/users/caskdata/following{/other_user}","gists_url":"https://api.github.com/users/caskdata/gists{/gist_id}","starred_url":"https://api.github.com/users/caskdata/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/caskdata/subscriptions","organizations_url":"https://api.github.com/users/caskdata/orgs","repos_url":"https://api.github.com/users/caskdata/repos","events_url":"https://api.github.com/users/caskdata/events{/privacy}","received_events_url":"https://api.github.com/users/caskdata/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/caskdata/cdap","description":"Cask Data Application Platform (CDAP)","fork":false,"url":"https://api.github.com/repos/caskdata/cdap","forks_url":"https://api.github.com/repos/caskdata/cdap/forks","keys_url":"https://api.github.com/repos/caskdata/cdap/keys{/key_id}","collaborators_url":"https://api.github.com/repos/caskdata/cdap/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/caskdata/cdap/teams","hooks_url":"https://api.github.com/repos/caskdata/cdap/hooks","issue_events_url":"https://api.github.com/repos/caskdata/cdap/issues/events{/number}","events_url":"https://api.github.com/repos/caskdata/cdap/events","assignees_url":"https://api.github.com/repos/caskdata/cdap/assignees{/user}","branches_url":"https://api.github.com/repos/caskdata/cdap/branches{/branch}","tags_url":"https://api.github.com/repos/caskdata/cdap/tags","blobs_url":"https://api.github.com/repos/caskdata/cdap/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/caskdata/cdap/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/caskdata/cdap/git/refs{/sha}","trees_url":"https://api.github.com/repos/caskdata/cdap/git/trees{/sha}","statuses_url":"https://api.github.com/repos/caskdata/cdap/statuses/{sha}","languages_url":"https://api.github.com/repos/caskdata/cdap/languages","stargazers_url":"https://api.github.com/repos/caskdata/cdap/stargazers","contributors_url":"https://api.github.com/repos/caskdata/cdap/contributors","subscribers_url":"https://api.github.com/repos/caskdata/cdap/subscribers","subscription_url":"https://api.github.com/repos/caskdata/cdap/subscription","commits_url":"https://api.github.com/repos/caskdata/cdap/commits{/sha}","git_commits_url":"https://api.github.com/repos/caskdata/cdap/git/commits{/sha}","comments_url":"https://api.github.com/repos/caskdata/cdap/comments{/number}","issue_comment_url":"https://api.github.com/repos/caskdata/cdap/issues/comments{/number}","contents_url":"https://api.github.com/repos/caskdata/cdap/contents/{+path}","compare_url":"https://api.github.com/repos/caskdata/cdap/compare/{base}...{head}","merges_url":"https://api.github.com/repos/caskdata/cdap/merges","archive_url":"https://api.github.com/repos/caskdata/cdap/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/caskdata/cdap/downloads","issues_url":"https://api.github.com/repos/caskdata/cdap/issues{/number}","pulls_url":"https://api.github.com/repos/caskdata/cdap/pulls{/number}","milestones_url":"https://api.github.com/repos/caskdata/cdap/milestones{/number}","notifications_url":"https://api.github.com/repos/caskdata/cdap/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/caskdata/cdap/labels{/name}","releases_url":"https://api.github.com/repos/caskdata/cdap/releases{/id}","deployments_url":"https://api.github.com/repos/caskdata/cdap/deployments","created_at":"2014-08-02T09:00:10Z","updated_at":"2016-07-11T15:12:47Z","pushed_at":"2016-07-11T17:45:38Z","git_url":"git://github.com/caskdata/cdap.git","ssh_url":"git@github.com:caskdata/cdap.git","clone_url":"https://github.com/caskdata/cdap.git","svn_url":"https://github.com/caskdata/cdap","homepage":"http://cdap.io","size":621112,"stargazers_count":133,"watchers_count":133,"language":"Java","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":46,"mirror_url":null,"open_issues_count":22,"forks":46,"open_issues":22,"watchers":133,"default_branch":"develop"}},"base":{"label":"caskdata:develop","ref":"develop","sha":"683ea1eead7ae12e6c46d57d2c37feead2b83363","user":{"login":"caskdata","id":8123023,"avatar_url":"https://avatars.githubusercontent.com/u/8123023?v=3","gravatar_id":"","url":"https://api.github.com/users/caskdata","html_url":"https://github.com/caskdata","followers_url":"https://api.github.com/users/caskdata/followers","following_url":"https://api.github.com/users/caskdata/following{/other_user}","gists_url":"https://api.github.com/users/caskdata/gists{/gist_id}","starred_url":"https://api.github.com/users/caskdata/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/caskdata/subscriptions","organizations_url":"https://api.github.com/users/caskdata/orgs","repos_url":"https://api.github.com/users/caskdata/repos","events_url":"https://api.github.com/users/caskdata/events{/privacy}","received_events_url":"https://api.github.com/users/caskdata/received_events","type":"Organization","site_admin":false},"repo":{"id":22542759,"name":"cdap","full_name":"caskdata/cdap","owner":{"login":"caskdata","id":8123023,"avatar_url":"https://avatars.githubusercontent.com/u/8123023?v=3","gravatar_id":"","url":"https://api.github.com/users/caskdata","html_url":"https://github.com/caskdata","followers_url":"https://api.github.com/users/caskdata/followers","following_url":"https://api.github.com/users/caskdata/following{/other_user}","gists_url":"https://api.github.com/users/caskdata/gists{/gist_id}","starred_url":"https://api.github.com/users/caskdata/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/caskdata/subscriptions","organizations_url":"https://api.github.com/users/caskdata/orgs","repos_url":"https://api.github.com/users/caskdata/repos","events_url":"https://api.github.com/users/caskdata/events{/privacy}","received_events_url":"https://api.github.com/users/caskdata/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/caskdata/cdap","description":"Cask Data Application Platform (CDAP)","fork":false,"url":"https://api.github.com/repos/caskdata/cdap","forks_url":"https://api.github.com/repos/caskdata/cdap/forks","keys_url":"https://api.github.com/repos/caskdata/cdap/keys{/key_id}","collaborators_url":"https://api.github.com/repos/caskdata/cdap/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/caskdata/cdap/teams","hooks_url":"https://api.github.com/repos/caskdata/cdap/hooks","issue_events_url":"https://api.github.com/repos/caskdata/cdap/issues/events{/number}","events_url":"https://api.github.com/repos/caskdata/cdap/events","assignees_url":"https://api.github.com/repos/caskdata/cdap/assignees{/user}","branches_url":"https://api.github.com/repos/caskdata/cdap/branches{/branch}","tags_url":"https://api.github.com/repos/caskdata/cdap/tags","blobs_url":"https://api.github.com/repos/caskdata/cdap/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/caskdata/cdap/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/caskdata/cdap/git/refs{/sha}","trees_url":"https://api.github.com/repos/caskdata/cdap/git/trees{/sha}","statuses_url":"https://api.github.com/repos/caskdata/cdap/statuses/{sha}","languages_url":"https://api.github.com/repos/caskdata/cdap/languages","stargazers_url":"https://api.github.com/repos/caskdata/cdap/stargazers","contributors_url":"https://api.github.com/repos/caskdata/cdap/contributors","subscribers_url":"https://api.github.com/repos/caskdata/cdap/subscribers","subscription_url":"https://api.github.com/repos/caskdata/cdap/subscription","commits_url":"https://api.github.com/repos/caskdata/cdap/commits{/sha}","git_commits_url":"https://api.github.com/repos/caskdata/cdap/git/commits{/sha}","comments_url":"https://api.github.com/repos/caskdata/cdap/comments{/number}","issue_comment_url":"https://api.github.com/repos/caskdata/cdap/issues/comments{/number}","contents_url":"https://api.github.com/repos/caskdata/cdap/contents/{+path}","compare_url":"https://api.github.com/repos/caskdata/cdap/compare/{base}...{head}","merges_url":"https://api.github.com/repos/caskdata/cdap/merges","archive_url":"https://api.github.com/repos/caskdata/cdap/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/caskdata/cdap/downloads","issues_url":"https://api.github.com/repos/caskdata/cdap/issues{/number}","pulls_url":"https://api.github.com/repos/caskdata/cdap/pulls{/number}","milestones_url":"https://api.github.com/repos/caskdata/cdap/milestones{/number}","notifications_url":"https://api.github.com/repos/caskdata/cdap/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/caskdata/cdap/labels{/name}","releases_url":"https://api.github.com/repos/caskdata/cdap/releases{/id}","deployments_url":"https://api.github.com/repos/caskdata/cdap/deployments","created_at":"2014-08-02T09:00:10Z","updated_at":"2016-07-11T15:12:47Z","pushed_at":"2016-07-11T17:45:38Z","git_url":"git://github.com/caskdata/cdap.git","ssh_url":"git@github.com:caskdata/cdap.git","clone_url":"https://github.com/caskdata/cdap.git","svn_url":"https://github.com/caskdata/cdap","homepage":"http://cdap.io","size":621112,"stargazers_count":133,"watchers_count":133,"language":"Java","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":46,"mirror_url":null,"open_issues_count":22,"forks":46,"open_issues":22,"watchers":133,"default_branch":"develop"}},"_links":{"self":{"href":"https://api.github.com/repos/caskdata/cdap/pulls/5972"},"html":{"href":"https://github.com/caskdata/cdap/pull/5972"},"issue":{"href":"https://api.github.com/repos/caskdata/cdap/issues/5972"},"comments":{"href":"https://api.github.com/repos/caskdata/cdap/issues/5972/comments"},"review_comments":{"href":"https://api.github.com/repos/caskdata/cdap/pulls/5972/comments"},"review_comment":{"href":"https://api.github.com/repos/caskdata/cdap/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/caskdata/cdap/pulls/5972/commits"},"statuses":{"href":"https://api.github.com/repos/caskdata/cdap/statuses/b7a92588c5d00cdaaee7c94f9db6f4e227b45286"}}}}
{"actor":{"display_login":"bdmogal"}}