-
Notifications
You must be signed in to change notification settings - Fork 610
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
YDB FQ: handle exception in YQL Generic Provider when IAM service is …
…not available (#9186)
- Loading branch information
1 parent
678534f
commit 592841b
Showing
3 changed files
with
115 additions
and
57 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
72 changes: 39 additions & 33 deletions
72
ydb/library/yql/providers/generic/actors/yql_generic_token_provider.cpp
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,67 +1,73 @@ | ||
| #include "yql_generic_token_provider.h" | ||
|
|
||
| #include <ydb/library/yql/providers/common/structured_token/yql_token_builder.h> | ||
| #include <ydb/library/yql/utils/log/log.h> | ||
|
|
||
| namespace NYql::NDq { | ||
| TGenericTokenProvider::TGenericTokenProvider( | ||
| const NYql::Generic::TSource& source, const ISecuredServiceAccountCredentialsFactory::TPtr& credentialsFactory) | ||
| : Source_(source) | ||
| , StaticIAMToken_(source.GetToken()) | ||
| , CredentialsProvider_(nullptr) | ||
| TGenericTokenProvider::TGenericTokenProvider(const TString& staticIamToken) | ||
| : StaticIAMToken_(staticIamToken) | ||
| { | ||
| // 1. User has provided IAM-token itself. | ||
| // This token will be used during the whole lifetime of a read actor. | ||
| if (!StaticIAMToken_.empty()) { | ||
| return; | ||
| } | ||
| } | ||
|
|
||
| // 2. User has provided service account creds. | ||
| // We create token accessor client that will renew token accessor by demand. | ||
| if (source.GetServiceAccountId() && source.GetServiceAccountIdSignature()) { | ||
| Y_ENSURE(credentialsFactory, "CredentialsFactory is not initialized"); | ||
| TGenericTokenProvider::TGenericTokenProvider( | ||
| const TString& serviceAccountId, const TString& ServiceAccountIdSignature, | ||
| const ISecuredServiceAccountCredentialsFactory::TPtr& credentialsFactory) { | ||
| Y_ENSURE(!serviceAccountId.Empty(), "No service account provided"); | ||
| Y_ENSURE(!ServiceAccountIdSignature.Empty(), "No service account signature provided"); | ||
| Y_ENSURE(credentialsFactory, "CredentialsFactory is not initialized"); | ||
|
|
||
| auto structuredTokenJSON = | ||
| TStructuredTokenBuilder() | ||
| .SetServiceAccountIdAuth(source.GetServiceAccountId(), source.GetServiceAccountIdSignature()) | ||
| .ToJson(); | ||
| auto structuredTokenJSON = | ||
| TStructuredTokenBuilder().SetServiceAccountIdAuth(serviceAccountId, ServiceAccountIdSignature).ToJson(); | ||
|
|
||
| // If service account is provided, obtain IAM-token | ||
| Y_ENSURE(structuredTokenJSON, "empty structured token"); | ||
| Y_ENSURE(structuredTokenJSON, "empty structured token"); | ||
|
|
||
| auto credentialsProviderFactory = | ||
| CreateCredentialsProviderFactoryForStructuredToken(credentialsFactory, structuredTokenJSON, false); | ||
| CredentialsProvider_ = credentialsProviderFactory->CreateProvider(); | ||
| } | ||
|
|
||
| // 3. If we reached this point, it means that user doesn't need token auth. | ||
| auto credentialsProviderFactory = | ||
| CreateCredentialsProviderFactoryForStructuredToken(credentialsFactory, structuredTokenJSON, false); | ||
| CredentialsProvider_ = credentialsProviderFactory->CreateProvider(); | ||
| } | ||
|
|
||
| void TGenericTokenProvider::MaybeFillToken(NConnector::NApi::TDataSourceInstance& dsi) const { | ||
| TString TGenericTokenProvider::MaybeFillToken(NConnector::NApi::TDataSourceInstance& dsi) const { | ||
| // 1. Don't need tokens if basic auth is set | ||
| if (dsi.credentials().has_basic()) { | ||
| return; | ||
| return {}; | ||
| } | ||
|
|
||
| *dsi.mutable_credentials()->mutable_token()->mutable_type() = "IAM"; | ||
|
|
||
| // 2. If static IAM-token has been provided, use it | ||
| if (!StaticIAMToken_.empty()) { | ||
| *dsi.mutable_credentials()->mutable_token()->mutable_value() = StaticIAMToken_; | ||
| return; | ||
| return {}; | ||
| } | ||
|
|
||
| // 3. Otherwise use credentials provider to get token | ||
| Y_ENSURE(CredentialsProvider_, "CredentialsProvider is not initialized"); | ||
|
|
||
| auto iamToken = CredentialsProvider_->GetAuthInfo(); | ||
| TString iamToken; | ||
| try { | ||
| iamToken = CredentialsProvider_->GetAuthInfo(); | ||
| } catch (const std::exception& e) { | ||
| YQL_CLOG(ERROR, ProviderGeneric) << "MaybeFillToken: " << e.what(); | ||
| return TString(e.what()); | ||
| } | ||
|
|
||
| Y_ENSURE(iamToken, "CredentialsProvider returned empty IAM token"); | ||
|
|
||
| *dsi.mutable_credentials()->mutable_token()->mutable_value() = std::move(iamToken); | ||
| return {}; | ||
| } | ||
|
|
||
| TGenericTokenProvider::TPtr | ||
| CreateGenericTokenProvider(const NYql::Generic::TSource& source, | ||
| CreateGenericTokenProvider(const TString& staticIamToken, const TString& serviceAccountId, | ||
| const TString& serviceAccountIdSignature, | ||
| const ISecuredServiceAccountCredentialsFactory::TPtr& credentialsFactory) { | ||
| return std::make_unique<TGenericTokenProvider>(source, credentialsFactory); | ||
| if (!staticIamToken.Empty()) { | ||
| return std::make_unique<TGenericTokenProvider>(staticIamToken); | ||
| } | ||
| if (!serviceAccountId.Empty()) { | ||
| return std::make_unique<TGenericTokenProvider>(serviceAccountId, serviceAccountIdSignature, | ||
| credentialsFactory); | ||
| } | ||
| return std::make_unique<TGenericTokenProvider>(); | ||
| } | ||
| } //namespace NYql::NDq | ||
| } // namespace NYql::NDq |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters