Examples with SystemPermission org.apache.accumulo.core.security.SystemPermission used on opensource projects

Example 1 with SystemPermission

use of org.apache.accumulo.core.security.SystemPermission in project accumulo by apache.

the class UserPermissionsCommand method execute.

@Override
public int execute(final String fullCommand, final CommandLine cl, final Shell shellState) throws AccumuloException, AccumuloSecurityException, IOException {
    final String user = cl.getOptionValue(userOpt.getOpt(), shellState.getConnector().whoami());
    String delim = "";
    shellState.getReader().print("System permissions: ");
    for (SystemPermission p : SystemPermission.values()) {
        if (p != null && shellState.getConnector().securityOperations().hasSystemPermission(user, p)) {
            shellState.getReader().print(delim + "System." + p.name());
            delim = ", ";
        }
    }
    shellState.getReader().println();
    boolean runOnce = true;
    for (String n : shellState.getConnector().namespaceOperations().list()) {
        delim = "";
        for (NamespacePermission p : NamespacePermission.values()) {
            if (p != null && shellState.getConnector().securityOperations().hasNamespacePermission(user, n, p)) {
                if (runOnce) {
                    shellState.getReader().print("\nNamespace permissions (" + n + "): ");
                    runOnce = false;
                }
                shellState.getReader().print(delim + "Namespace." + p.name());
                delim = ", ";
            }
        }
        runOnce = true;
    }
    shellState.getReader().println();
    runOnce = true;
    for (String t : shellState.getConnector().tableOperations().list()) {
        delim = "";
        for (TablePermission p : TablePermission.values()) {
            if (shellState.getConnector().securityOperations().hasTablePermission(user, t, p) && p != null) {
                if (runOnce) {
                    shellState.getReader().print("\nTable permissions (" + t + "): ");
                    runOnce = false;
                }
                shellState.getReader().print(delim + "Table." + p.name());
                delim = ", ";
            }
        }
        runOnce = true;
    }
    shellState.getReader().println();
    return 0;
}

Example 2 with SystemPermission

use of org.apache.accumulo.core.security.SystemPermission in project accumulo by apache.

the class ZKAuthenticatorTest method testSystemConversion.

public void testSystemConversion() {
    Set<SystemPermission> perms = new TreeSet<>();
    for (SystemPermission s : SystemPermission.values()) perms.add(s);
    Set<SystemPermission> converted = ZKSecurityTool.convertSystemPermissions(ZKSecurityTool.convertSystemPermissions(perms));
    assertTrue(perms.size() == converted.size());
    for (SystemPermission s : perms) assertTrue(converted.contains(s));
}

Example 3 with SystemPermission

use of org.apache.accumulo.core.security.SystemPermission in project accumulo by apache.

the class KerberosIT method testUserPrivilegesForTable.

@Test
public void testUserPrivilegesForTable() throws Exception {
    String user1 = testName.getMethodName();
    final File user1Keytab = new File(kdc.getKeytabDir(), user1 + ".keytab");
    if (user1Keytab.exists() && !user1Keytab.delete()) {
        log.warn("Unable to delete {}", user1Keytab);
    }
    // Create some new users -- cannot contain realm
    kdc.createPrincipal(user1Keytab, user1);
    final String qualifiedUser1 = kdc.qualifyUser(user1);
    // Log in as user1
    UserGroupInformation ugi = UserGroupInformation.loginUserFromKeytabAndReturnUGI(qualifiedUser1, user1Keytab.getAbsolutePath());
    log.info("Logged in as {}", user1);
    ugi.doAs(new PrivilegedExceptionAction<Void>() {

        @Override
        public Void run() throws Exception {
            // Indirectly creates this user when we use it
            Connector conn = mac.getConnector(qualifiedUser1, new KerberosToken());
            log.info("Created connector as {}", qualifiedUser1);
            // The new user should have no system permissions
            for (SystemPermission perm : SystemPermission.values()) {
                assertFalse(conn.securityOperations().hasSystemPermission(qualifiedUser1, perm));
            }
            return null;
        }
    });
    final String table = testName.getMethodName() + "_user_table";
    final String viz = "viz";
    ugi = UserGroupInformation.loginUserFromKeytabAndReturnUGI(rootUser.getPrincipal(), rootUser.getKeytab().getAbsolutePath());
    ugi.doAs(new PrivilegedExceptionAction<Void>() {

        @Override
        public Void run() throws Exception {
            Connector conn = mac.getConnector(rootUser.getPrincipal(), new KerberosToken());
            conn.tableOperations().create(table);
            // Give our unprivileged user permission on the table we made for them
            conn.securityOperations().grantTablePermission(qualifiedUser1, table, TablePermission.READ);
            conn.securityOperations().grantTablePermission(qualifiedUser1, table, TablePermission.WRITE);
            conn.securityOperations().grantTablePermission(qualifiedUser1, table, TablePermission.ALTER_TABLE);
            conn.securityOperations().grantTablePermission(qualifiedUser1, table, TablePermission.DROP_TABLE);
            conn.securityOperations().changeUserAuthorizations(qualifiedUser1, new Authorizations(viz));
            return null;
        }
    });
    // Switch back to the original user
    ugi = UserGroupInformation.loginUserFromKeytabAndReturnUGI(qualifiedUser1, user1Keytab.getAbsolutePath());
    ugi.doAs(new PrivilegedExceptionAction<Void>() {

        @Override
        public Void run() throws Exception {
            Connector conn = mac.getConnector(qualifiedUser1, new KerberosToken());
            // Make sure we can actually use the table we made
            // Write data
            final long ts = 1000l;
            BatchWriter bw = conn.createBatchWriter(table, new BatchWriterConfig());
            Mutation m = new Mutation("a");
            m.put("b", "c", new ColumnVisibility(viz.getBytes()), ts, "d");
            bw.addMutation(m);
            bw.close();
            // Compact
            conn.tableOperations().compact(table, new CompactionConfig().setWait(true).setFlush(true));
            // Alter
            conn.tableOperations().setProperty(table, Property.TABLE_BLOOM_ENABLED.getKey(), "true");
            // Read (and proper authorizations)
            try (Scanner s = conn.createScanner(table, new Authorizations(viz))) {
                Iterator<Entry<Key, Value>> iter = s.iterator();
                assertTrue("No results from iterator", iter.hasNext());
                Entry<Key, Value> entry = iter.next();
                assertEquals(new Key("a", "b", "c", viz, ts), entry.getKey());
                assertEquals(new Value("d".getBytes()), entry.getValue());
                assertFalse("Had more results from iterator", iter.hasNext());
                return null;
            }
        }
    });
}

Example 4 with SystemPermission

use of org.apache.accumulo.core.security.SystemPermission in project accumulo by apache.

the class KerberosIT method testNewUser.

@Test
public void testNewUser() throws Exception {
    String newUser = testName.getMethodName();
    final File newUserKeytab = new File(kdc.getKeytabDir(), newUser + ".keytab");
    if (newUserKeytab.exists() && !newUserKeytab.delete()) {
        log.warn("Unable to delete {}", newUserKeytab);
    }
    // Create a new user
    kdc.createPrincipal(newUserKeytab, newUser);
    final String newQualifiedUser = kdc.qualifyUser(newUser);
    final HashSet<String> users = Sets.newHashSet(rootUser.getPrincipal());
    // Login as the "root" user
    UserGroupInformation ugi = UserGroupInformation.loginUserFromKeytabAndReturnUGI(rootUser.getPrincipal(), rootUser.getKeytab().getAbsolutePath());
    log.info("Logged in as {}", rootUser.getPrincipal());
    ugi.doAs(new PrivilegedExceptionAction<Void>() {

        @Override
        public Void run() throws Exception {
            Connector conn = mac.getConnector(rootUser.getPrincipal(), new KerberosToken());
            log.info("Created connector as {}", rootUser.getPrincipal());
            assertEquals(rootUser.getPrincipal(), conn.whoami());
            // Make sure the system user doesn't exist -- this will force some RPC to happen server-side
            createTableWithDataAndCompact(conn);
            assertEquals(users, conn.securityOperations().listLocalUsers());
            return null;
        }
    });
    // Switch to a new user
    ugi = UserGroupInformation.loginUserFromKeytabAndReturnUGI(newQualifiedUser, newUserKeytab.getAbsolutePath());
    log.info("Logged in as {}", newQualifiedUser);
    ugi.doAs(new PrivilegedExceptionAction<Void>() {

        @Override
        public Void run() throws Exception {
            Connector conn = mac.getConnector(newQualifiedUser, new KerberosToken());
            log.info("Created connector as {}", newQualifiedUser);
            assertEquals(newQualifiedUser, conn.whoami());
            // The new user should have no system permissions
            for (SystemPermission perm : SystemPermission.values()) {
                assertFalse(conn.securityOperations().hasSystemPermission(newQualifiedUser, perm));
            }
            users.add(newQualifiedUser);
            // Same users as before, plus the new user we just created
            assertEquals(users, conn.securityOperations().listLocalUsers());
            return null;
        }
    });
}

Example 5 with SystemPermission

use of org.apache.accumulo.core.security.SystemPermission in project accumulo by apache.

the class KerberosIT method testAdminUser.

@Test
public void testAdminUser() throws Exception {
    // Login as the client (provided to `accumulo init` as the "root" user)
    UserGroupInformation ugi = UserGroupInformation.loginUserFromKeytabAndReturnUGI(rootUser.getPrincipal(), rootUser.getKeytab().getAbsolutePath());
    ugi.doAs(new PrivilegedExceptionAction<Void>() {

        @Override
        public Void run() throws Exception {
            final Connector conn = mac.getConnector(rootUser.getPrincipal(), new KerberosToken());
            // The "root" user should have all system permissions
            for (SystemPermission perm : SystemPermission.values()) {
                assertTrue("Expected user to have permission: " + perm, conn.securityOperations().hasSystemPermission(conn.whoami(), perm));
            }
            // and the ability to modify the root and metadata tables
            for (String table : Arrays.asList(RootTable.NAME, MetadataTable.NAME)) {
                assertTrue(conn.securityOperations().hasTablePermission(conn.whoami(), table, TablePermission.ALTER_TABLE));
            }
            return null;
        }
    });
}