Add option to use current caching that only caches access based on fi…

…rst user
hpcc-systems · May 21, 2024 · 364ed76 · 364ed76
1 parent 43fde46
commit 364ed76
Show file tree

Hide file tree

Showing 8 changed files with 74 additions and 12 deletions.
diff --git a/esp/applications/common/ldap/ldap.yaml b/esp/applications/common/ldap/ldap.yaml
@@ -22,3 +22,4 @@ ldap:
   hpccAdminSecretKey: ""
   hpccAdminVaultId: ""
   checkScopeScans: true
+  useLegacyDefaultFileScopePermissionCache: false
diff --git a/helm/hpcc/values.schema.json b/helm/hpcc/values.schema.json
@@ -1076,6 +1076,10 @@
         "checkScopeScans": {
           "type": "boolean",
           "description": "Only return iterated logical file metadata for files that user has scope permission to access"
+        },
+        "useLegacyDefaultFileScopePermissionCache": {
+          "type": "boolean",
+          "description": "Use legacy default filescope permissions that cached value for first user"
         }
       }
     },

diff --git a/initfiles/componentfiles/configxml/dali.xsl b/initfiles/componentfiles/configxml/dali.xsl
@@ -308,6 +308,9 @@
             <xsl:attribute name="adminGroupName">
                 <xsl:value-of select="/Environment/Software/LDAPServerProcess[@name=$ldapServerName]/@adminGroupName"/>
             </xsl:attribute>
+            <xsl:attribute name="useLegacyDefaultFileScopePermissionCache">
+                <xsl:value-of select="/Environment/Software/LDAPServerProcess[@name=$ldapServerName]/@useLegacyDefaultFileScopePermissionCache"/>
+            </xsl:attribute>
             <xsl:variable name="ldapServerNode" select="/Environment/Software/LDAPServerProcess[@name=$ldapServerName]"/>
             <xsl:if test="not($ldapServerNode)">
               <xsl:message terminate="yes">

diff --git a/initfiles/componentfiles/configxml/esp.xsl b/initfiles/componentfiles/configxml/esp.xsl
@@ -466,6 +466,9 @@
                         <xsl:otherwise/>
                     </xsl:choose>
                 </xsl:for-each>
+                <xsl:attribute name="useLegacyDefaultFileScopePermissionCache">
+                    <xsl:value-of select="/Environment/Software/LDAPServerProcess[@name=$ldapServer]/@useLegacyDefaultFileScopePermissionCache"/>
+                </xsl:attribute>
             </xsl:element>
         </xsl:for-each>
     </xsl:template>

diff --git a/system/security/LdapSecurity/ldapconnection.cpp b/system/security/LdapSecurity/ldapconnection.cpp
@@ -664,6 +664,7 @@ class CLdapConfig : implements ILdapConfig, public CInterface
             m_sdfieldname.append("aci");
         else if(m_serverType == OPEN_LDAP)
             m_sdfieldname.append("aci");
+
 #ifdef _DEBUG
         debugPrintout();
 #endif

diff --git a/system/security/LdapSecurity/ldapsecurity.cpp b/system/security/LdapSecurity/ldapsecurity.cpp
@@ -630,6 +630,7 @@ void CLdapSecManager::init(const char *serviceName, IPropertyTree* cfg)
     m_permissionsCache->setCacheTimeout( 60 * cacheTimeoutMinutes);
     m_permissionsCache->setTransactionalEnabled(true);
     m_permissionsCache->setSecManager(this);
+    m_permissionsCache->setUseLegacyDefaultFileScopePermissionCache(cfg->getPropBool("@useLegacyDefaultFileScopePermissionCache", false));
     m_passwordExpirationWarningDays = cfg->getPropInt(".//@passwordExpirationWarningDays", 10); //Default to 10 days
     m_checkViewPermissions = cfg->getPropBool(".//@checkViewPermissions", false);
     m_hpccInternalScope.set(queryDfsXmlBranchName(DXB_Internal)).append("::");//HpccInternal::

diff --git a/system/security/shared/caching.cpp b/system/security/shared/caching.cpp
@@ -572,7 +572,15 @@ bool CPermissionsCache::queryPermsManagedFileScope(ISecUser& sec_user, const cha
             aindex_t count = m_secMgr->getManagedScopeTree(RT_FILE_SCOPE, nullptr, scopes);
             if (count)
                 addManagedFileScopes(scopes);
-            m_userDefaultFileScopePermissions.clear();
+            if (m_useLegacyDefaultFileScopePermissionCache)
+            {
+                m_defaultPermission = SecAccess_Unknown;
+            }
+            else
+            {
+                WriteLockBlock defaultScopesWriteLock(m_defaultScopesRWLock);
+                m_userDefaultFileScopePermissions.clear();
+            }
             time(&m_lastManagedFileScopesRefresh);
         }
     }
@@ -672,20 +680,42 @@ bool CPermissionsCache::queryPermsManagedFileScope(ISecUser& sec_user, const cha
 
 SecAccessFlags CPermissionsCache::queryDefaultPermission(ISecUser& user)
 {
-    const char *username = user.getName();
 
-    SecAccessFlags defaultPermission = SecAccess_None;
-    auto it = m_userDefaultFileScopePermissions.find(username);
-    if (it == m_userDefaultFileScopePermissions.end())
+    if (m_useLegacyDefaultFileScopePermissionCache)
     {
-        defaultPermission = m_secMgr->queryDefaultPermission(user);
-        std::string userName(username);
-        m_userDefaultFileScopePermissions.insert(std::pair<std::string, SecAccessFlags>(userName, defaultPermission));
-        DBGLOG("Added user '%s' to default file scope permissions with access %s(%d)", username, getSecAccessFlagName(defaultPermission), defaultPermission);
+        if (m_defaultPermission == SecAccess_Unknown)
+        {
+            if (m_secMgr)
+                m_defaultPermission = m_secMgr->queryDefaultPermission(user);
+            else
+                m_defaultPermission = SecAccess_None;
+
+            DBGLOG("Legacy default file scope permission set to %s(%d) for all users, based on User '%s'", getSecAccessFlagName(m_defaultPermission),
+                   m_defaultPermission, user.getName());
+        }
+        return m_defaultPermission;
     }
-    else
+
+    const char *username = user.getName();
+    SecAccessFlags defaultPermission = SecAccess_None;
+    if (m_secMgr)
     {
-        defaultPermission = it->second;
+        ReadLockBlock defaultScopesReadLock(m_defaultScopesRWLock);
+        auto it = m_userDefaultFileScopePermissions.find(username);
+        if (it == m_userDefaultFileScopePermissions.end())
+        {
+            defaultScopesReadLock.clear();
+            WriteLockBlock defaultScopesWriteLock(m_defaultScopesRWLock);
+            defaultPermission = m_secMgr->queryDefaultPermission(user);
+            std::string userName(username);
+            m_userDefaultFileScopePermissions.emplace(userName, defaultPermission);
+            DBGLOG("Added user '%s' to default file scope permissions with access %s(%d)", username, getSecAccessFlagName(defaultPermission),
+                   defaultPermission);
+        }
+        else
+        {
+            defaultPermission = it->second;
+        }
     }
 
     return defaultPermission;
@@ -711,8 +741,16 @@ void CPermissionsCache::flush()
             delete (*ui).second;
         m_userCache.clear();
     }
+    if (m_useLegacyDefaultFileScopePermissionCache)
+    {
+        m_defaultPermission = SecAccess_None;
+    }
+    else
+    {
+        WriteLockBlock defaultScopesWriteLock(m_defaultScopesRWLock);
+        m_userDefaultFileScopePermissions.clear();
+    }
     m_lastManagedFileScopesRefresh = 0;
-    m_userDefaultFileScopePermissions.clear();
 }
 
 CPermissionsCache* CPermissionsCache::getInstance(const char * _secMgrClass)

diff --git a/system/security/shared/caching.hpp b/system/security/shared/caching.hpp
@@ -143,6 +143,7 @@ class CPermissionsCache : public CInterface
         m_transactionalEnabled = false;
         m_secMgr = NULL;
         m_lastManagedFileScopesRefresh = 0;
+        m_defaultPermission = SecAccess_Unknown;
         m_secMgrClass.set(_secMgrClass);
         m_transactionalCacheTimeout = DEFAULT_CACHE_TIMEOUT_SECONDS;
     }
@@ -202,6 +203,12 @@ class CPermissionsCache : public CInterface
     bool queryPermsManagedFileScope(ISecUser& sec_user, const char * fullScope, StringBuffer& managedScope, SecAccessFlags * accessFlags);
     void setSecManager(ISecManager * secMgr) { m_secMgr = secMgr; }
     SecAccessFlags  queryDefaultPermission(ISecUser& user);
+    void setUseLegacyDefaultFileScopePermissionCache(bool useLegacy)
+    {
+        if (useLegacy)
+            DBGLOG("*** Setting default file scope permissions to use legacy mode which uses first retrieved permission for all users.");
+        m_useLegacyDefaultFileScopePermissionCache = useLegacy;
+    }
 private:
 
     typedef std::map<string, CResPermissionsCache*> MapResPermissionsCache;
@@ -220,11 +227,15 @@ class CPermissionsCache : public CInterface
     StringAttr                  m_secMgrClass;
 
     //Managed File Scope support
+    mutable ReadWriteLock       m_defaultScopesRWLock;//guards m_userDefaultFileScopePermissions
     std::map<std::string, SecAccessFlags> m_userDefaultFileScopePermissions;
+    SecAccessFlags              m_defaultPermission;
     map<string, ISecResource*>  m_managedFileScopesMap;
     mutable ReadWriteLock       m_scopesRWLock;//guards m_managedFileScopesMap
     ISecManager *               m_secMgr;
     time_t                      m_lastManagedFileScopesRefresh;
+
+    bool m_useLegacyDefaultFileScopePermissionCache = false;
 };
 
 time_t getThreadCreateTime();