| 105 | |
| 106 | |
| 107 | const AuthorizationCallbacks createAuthorizationCallbacks( |
| 108 | Authorizer* authorizer) |
| 109 | { |
| 110 | typedef lambda::function<Future<bool>( |
| 111 | const process::http::Request& httpRequest, |
| 112 | const Option<Principal>& principal)> Callback; |
| 113 | |
| 114 | AuthorizationCallbacks callbacks; |
| 115 | |
| 116 | Callback getEndpoint = [authorizer]( |
| 117 | const process::http::Request& httpRequest, |
| 118 | const Option<Principal>& principal) -> Future<bool> { |
| 119 | const string path = httpRequest.url.path; |
| 120 | |
| 121 | if (!AUTHORIZABLE_ENDPOINTS.contains(path)) { |
| 122 | return Failure( |
| 123 | "Endpoint '" + path + "' is not an authorizable endpoint"); |
| 124 | } |
| 125 | |
| 126 | Request authorizationRequest; |
| 127 | authorizationRequest.set_action(GET_ENDPOINT_WITH_PATH); |
| 128 | |
| 129 | Option<Subject> subject = createSubject(principal); |
| 130 | if (subject.isSome()) { |
| 131 | authorizationRequest.mutable_subject()->CopyFrom(subject.get()); |
| 132 | } |
| 133 | |
| 134 | authorizationRequest.mutable_object()->set_value(path); |
| 135 | |
| 136 | LOG(INFO) << "Authorizing principal '" |
| 137 | << (principal.isSome() ? stringify(principal.get()) : "ANY") |
| 138 | << "' to GET the endpoint '" << path << "'"; |
| 139 | |
| 140 | return authorizer->authorized(authorizationRequest); |
| 141 | }; |
| 142 | |
| 143 | callbacks.insert(std::make_pair("/logging/toggle", getEndpoint)); |
| 144 | callbacks.insert(std::make_pair("/metrics/snapshot", getEndpoint)); |
| 145 | |
| 146 | return callbacks; |
| 147 | } |
| 148 | |
| 149 | } // namespace authorization { |
| 150 | } // namespace mesos { |