User
The User class is part of Gaffer's access module. When interacting with Gaffer you use a User.
User Object
The User object contains:
userId- Unique identifier for the userdataAuths- User authorisations for accessing dataopAuths- User authorisations for running different Gaffer operations
The execute methods of Graph require you to pass in an instance of User.
The examples in this documentation usually use the default user created with new User().
For users of Gaffer, interacting in Java is insecure as you are able to set any authorisations you want to. However, as
you are writing Java it is assumed that you have access to the store.properties file providing the connection details
(including password) for the cluster where your data is stored (e.g. Accumulo). Therefore, you could bypass Gaffer and
read all the data directly from disk if you wanted to.
The security layer for Gaffer is currently only enforced by the REST API. We recommend restricting users such that they
do not have access to the cluster and by only allowing users to connect to Gaffer via the REST API. In the REST API the
User object is constructed via a UserFactory.
Currently, we only provide one implementation of this, the UnknownUserFactory
This UnknownUserFactory will always just return new User() - it is used as the default user factory. To specify the
user factory class define the gaffer.user.factory.class REST property.
To authenticate your users, you will need to extend the REST API to add your chosen authentication mechanism. You will
need to implement your own UserFactory class which creates a new User instance based on the user making the REST
request. This could involve making a call to an LDAP server or similar auth service.
For example, you could use the authorisation header in the request:
public class LdapUserFactory implements UserFactory {
@Context
private HttpHeaders httpHeaders;
public User createUser() {
final String authHeaderValue = httpHeaders.getHeaderString(HttpHeaders.AUTHORIZATION); // add logic to fetch userId
final String userId = null; // extract from authHeaderValue
final List<String> opAuths = null; // fetch op auths for userId
final List<String> dataAuths = null; // fetch op auths for userId
return new User.Builder()
.userId(userId)
.opAuths(opAuths)
.dataAuths(dataAuths)
.build();
}
}
Created: April 22, 2024