Skip to content

Commit 7384752

Browse files
sodresodre
authored
Merge pull request #13 from zeroae/i/throttle
Invalidate the group cache before add/delete access policies
2 parents 3e796ce + 58b4560 commit 7384752

File tree

4 files changed

+70
-21
lines changed

4 files changed

+70
-21
lines changed

‎nifi-cognito-authorizer/src/main/java/co/zeroae/nifi/authorization/cognito/AbstractCognitoProvider.java

Lines changed: 25 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,14 +17,18 @@
1717
import software.amazon.awssdk.core.retry.RetryPolicy;
1818
import software.amazon.awssdk.core.retry.backoff.BackoffStrategy;
1919
import software.amazon.awssdk.core.retry.backoff.FullJitterBackoffStrategy;
20+
import software.amazon.awssdk.core.retry.conditions.OrRetryCondition;
21+
import software.amazon.awssdk.core.retry.conditions.RetryCondition;
22+
import software.amazon.awssdk.core.retry.conditions.RetryOnExceptionsCondition;
2023
import software.amazon.awssdk.regions.Region;
2124
import software.amazon.awssdk.services.cognitoidentityprovider.CognitoIdentityProviderClient;
22-
import software.amazon.awssdk.services.cognitoidentityprovider.CognitoIdentityProviderClientBuilder;
25+
import software.amazon.awssdk.services.cognitoidentityprovider.model.TooManyRequestsException;
2326

2427
import java.io.FileInputStream;
2528
import java.io.IOException;
2629
import java.io.InputStream;
2730
import java.nio.file.Paths;
31+
import java.time.Duration;
2832
import java.util.Properties;
2933
import java.util.concurrent.TimeUnit;
3034

@@ -33,7 +37,7 @@ public abstract class AbstractCognitoProvider {
3337
static final String ACCESS_KEY_PROPS_NAME = "aws.access.key.id";
3438
static final String SECRET_KEY_PROPS_NAME = "aws.secret.access.key";
3539

36-
public static final int MAX_ATTEMPTS = 10;
40+
public static final int MAX_ATTEMPTS = BackoffStrategy.RETRIES_ATTEMPTED_CEILING;
3741
public static final int MAX_PAGE_SIZE = 60;
3842
public static final String PROP_USER_POOL_ID = "User Pool";
3943
public static final String PROP_TENANT_ID = "Tenant Id";
@@ -97,14 +101,27 @@ CognitoIdentityProviderClient configureClient(final String awsCredentialsFilenam
97101
credentialsProvider = DefaultCredentialsProvider.create();
98102
}
99103
final Region region = Region.of(userPoolId.substring(0, userPoolId.indexOf('_')));
100-
final ClientOverrideConfiguration overrideConfiguration = ClientOverrideConfiguration.builder()
101-
.retryPolicy(RetryPolicy.builder(RetryMode.ADAPTIVE)
102-
.additionalRetryConditionsAllowed(true)
103-
.fastFailRateLimiting(false)
104-
.numRetries(MAX_ATTEMPTS)
105-
.build()
104+
final RetryPolicy retryPolicy = RetryPolicy.builder(RetryMode.ADAPTIVE)
105+
.additionalRetryConditionsAllowed(true)
106+
.fastFailRateLimiting(false)
107+
.numRetries(Math.min(MAX_ATTEMPTS, BackoffStrategy.RETRIES_ATTEMPTED_CEILING))
108+
.retryCondition(OrRetryCondition.create(
109+
RetryOnExceptionsCondition.create(TooManyRequestsException.class),
110+
RetryCondition.defaultRetryCondition()
111+
))
112+
.backoffStrategy(FullJitterBackoffStrategy.builder()
113+
.maxBackoffTime(Duration.ofSeconds(30))
114+
.baseDelay(Duration.ofMillis(500))
115+
.build())
116+
.throttlingBackoffStrategy(FullJitterBackoffStrategy.builder()
117+
.maxBackoffTime(Duration.ofSeconds(30))
118+
.baseDelay(Duration.ofMillis(500))
119+
.build()
106120
)
107121
.build();
122+
final ClientOverrideConfiguration overrideConfiguration = ClientOverrideConfiguration.builder()
123+
.retryPolicy(retryPolicy)
124+
.build();
108125

109126
return CognitoIdentityProviderClient.builder()
110127
.region(region)

‎nifi-cognito-authorizer/src/main/java/co/zeroae/nifi/authorization/cognito/CognitoAccessPolicyProvider.java

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -90,15 +90,20 @@ public AccessPolicy getAccessPolicy(String identifier) throws AuthorizationAcces
9090

9191
@Override
9292
public AccessPolicy getAccessPolicy(String resource, RequestAction action) throws AuthorizationAccessException {
93-
return Objects.requireNonNull(policyByGroupName.get(getGroupName(resource, action))).orElse(null);
93+
final Set<AccessPolicy> allPolicies = getAccessPolicies();
94+
if (allPolicies == null)
95+
return null;
96+
return allPolicies.stream()
97+
.filter(policy -> policy.getResource().equals(resource) && policy.getAction().equals(action))
98+
.findFirst()
99+
.orElse(null);
94100
}
95101

96102
@Override
97103
public AccessPolicy addAccessPolicy(AccessPolicy accessPolicy) throws AuthorizationAccessException {
98104
try {
99-
AccessPolicy rv = super.addAccessPolicy(accessPolicy);
100105
groupTypeCache.invalidateAll();
101-
return rv;
106+
return super.addAccessPolicy(accessPolicy);
102107
} finally {
103108
invalidate(accessPolicy);
104109
}
@@ -113,6 +118,7 @@ public AccessPolicy updateAccessPolicy(AccessPolicy accessPolicy) throws Authori
113118
@Override
114119
public AccessPolicy deleteAccessPolicy(AccessPolicy accessPolicy) throws AuthorizationAccessException {
115120
try {
121+
groupTypeCache.invalidateAll();
116122
return super.deleteAccessPolicy(accessPolicy);
117123
} finally {
118124
invalidate(accessPolicy);

‎nifi-registry-cognito-extensions/src/main/java/co/zeroae/nifi/registry/authorization/cognito/AbstractCognitoProvider.java

Lines changed: 27 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,21 @@
1414
import software.amazon.awssdk.core.client.config.ClientOverrideConfiguration;
1515
import software.amazon.awssdk.core.retry.RetryMode;
1616
import software.amazon.awssdk.core.retry.RetryPolicy;
17+
import software.amazon.awssdk.core.retry.backoff.BackoffStrategy;
18+
import software.amazon.awssdk.core.retry.backoff.FullJitterBackoffStrategy;
19+
import software.amazon.awssdk.core.retry.conditions.OrRetryCondition;
20+
import software.amazon.awssdk.core.retry.conditions.RetryCondition;
21+
import software.amazon.awssdk.core.retry.conditions.RetryOnExceptionsCondition;
1722
import software.amazon.awssdk.regions.Region;
1823
import software.amazon.awssdk.services.cognitoidentityprovider.CognitoIdentityProviderClient;
24+
import software.amazon.awssdk.services.cognitoidentityprovider.model.TooManyRequestsException;
1925
import software.amazon.awssdk.utils.StringUtils;
2026

2127
import java.io.FileInputStream;
2228
import java.io.IOException;
2329
import java.io.InputStream;
2430
import java.nio.file.Paths;
31+
import java.time.Duration;
2532
import java.util.Properties;
2633
import java.util.concurrent.TimeUnit;
2734

@@ -30,7 +37,7 @@ public abstract class AbstractCognitoProvider {
3037
static final String ACCESS_KEY_PROPS_NAME = "aws.access.key.id";
3138
static final String SECRET_KEY_PROPS_NAME = "aws.secret.access.key";
3239

33-
public static final int MAX_ATTEMPTS = 10;
40+
public static final int MAX_ATTEMPTS = BackoffStrategy.RETRIES_ATTEMPTED_CEILING;
3441
public static final int MAX_PAGE_SIZE = 60;
3542
public static final String PROP_USER_POOL_ID = "User Pool";
3643
public static final String PROP_TENANT_ID = "Tenant Id";
@@ -94,14 +101,27 @@ CognitoIdentityProviderClient configureClient(final String awsCredentialsFilenam
94101
credentialsProvider = DefaultCredentialsProvider.create();
95102
}
96103
final Region region = Region.of(userPoolId.substring(0, userPoolId.indexOf('_')));
97-
final ClientOverrideConfiguration overrideConfiguration = ClientOverrideConfiguration.builder()
98-
.retryPolicy(RetryPolicy.builder(RetryMode.ADAPTIVE)
99-
.additionalRetryConditionsAllowed(true)
100-
.fastFailRateLimiting(false)
101-
.numRetries(MAX_ATTEMPTS)
102-
.build()
104+
final RetryPolicy retryPolicy = RetryPolicy.builder(RetryMode.ADAPTIVE)
105+
.additionalRetryConditionsAllowed(true)
106+
.fastFailRateLimiting(false)
107+
.numRetries(Math.min(MAX_ATTEMPTS, BackoffStrategy.RETRIES_ATTEMPTED_CEILING))
108+
.retryCondition(OrRetryCondition.create(
109+
RetryOnExceptionsCondition.create(TooManyRequestsException.class),
110+
RetryCondition.defaultRetryCondition()
111+
))
112+
.backoffStrategy(FullJitterBackoffStrategy.builder()
113+
.maxBackoffTime(Duration.ofSeconds(30))
114+
.baseDelay(Duration.ofMillis(500))
115+
.build())
116+
.throttlingBackoffStrategy(FullJitterBackoffStrategy.builder()
117+
.maxBackoffTime(Duration.ofSeconds(30))
118+
.baseDelay(Duration.ofMillis(500))
119+
.build()
103120
)
104121
.build();
122+
final ClientOverrideConfiguration overrideConfiguration = ClientOverrideConfiguration.builder()
123+
.retryPolicy(retryPolicy)
124+
.build();
105125

106126
return CognitoIdentityProviderClient.builder()
107127
.region(region)

‎nifi-registry-cognito-extensions/src/main/java/co/zeroae/nifi/registry/authorization/cognito/CognitoAccessPolicyProvider.java

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -93,15 +93,20 @@ public AccessPolicy getAccessPolicy(String identifier) throws AuthorizationAcces
9393

9494
@Override
9595
public AccessPolicy getAccessPolicy(String resource, RequestAction action) throws AuthorizationAccessException {
96-
return Objects.requireNonNull(policyByGroupName.get(getGroupName(resource, action))).orElse(null);
96+
final Set<AccessPolicy> allPolicies = getAccessPolicies();
97+
if (allPolicies == null)
98+
return null;
99+
return allPolicies.stream()
100+
.filter(policy -> policy.getResource().equals(resource) && policy.getAction().equals(action))
101+
.findFirst()
102+
.orElse(null);
97103
}
98104

99105
@Override
100106
public AccessPolicy addAccessPolicy(AccessPolicy accessPolicy) throws AuthorizationAccessException {
101107
try {
102-
AccessPolicy rv = super.addAccessPolicy(accessPolicy);
103108
groupTypeCache.invalidateAll();
104-
return rv;
109+
return super.addAccessPolicy(accessPolicy);
105110
} finally {
106111
invalidate(accessPolicy);
107112
}
@@ -116,6 +121,7 @@ public AccessPolicy updateAccessPolicy(AccessPolicy accessPolicy) throws Authori
116121
@Override
117122
public AccessPolicy deleteAccessPolicy(AccessPolicy accessPolicy) throws AuthorizationAccessException {
118123
try {
124+
groupTypeCache.invalidateAll();
119125
return super.deleteAccessPolicy(accessPolicy);
120126
} finally {
121127
invalidate(accessPolicy);

0 commit comments

Comments
 (0)