Examples with VirtualGroupRequest com.sequenceiq.cloudbreak.auth.altus.VirtualGroupRequest used on opensource projects

Example 1 with VirtualGroupRequest

use of com.sequenceiq.cloudbreak.auth.altus.VirtualGroupRequest in project cloudbreak by hortonworks.

the class ClusterHostServiceRunner method createSaltConfig.

private SaltConfig createSaltConfig(Stack stack, Cluster cluster, List<GrainProperties> grainsProperties) throws IOException, CloudbreakOrchestratorException {
    GatewayConfig primaryGatewayConfig = gatewayConfigService.getPrimaryGatewayConfig(stack);
    ClouderaManagerRepo clouderaManagerRepo = clusterComponentConfigProvider.getClouderaManagerRepoDetails(cluster.getId());
    Map<String, SaltPillarProperties> servicePillar = new HashMap<>();
    KerberosConfig kerberosConfig = kerberosConfigService.get(stack.getEnvironmentCrn(), stack.getName()).orElse(null);
    saveCustomNameservers(stack, kerberosConfig, servicePillar);
    servicePillar.putAll(createUnboundEliminationPillar(stack.getDomainDnsResolver()));
    addKerberosConfig(servicePillar, kerberosConfig);
    servicePillar.putAll(hostAttributeDecorator.createHostAttributePillars(stack));
    servicePillar.put("discovery", new SaltPillarProperties("/discovery/init.sls", singletonMap("platform", stack.cloudPlatform())));
    String virtualGroupsEnvironmentCrn = environmentConfigProvider.getParentEnvironmentCrn(stack.getEnvironmentCrn());
    boolean deployedInChildEnvironment = !virtualGroupsEnvironmentCrn.equals(stack.getEnvironmentCrn());
    Map<String, ? extends Serializable> clusterProperties = Map.of("name", stack.getCluster().getName(), "deployedInChildEnvironment", deployedInChildEnvironment);
    servicePillar.put("metadata", new SaltPillarProperties("/metadata/init.sls", singletonMap("cluster", clusterProperties)));
    ClusterPreCreationApi connector = clusterApiConnectors.getConnector(cluster);
    Map<String, List<String>> serviceLocations = getServiceLocations(cluster);
    Optional<LdapView> ldapView = ldapConfigService.get(stack.getEnvironmentCrn(), stack.getName());
    VirtualGroupRequest virtualGroupRequest = getVirtualGroupRequest(virtualGroupsEnvironmentCrn, ldapView);
    servicePillar.putAll(createGatewayPillar(primaryGatewayConfig, cluster, stack, virtualGroupRequest, connector, kerberosConfig, serviceLocations, clouderaManagerRepo));
    saveIdBrokerPillar(cluster, servicePillar);
    postgresConfigService.decorateServicePillarWithPostgresIfNeeded(servicePillar, stack, cluster);
    addClouderaManagerConfig(stack, cluster, servicePillar, clouderaManagerRepo, primaryGatewayConfig);
    ldapView.ifPresent(ldap -> saveLdapPillar(ldap, servicePillar));
    saveSssdAdPillar(servicePillar, kerberosConfig);
    servicePillar.putAll(saveSssdIpaPillar(kerberosConfig, serviceLocations, stack.getEnvironmentCrn()));
    Map<String, Map<String, String>> mountPathMap = stack.getInstanceGroups().stream().flatMap(group -> group.getInstanceMetaDataSet().stream().filter(instanceMetaData -> instanceMetaData.getDiscoveryFQDN() != null).collect(Collectors.toMap(InstanceMetaData::getDiscoveryFQDN, node -> Map.of("mount_path", getMountPath(group), "cloud_platform", stack.getCloudPlatform(), "temporary_storage", group.getTemplate().getTemporaryStorage().name()), (l, r) -> Map.of("mount_path", getMountPath(group), "cloud_platform", stack.getCloudPlatform(), "temporary_storage", group.getTemplate().getTemporaryStorage().name()))).entrySet().stream()).collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue));
    servicePillar.put("startup", new SaltPillarProperties("/mount/startup.sls", singletonMap("mount", mountPathMap)));
    proxyConfigProvider.decoratePillarWithProxyDataIfNeeded(servicePillar, cluster);
    decoratePillarWithJdbcConnectors(cluster, servicePillar);
    return new SaltConfig(servicePillar, grainsProperties);
}

Example 2 with VirtualGroupRequest

use of com.sequenceiq.cloudbreak.auth.altus.VirtualGroupRequest in project cloudbreak by hortonworks.

the class ClusterHostServiceRunner method createSaltConfigWithGatewayPillarOnly.

private SaltConfig createSaltConfigWithGatewayPillarOnly(Stack stack, Cluster cluster, List<GrainProperties> grainsProperties) throws IOException, CloudbreakOrchestratorException {
    GatewayConfig primaryGatewayConfig = gatewayConfigService.getPrimaryGatewayConfig(stack);
    String virtualGroupsEnvironmentCrn = environmentConfigProvider.getParentEnvironmentCrn(stack.getEnvironmentCrn());
    ClusterPreCreationApi connector = clusterApiConnectors.getConnector(cluster);
    Map<String, List<String>> serviceLocations = getServiceLocations(cluster);
    LOGGER.debug("Getting LDAP config for Gateway pillar");
    Optional<LdapView> ldapView = ldapConfigService.get(stack.getEnvironmentCrn(), stack.getName());
    VirtualGroupRequest virtualGroupRequest = getVirtualGroupRequest(virtualGroupsEnvironmentCrn, ldapView);
    LOGGER.debug("Getting kerberos config for Gateway pillar");
    KerberosConfig kerberosConfig = kerberosConfigService.get(stack.getEnvironmentCrn(), stack.getName()).orElse(null);
    ClouderaManagerRepo clouderaManagerRepo = clusterComponentConfigProvider.getClouderaManagerRepoDetails(cluster.getId());
    LOGGER.debug("Creating gateway pillar");
    Map<String, SaltPillarProperties> servicePillar = new HashMap<>(createGatewayPillar(primaryGatewayConfig, cluster, stack, virtualGroupRequest, connector, kerberosConfig, serviceLocations, clouderaManagerRepo));
    return new SaltConfig(servicePillar, grainsProperties);
}

Example 3 with VirtualGroupRequest

use of com.sequenceiq.cloudbreak.auth.altus.VirtualGroupRequest in project cloudbreak by hortonworks.

the class LdapSSOConfigurationHandler method accept.

@Override
public void accept(Event<LdapSSOConfigurationRequest> ldapConfigurationRequestEvent) {
    Long stackId = ldapConfigurationRequestEvent.getData().getResourceId();
    Selectable response;
    try {
        Stack stack = stackService.getByIdWithListsInTransaction(stackId);
        GatewayConfig primaryGatewayConfig = gatewayConfigService.getPrimaryGatewayConfig(stack);
        LdapView ldapView = ldapConfigService.get(stack.getEnvironmentCrn(), stack.getName()).orElse(null);
        String environmentCrnForVirtualGroups = environmentConfigProvider.getParentEnvironmentCrn(stack.getEnvironmentCrn());
        VirtualGroupRequest virtualGroupRequest = new VirtualGroupRequest(environmentCrnForVirtualGroups, ldapView != null ? ldapView.getAdminGroup() : "");
        clusterApiConnectors.getConnector(stack).clusterSecurityService().setupLdapAndSSO(primaryGatewayConfig.getPublicAddress(), ldapView, virtualGroupRequest);
        response = new LdapSSOConfigurationSuccess(stackId);
    } catch (Exception e) {
        LOGGER.info("Error during LDAP configuration, stackId: " + stackId, e);
        response = new LdapSSOConfigurationFailed(stackId, e);
    }
    eventBus.notify(response.selector(), new Event<>(ldapConfigurationRequestEvent.getHeaders(), response));
}

Example 4 with VirtualGroupRequest

use of com.sequenceiq.cloudbreak.auth.altus.VirtualGroupRequest in project cloudbreak by hortonworks.

the class RangerRoleConfigProviderTest method testGetRangerAdminDefaultPolicyGroups.

@ParameterizedTest(name = "{0}")
@MethodSource("defaultPolicyGroupsDataProvider")
public void testGetRangerAdminDefaultPolicyGroups(String testCaseName, String cdhVersion, int expectedRoleConfigCount, int expectedSvcConfigCount) {
    HostgroupView master = new HostgroupView("master", 1, InstanceGroupType.GATEWAY, 1);
    HostgroupView worker = new HostgroupView("worker", 2, InstanceGroupType.CORE, 2);
    String inputJson = getBlueprintText("input/clouderamanager-db-config.bp");
    CmTemplateProcessor cmTemplateProcessor = new CmTemplateProcessor(inputJson);
    cmTemplateProcessor.setCdhVersion(cdhVersion);
    TemplatePreparationObject preparationObject = Builder.builder().withHostgroupViews(Set.of(master, worker)).withBlueprintView(new BlueprintView(inputJson, "", "", cmTemplateProcessor)).withRdsConfigs(Set.of(rdsConfig(DatabaseType.RANGER))).withVirtualGroupView(new VirtualGroupRequest(TestConstants.CRN, "")).withProductDetails(generateCmRepo(() -> cdhVersion), null).build();
    if (expectedRoleConfigCount == 6) {
        when(virtualGroupService.createOrGetVirtualGroup(preparationObject.getVirtualGroupRequest(), RANGER_ADMIN)).thenReturn(ADMIN_GROUP);
    }
    if ("7.6.0".equals(cdhVersion)) {
        when(virtualGroupService.createOrGetVirtualGroup(preparationObject.getVirtualGroupRequest(), RANGER_ADMIN)).thenReturn(ADMIN_GROUP);
        when(virtualGroupService.createOrGetVirtualGroup(preparationObject.getVirtualGroupRequest(), HBASE_ADMIN)).thenReturn(HBASE_ADMIN_GROUP);
    }
    Map<String, List<ApiClusterTemplateConfig>> roleConfigs = underTest.getRoleConfigs(cmTemplateProcessor, preparationObject);
    List<ApiClusterTemplateConfig> masterRangerAdmin = roleConfigs.get("ranger-RANGER_ADMIN-BASE");
    assertThat(masterRangerAdmin.size()).isEqualTo(expectedRoleConfigCount);
    List<ApiClusterTemplateConfig> serviceConfigs = underTest.getServiceConfigs(cmTemplateProcessor, preparationObject);
    assertThat(serviceConfigs.size()).isEqualTo(expectedSvcConfigCount);
    if (expectedRoleConfigCount == 6) {
        assertThat(masterRangerAdmin.get(5).getName()).isEqualTo(RANGER_DEFAULT_POLICY_GROUPS);
        assertThat(masterRangerAdmin.get(5).getValue()).isEqualTo(ADMIN_GROUP);
    }
    if ("7.6.0".equals(cdhVersion)) {
        assertThat(masterRangerAdmin.get(1).getName()).isEqualTo(RANGER_HBASE_ADMIN_VIRTUAL_GROUPS);
        assertThat(masterRangerAdmin.get(1).getValue()).isEqualTo(HBASE_ADMIN_GROUP);
    }
}

Example 5 with VirtualGroupRequest

use of com.sequenceiq.cloudbreak.auth.altus.VirtualGroupRequest in project cloudbreak by hortonworks.

the class KnoxGatewayConfigProviderTest method roleConfigsWithGatewayWithLdapConfig.

@Test
public void roleConfigsWithGatewayWithLdapConfig() {
    Gateway gateway = new Gateway();
    gateway.setKnoxMasterSecret("admin");
    gateway.setPath("/a/b/c");
    IdBroker idBroker = new IdBroker();
    idBroker.setMasterSecret("supersecret");
    BlueprintTextProcessor blueprintTextProcessor = mock(BlueprintTextProcessor.class);
    LdapView ldapConfig = LdapViewBuilder.aLdapView().build();
    BlueprintView blueprintView = new BlueprintView("text", "7.2.11", "CDH", blueprintTextProcessor);
    GeneralClusterConfigs generalClusterConfigs = new GeneralClusterConfigs();
    generalClusterConfigs.setAccountId(Optional.of("1234"));
    TemplatePreparationObject source = Builder.builder().withGateway(gateway, "key", new HashSet<>()).withLdapConfig(ldapConfig).withGeneralClusterConfigs(generalClusterConfigs).withBlueprintView(blueprintView).withVirtualGroupView(new VirtualGroupRequest(TestConstants.CRN, "")).withProductDetails(new ClouderaManagerRepo().withVersion("7.4.2"), List.of(new ClouderaManagerProduct().withVersion("7.2.10").withName("CDH"))).withIdBroker(idBroker).build();
    when(virtualGroupService.createOrGetVirtualGroup(source.getVirtualGroupRequest(), UmsVirtualGroupRight.KNOX_ADMIN)).thenReturn("knox_admins");
    when(entitlementService.isOjdbcTokenDhOneHour(anyString())).thenReturn(true);
    assertEquals(List.of(config("idbroker_master_secret", "supersecret"), config("idbroker_gateway_knox_admin_groups", "knox_admins"), config("idbroker_gateway_signing_keystore_name", "signing.jks"), config("idbroker_gateway_signing_keystore_type", "JKS"), config("idbroker_gateway_signing_key_alias", "signing-identity")), underTest.getRoleConfigs(KnoxRoles.IDBROKER, source));
    assertEquals(List.of(config("gateway_master_secret", gateway.getKnoxMasterSecret()), config("gateway_default_topology_name", "cdp-proxy"), config("gateway_knox_admin_groups", "knox_admins"), config("gateway_auto_discovery_enabled", "false"), config("gateway_path", gateway.getPath()), config("gateway_signing_keystore_name", "signing.jks"), config("gateway_signing_keystore_type", "JKS"), config("gateway_signing_key_alias", "signing-identity"), config("gateway_dispatch_whitelist", "^*.*$"), config("gateway_service_tokenstate_impl", "org.apache.knox.gateway.services.token.impl.JDBCTokenStateService")), ThreadBasedUserCrnProvider.doAs(TEST_USER_CRN, () -> underTest.getRoleConfigs(KnoxRoles.KNOX_GATEWAY, source)));
    assertEquals(List.of(), underTest.getRoleConfigs("NAMENODE", source));
}