[IGNITE-5077] Support service security permissions

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Implemented
• Fix Version/s: 2.1
• Component/s: managed services
• Assignee: Dmitry Karachentsev
• Reporter: Dmitry Karachentsev
• Created: 25/Apr/17 10:28
• Updated: 04/Jul/19 21:54
• Resolved: 02/May/17 09:51

Description

Need to add capability to specify permissions to allow/disallow executions of particular services (similar to compute tasks).

The following permissions should be added to the SecurityPermission enum:

SERVICE_DEPLOY - for IgniteServices.deployXXX methods.
SERVICE_CANCEL - for IgniteServices.cancel and IgniteServices.cancelAll methods.
SERVICE_INVOKE - for IgniteServices.service, IgniteServices.services and IgniteServices.serviceProxy methods.

SERVICE_INVOKE should allow fine-grained authorization based on service name, similar to TASK_EXECUTE. E.g., a particular user should be able to execute service A, but not service B.

Issue Links

• relates to: IGNITE-5259 Minor serialization fix
• links to: GitHub Pull Request #1870
• links to: GitHub Pull Request #1870