Add a server option for setting authorizer (#829)

Author: sergeybykov

cmd/server/main.go

@@ -31,6 +31,7 @@ import (
 
 	"github.com/urfave/cli"
 
+	"go.temporal.io/server/common/authorization"
 	"go.temporal.io/server/common/headers"
 	_ "go.temporal.io/server/common/persistence/sql/sqlplugin/mysql"      // needed to load mysql plugin
 	_ "go.temporal.io/server/common/persistence/sql/sqlplugin/postgresql" // needed to load postgresql plugin
@@ -100,6 +101,7 @@ func buildCLI() *cli.App {
 					temporal.ForServices(services),
 					temporal.WithConfigLoader(configDir, env, zone),
 					temporal.InterruptOn(temporal.InterruptCh()),
+					temporal.WithAuthorizer(authorization.NewNopAuthorizer()),
 				)
 
 				err := s.Start()

temporal/server.go

@@ -316,7 +316,12 @@ func (s *Server) getServiceParams(
 
 	params.ArchiverProvider = provider.NewArchiverProvider(s.so.config.Archival.History.Provider, s.so.config.Archival.Visibility.Provider)
 	params.PersistenceConfig.TransactionSizeLimit = dc.GetIntProperty(dynamicconfig.TransactionSizeLimit, common.DefaultTransactionSizeLimit)
-	params.Authorizer = authorization.NewNopAuthorizer()
+
+	if s.so.authorizer != nil {
+		params.Authorizer = s.so.authorizer
+	} else {
+		params.Authorizer = authorization.NewNopAuthorizer()
+	}
 
 	return &params, nil
 }

temporal/server_option.go

@@ -25,6 +25,7 @@
 package temporal
 
 import (
+	"go.temporal.io/server/common/authorization"
 	"go.temporal.io/server/common/service/config"
 )
 
@@ -59,3 +60,10 @@ func InterruptOn(interruptCh <-chan interface{}) ServerOption {
 		s.interruptCh = interruptCh
 	})
 }
+
+// Sets low level authorizer to allow/deny all API calls
+func WithAuthorizer(authorizer authorization.Authorizer) ServerOption {
+	return newApplyFuncContainer(func(s *serverOptions) {
+		s.authorizer = authorizer
+	})
+}

temporal/server_options.go

@@ -27,15 +27,17 @@ package temporal
 import (
 	"fmt"
 
+	"go.temporal.io/server/common/authorization"
 	"go.temporal.io/server/common/service/config"
 )
 
 type (
 	serverOptions struct {
-		config    *config.Config
-		configDir string
-		env       string
-		zone      string
+		config     *config.Config
+		authorizer authorization.Authorizer
+		configDir  string
+		env        string
+		zone       string
 
 		serviceNames []string