Github user mcgilman commented on the issue:
https://github.com/apache/nifi/pull/2703
@markobean I just ran your PR and I'm not seeing the same behavior you are
describing. Even without the component policy, I'm able to view the provenance
event. This is the behavior I was expecting to see following the discussion on
the JIRA. It's possible that we're using the same language to refer to
different things. Let me try to elaborate/clarify a bit here.
/processors/1234 - component policy (controls access to a component and its
config)
/provenance-data/processors/1234 - comopnent provenance event policy
(controls access to the provenance events from a component)
/data/processors/1234 - component data policy (controls access to the data
from a component including flowfile attributes)
The line you referenced should only verify access to the component
provenance event (and it appears that's how it's working). It should not be
checking the component policy. My suggestion was to additionally check the
component policy prior to populating the component details
(`setComponentDetails`). This would be in line with your initial comment on
this JIRA.
With your most recent changes, I'm not sure its functionality is different
than before. It seems that it would be impossible to get a non-summarized event
without permissions to the data of the component. I think we only need to
verify permissions to data of a component for the attributes and the content
specific fields. Other fields should be ok, allowing for a non-summarized event
for folks without access to a component's data.
It appears that `checkAuthorizationForReplay` was also verifying that the
connection that would be replayed into still exists. This would affect the
availability of the replay action. Also, while a little nit-picky, I would also
suggest using the `checkAuthorization...` methods which return an
`AuthorizationResult` instead of relying on an `Exception` during a
non-exceptional case. The generation of the stack trace is an expensive
operation.
Also, it does not seem like you updated or replied to my comment regarding
the need to include the flowfile attributes when authorizing access to
component's provenance events. I think these are only necessary when
authorizing access to a component's data.
Please do not squash additional commits. It makes it difficult to review
when I cannot easily see the incremental changes.
Thanks!
---
