Examples with SystemPermission org.apache.accumulo.core.security.SystemPermission used on opensource projects

Example 11 with SystemPermission

use of org.apache.accumulo.core.security.SystemPermission in project accumulo by apache.

the class ZKSecurityTool method convertSystemPermissions.

public static byte[] convertSystemPermissions(Set<SystemPermission> systempermissions) {
    ByteArrayOutputStream bytes = new ByteArrayOutputStream(systempermissions.size());
    DataOutputStream out = new DataOutputStream(bytes);
    try {
        for (SystemPermission sp : systempermissions) out.writeByte(sp.getId());
    } catch (IOException e) {
        log.error("{}", e.getMessage(), e);
        // this is impossible with ByteArrayOutputStream; crash hard if this happens
        throw new RuntimeException(e);
    }
    return bytes.toByteArray();
}

Example 12 with SystemPermission

use of org.apache.accumulo.core.security.SystemPermission in project accumulo by apache.

the class ZKSecurityTool method convertSystemPermissions.

public static Set<SystemPermission> convertSystemPermissions(byte[] systempermissions) {
    ByteArrayInputStream bytes = new ByteArrayInputStream(systempermissions);
    DataInputStream in = new DataInputStream(bytes);
    Set<SystemPermission> toReturn = new HashSet<>();
    try {
        while (in.available() > 0) toReturn.add(SystemPermission.getPermissionById(in.readByte()));
    } catch (IOException e) {
        log.error("User database is corrupt; error converting system permissions", e);
        toReturn.clear();
    }
    return toReturn;
}

Example 13 with SystemPermission

use of org.apache.accumulo.core.security.SystemPermission in project accumulo by apache.

the class PermissionsIT method systemPermissionsTest.

@Test
public void systemPermissionsTest() throws Exception {
    ClusterUser testUser = getUser(0), rootUser = getAdminUser();
    // verify that the test is being run by root
    Connector c = getConnector();
    verifyHasOnlyTheseSystemPermissions(c, c.whoami(), SystemPermission.values());
    // create the test user
    String principal = testUser.getPrincipal();
    AuthenticationToken token = testUser.getToken();
    PasswordToken passwordToken = null;
    if (token instanceof PasswordToken) {
        passwordToken = (PasswordToken) token;
    }
    loginAs(rootUser);
    c.securityOperations().createLocalUser(principal, passwordToken);
    loginAs(testUser);
    Connector test_user_conn = c.getInstance().getConnector(principal, token);
    loginAs(rootUser);
    verifyHasNoSystemPermissions(c, principal, SystemPermission.values());
    // test each permission
    for (SystemPermission perm : SystemPermission.values()) {
        log.debug("Verifying the {} permission", perm);
        // test permission before and after granting it
        String tableNamePrefix = getUniqueNames(1)[0];
        testMissingSystemPermission(tableNamePrefix, c, rootUser, test_user_conn, testUser, perm);
        loginAs(rootUser);
        c.securityOperations().grantSystemPermission(principal, perm);
        verifyHasOnlyTheseSystemPermissions(c, principal, perm);
        testGrantedSystemPermission(tableNamePrefix, c, rootUser, test_user_conn, testUser, perm);
        loginAs(rootUser);
        c.securityOperations().revokeSystemPermission(principal, perm);
        verifyHasNoSystemPermissions(c, principal, perm);
    }
}

Example 14 with SystemPermission

use of org.apache.accumulo.core.security.SystemPermission in project accumulo by apache.

the class KerberosIT method testUserPrivilegesThroughGrant.

@Test
public void testUserPrivilegesThroughGrant() throws Exception {
    String user1 = testName.getMethodName();
    final File user1Keytab = new File(kdc.getKeytabDir(), user1 + ".keytab");
    if (user1Keytab.exists() && !user1Keytab.delete()) {
        log.warn("Unable to delete {}", user1Keytab);
    }
    // Create some new users
    kdc.createPrincipal(user1Keytab, user1);
    final String qualifiedUser1 = kdc.qualifyUser(user1);
    // Log in as user1
    UserGroupInformation ugi = UserGroupInformation.loginUserFromKeytabAndReturnUGI(user1, user1Keytab.getAbsolutePath());
    log.info("Logged in as {}", user1);
    ugi.doAs(new PrivilegedExceptionAction<Void>() {

        @Override
        public Void run() throws Exception {
            // Indirectly creates this user when we use it
            Connector conn = mac.getConnector(qualifiedUser1, new KerberosToken());
            log.info("Created connector as {}", qualifiedUser1);
            // The new user should have no system permissions
            for (SystemPermission perm : SystemPermission.values()) {
                assertFalse(conn.securityOperations().hasSystemPermission(qualifiedUser1, perm));
            }
            return null;
        }
    });
    ugi = UserGroupInformation.loginUserFromKeytabAndReturnUGI(rootUser.getPrincipal(), rootUser.getKeytab().getAbsolutePath());
    ugi.doAs(new PrivilegedExceptionAction<Void>() {

        @Override
        public Void run() throws Exception {
            Connector conn = mac.getConnector(rootUser.getPrincipal(), new KerberosToken());
            conn.securityOperations().grantSystemPermission(qualifiedUser1, SystemPermission.CREATE_TABLE);
            return null;
        }
    });
    // Switch back to the original user
    ugi = UserGroupInformation.loginUserFromKeytabAndReturnUGI(user1, user1Keytab.getAbsolutePath());
    ugi.doAs(new PrivilegedExceptionAction<Void>() {

        @Override
        public Void run() throws Exception {
            Connector conn = mac.getConnector(qualifiedUser1, new KerberosToken());
            // Shouldn't throw an exception since we granted the create table permission
            final String table = testName.getMethodName() + "_user_table";
            conn.tableOperations().create(table);
            // Make sure we can actually use the table we made
            BatchWriter bw = conn.createBatchWriter(table, new BatchWriterConfig());
            Mutation m = new Mutation("a");
            m.put("b", "c", "d");
            bw.addMutation(m);
            bw.close();
            conn.tableOperations().compact(table, new CompactionConfig().setWait(true).setFlush(true));
            return null;
        }
    });
}