NIFI-16260 - Add a Database Password Provider for GCP CloudSQL #11604
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,234 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one or more | ||
| * contributor license agreements. See the NOTICE file distributed with | ||
| * this work for additional information regarding copyright ownership. | ||
| * The ASF licenses this file to You under the Apache License, Version 2.0 | ||
| * (the "License"); you may not use this file except in compliance with | ||
| * the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package org.apache.nifi.processors.gcp.cloudsql; | ||
|
|
||
| import com.google.auth.oauth2.AccessToken; | ||
| import com.google.auth.oauth2.GoogleCredentials; | ||
| import com.google.auth.oauth2.ImpersonatedCredentials; | ||
| import org.apache.commons.lang3.StringUtils; | ||
| import org.apache.nifi.annotation.documentation.CapabilityDescription; | ||
| import org.apache.nifi.annotation.documentation.Tags; | ||
| import org.apache.nifi.annotation.lifecycle.OnDisabled; | ||
| import org.apache.nifi.annotation.lifecycle.OnEnabled; | ||
| import org.apache.nifi.components.ConfigVerificationResult; | ||
| import org.apache.nifi.components.ConfigVerificationResult.Outcome; | ||
| import org.apache.nifi.components.PropertyDescriptor; | ||
| import org.apache.nifi.controller.AbstractControllerService; | ||
| import org.apache.nifi.controller.ConfigurationContext; | ||
| import org.apache.nifi.controller.VerifiableControllerService; | ||
| import org.apache.nifi.dbcp.api.DatabasePasswordProvider; | ||
| import org.apache.nifi.dbcp.api.DatabasePasswordRequestContext; | ||
| import org.apache.nifi.gcp.credentials.service.GCPCredentialsService; | ||
| import org.apache.nifi.logging.ComponentLog; | ||
| import org.apache.nifi.processor.exception.ProcessException; | ||
| import org.apache.nifi.reporting.InitializationException; | ||
|
|
||
| import java.io.IOException; | ||
| import java.util.ArrayList; | ||
| import java.util.List; | ||
| import java.util.Map; | ||
| import java.util.Objects; | ||
|
|
||
| @Tags({"gcp", "cloud sql", "postgresql", "mysql", "iam", "jdbc", "password"}) | ||
| @CapabilityDescription(""" | ||
| Generates Google Cloud SQL IAM authentication tokens for Cloud SQL database connections. | ||
| PostgreSQL and MySQL are supported. | ||
| The generated access token replaces the database user password so that NiFi does not need to store long-lived credentials inside DBCP services. | ||
| """) | ||
| public class GcpCloudSqlIamDatabasePasswordProvider extends AbstractControllerService implements DatabasePasswordProvider, VerifiableControllerService { | ||
|
|
||
| static final String SQLSERVICE_LOGIN_SCOPE = "https://www.googleapis.com/auth/sqlservice.login"; | ||
| static final String FAILED_PASSWORD_MESSAGE = "Failed to generate Cloud SQL IAM database password"; | ||
| static final String VERIFY_SCOPE_STEP = "Resolve GCP credentials"; | ||
| static final String VERIFY_TOKEN_STEP = "Acquire Cloud SQL IAM access token"; | ||
| static final String VERIFY_CREDENTIALS_UNAVAILABLE = "Configured GCP Credentials Provider Service did not return Google credentials."; | ||
| static final String VERIFY_SCOPED_CREDENTIALS_UNAVAILABLE = "Failed to apply the Cloud SQL login scope to the configured Google credentials."; | ||
| static final String VERIFY_TOKEN_ACQUISITION_FAILED = "Failed to acquire a Cloud SQL IAM access token."; | ||
|
|
||
| static final PropertyDescriptor GCP_CREDENTIALS_PROVIDER_SERVICE = new PropertyDescriptor.Builder() | ||
| .name("GCP Credentials Provider Service") | ||
| .description("Controller Service that provides the Google credentials used to request Cloud SQL IAM authentication tokens.") | ||
| .identifiesControllerService(GCPCredentialsService.class) | ||
| .required(true) | ||
| .build(); | ||
|
|
||
| private static final List<PropertyDescriptor> PROPERTY_DESCRIPTORS = List.of( | ||
| GCP_CREDENTIALS_PROVIDER_SERVICE | ||
| ); | ||
|
|
||
| private volatile GoogleCredentials scopedCredentials; | ||
|
|
||
| @Override | ||
| protected List<PropertyDescriptor> getSupportedPropertyDescriptors() { | ||
| return PROPERTY_DESCRIPTORS; | ||
| } | ||
|
|
||
| @OnEnabled | ||
| public void onEnabled(final ConfigurationContext context) throws InitializationException { | ||
| scopedCredentials = requireScopedCredentials(context); | ||
| } | ||
|
|
||
| @OnDisabled | ||
| public void onDisabled() { | ||
| scopedCredentials = null; | ||
| } | ||
|
|
||
| @Override | ||
| public char[] getPassword(final DatabasePasswordRequestContext requestContext) { | ||
| Objects.requireNonNull(requestContext, "Database Password Request Context required"); | ||
|
|
||
| final GoogleCredentials credentials = scopedCredentials; | ||
| if (credentials == null) { | ||
| throw new ProcessException(FAILED_PASSWORD_MESSAGE); | ||
| } | ||
|
|
||
| final AccessToken accessToken = refreshAccessToken(credentials); | ||
| if (!hasTokenValue(accessToken)) { | ||
| throw new ProcessException(FAILED_PASSWORD_MESSAGE); | ||
| } | ||
|
|
||
| return accessToken.getTokenValue().toCharArray(); | ||
| } | ||
|
|
||
| @Override | ||
| public List<ConfigVerificationResult> verify(final ConfigurationContext context, final ComponentLog verificationLogger, | ||
|
Contributor
There was a problem hiding this comment. With the |
||
| final Map<String, String> attributes) { | ||
| final List<ConfigVerificationResult> results = new ArrayList<>(2); | ||
| final GoogleCredentials scopedVerificationCredentials = resolveVerificationCredentials(context, verificationLogger); | ||
| if (scopedVerificationCredentials == null) { | ||
| results.add(buildVerificationResult(VERIFY_SCOPE_STEP, Outcome.FAILED, VERIFY_CREDENTIALS_UNAVAILABLE)); | ||
| } else { | ||
| final ConfigVerificationResult scopedCredentialResult = describeScopedCredential(scopedVerificationCredentials); | ||
| results.add(scopedCredentialResult); | ||
| if (scopedCredentialResult.getOutcome() == Outcome.SUCCESSFUL) { | ||
| results.add(verifyAccessToken(scopedVerificationCredentials, verificationLogger)); | ||
| } | ||
| } | ||
| return results; | ||
| } | ||
|
|
||
| private GoogleCredentials resolveVerificationCredentials(final ConfigurationContext context, final ComponentLog verificationLogger) { | ||
| try { | ||
| return createSqlLoginScopedCredentials(resolveGoogleCredentials(context)); | ||
| } catch (final RuntimeException e) { | ||
| verificationLogger.error("Failed to resolve scoped Google credentials", e); | ||
| return null; | ||
| } | ||
| } | ||
|
|
||
| private ConfigVerificationResult verifyAccessToken(final GoogleCredentials credentials, final ComponentLog verificationLogger) { | ||
| try { | ||
| final AccessToken accessToken = credentials.refreshAccessToken(); | ||
| return hasTokenValue(accessToken) | ||
| ? buildTokenVerificationResult() | ||
| : buildVerificationResult(VERIFY_TOKEN_STEP, Outcome.FAILED, VERIFY_TOKEN_ACQUISITION_FAILED); | ||
| } catch (final IOException | RuntimeException e) { | ||
| verificationLogger.error("Failed to acquire Cloud SQL IAM access token", e); | ||
| return buildVerificationResult(VERIFY_TOKEN_STEP, Outcome.FAILED, VERIFY_TOKEN_ACQUISITION_FAILED); | ||
| } | ||
| } | ||
|
|
||
| private GoogleCredentials requireScopedCredentials(final ConfigurationContext context) throws InitializationException { | ||
| final GoogleCredentials googleCredentials; | ||
| try { | ||
| googleCredentials = resolveGoogleCredentials(context); | ||
| } catch (final RuntimeException e) { | ||
| throw new InitializationException(VERIFY_CREDENTIALS_UNAVAILABLE, e); | ||
| } | ||
|
|
||
| if (googleCredentials == null) { | ||
| throw new InitializationException(VERIFY_CREDENTIALS_UNAVAILABLE); | ||
| } | ||
|
|
||
| final GoogleCredentials credentials; | ||
| try { | ||
| credentials = createSqlLoginScopedCredentials(googleCredentials); | ||
| } catch (final RuntimeException e) { | ||
| throw new InitializationException(VERIFY_SCOPED_CREDENTIALS_UNAVAILABLE, e); | ||
| } | ||
|
|
||
| if (credentials == null) { | ||
| throw new InitializationException(VERIFY_SCOPED_CREDENTIALS_UNAVAILABLE); | ||
| } | ||
|
|
||
| return credentials; | ||
| } | ||
|
|
||
| private AccessToken refreshAccessToken(final GoogleCredentials credentials) { | ||
| try { | ||
| credentials.refreshIfExpired(); | ||
| } catch (final IOException | RuntimeException e) { | ||
| throw new ProcessException(FAILED_PASSWORD_MESSAGE); | ||
| } | ||
|
|
||
| return credentials.getAccessToken(); | ||
| } | ||
|
|
||
| private GoogleCredentials resolveGoogleCredentials(final ConfigurationContext context) { | ||
| final GCPCredentialsService credentialsService = context.getProperty(GCP_CREDENTIALS_PROVIDER_SERVICE) | ||
| .asControllerService(GCPCredentialsService.class); | ||
| if (credentialsService == null) { | ||
| return null; | ||
| } | ||
|
|
||
| return credentialsService.getGoogleCredentials(); | ||
| } | ||
|
|
||
| private GoogleCredentials createSqlLoginScopedCredentials(final GoogleCredentials googleCredentials) { | ||
| if (googleCredentials == null) { | ||
| return null; | ||
| } | ||
|
|
||
| return googleCredentials.createScoped(List.of(SQLSERVICE_LOGIN_SCOPE)); | ||
| } | ||
|
|
||
| private ConfigVerificationResult describeScopedCredential(final GoogleCredentials scopedVerificationCredentials) { | ||
| if (scopedVerificationCredentials instanceof ImpersonatedCredentials) { | ||
| return buildVerificationResult( | ||
| VERIFY_SCOPE_STEP, | ||
| Outcome.SUCCESSFUL, | ||
| "Resolved GCP credentials and Cloud SQL login scope. Target service account impersonation is active." | ||
| ); | ||
| } | ||
|
|
||
| return buildVerificationResult( | ||
| VERIFY_SCOPE_STEP, | ||
| Outcome.SUCCESSFUL, | ||
| "Resolved GCP credentials and Cloud SQL login scope." | ||
| ); | ||
| } | ||
|
|
||
| private ConfigVerificationResult buildTokenVerificationResult() { | ||
| return buildVerificationResult( | ||
| VERIFY_TOKEN_STEP, | ||
| Outcome.SUCCESSFUL, | ||
| "Acquired a Cloud SQL IAM access token. Use DBCP Verify to validate the database connection." | ||
| ); | ||
| } | ||
|
|
||
| private boolean hasTokenValue(final AccessToken accessToken) { | ||
| return accessToken != null && StringUtils.isNotBlank(accessToken.getTokenValue()); | ||
| } | ||
|
|
||
| private ConfigVerificationResult buildVerificationResult(final String stepName, final Outcome outcome, final String explanation) { | ||
| return new ConfigVerificationResult.Builder() | ||
| .verificationStepName(stepName) | ||
| .outcome(outcome) | ||
| .explanation(explanation) | ||
| .build(); | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.