Examples with IZooReaderWriter org.apache.accumulo.fate.zookeeper.IZooReaderWriter used on opensource projects

Example 21 with IZooReaderWriter

use of org.apache.accumulo.fate.zookeeper.IZooReaderWriter in project accumulo by apache.

the class ZKAuthenticator method initializeSecurity.

@Override
public void initializeSecurity(TCredentials credentials, String principal, byte[] token) throws AccumuloSecurityException {
    try {
        // remove old settings from zookeeper first, if any
        IZooReaderWriter zoo = ZooReaderWriter.getInstance();
        synchronized (zooCache) {
            zooCache.clear();
            if (zoo.exists(ZKUserPath)) {
                zoo.recursiveDelete(ZKUserPath, NodeMissingPolicy.SKIP);
                log.info("Removed {}/ from zookeeper", ZKUserPath);
            }
            // prep parent node of users with root username
            zoo.putPersistentData(ZKUserPath, principal.getBytes(UTF_8), NodeExistsPolicy.FAIL);
            constructUser(principal, ZKSecurityTool.createPass(token));
        }
    } catch (KeeperException | AccumuloException | InterruptedException e) {
        log.error("{}", e.getMessage(), e);
        throw new RuntimeException(e);
    }
}

Example 22 with IZooReaderWriter

use of org.apache.accumulo.fate.zookeeper.IZooReaderWriter in project accumulo by apache.

the class ZKAuthorizor method initializeSecurity.

@Override
public void initializeSecurity(TCredentials itw, String rootuser) throws AccumuloSecurityException {
    IZooReaderWriter zoo = ZooReaderWriter.getInstance();
    // create the root user with all system privileges, no table privileges, and no record-level authorizations
    Set<SystemPermission> rootPerms = new TreeSet<>();
    for (SystemPermission p : SystemPermission.values()) rootPerms.add(p);
    Map<Table.ID, Set<TablePermission>> tablePerms = new HashMap<>();
    // Allow the root user to flush the metadata tables
    tablePerms.put(MetadataTable.ID, Collections.singleton(TablePermission.ALTER_TABLE));
    tablePerms.put(RootTable.ID, Collections.singleton(TablePermission.ALTER_TABLE));
    try {
        // prep parent node of users with root username
        if (!zoo.exists(ZKUserPath))
            zoo.putPersistentData(ZKUserPath, rootuser.getBytes(UTF_8), NodeExistsPolicy.FAIL);
        initUser(rootuser);
        zoo.putPersistentData(ZKUserPath + "/" + rootuser + ZKUserAuths, ZKSecurityTool.convertAuthorizations(Authorizations.EMPTY), NodeExistsPolicy.FAIL);
    } catch (KeeperException | InterruptedException e) {
        log.error("{}", e.getMessage(), e);
        throw new RuntimeException(e);
    }
}

Example 23 with IZooReaderWriter

use of org.apache.accumulo.fate.zookeeper.IZooReaderWriter in project accumulo by apache.

the class ZKPermHandler method revokeNamespacePermission.

@Override
public void revokeNamespacePermission(String user, Namespace.ID namespace, NamespacePermission permission) throws AccumuloSecurityException {
    byte[] serializedPerms = zooCache.get(ZKUserPath + "/" + user + ZKUserNamespacePerms + "/" + namespace);
    // User had no namespace permission, nothing to revoke.
    if (serializedPerms == null)
        return;
    Set<NamespacePermission> namespacePerms = ZKSecurityTool.convertNamespacePermissions(serializedPerms);
    try {
        if (namespacePerms.remove(permission)) {
            zooCache.clear();
            IZooReaderWriter zoo = ZooReaderWriter.getInstance();
            if (namespacePerms.size() == 0)
                zoo.recursiveDelete(ZKUserPath + "/" + user + ZKUserNamespacePerms + "/" + namespace, NodeMissingPolicy.SKIP);
            else
                zoo.putPersistentData(ZKUserPath + "/" + user + ZKUserNamespacePerms + "/" + namespace, ZKSecurityTool.convertNamespacePermissions(namespacePerms), NodeExistsPolicy.OVERWRITE);
        }
    } catch (KeeperException e) {
        log.error("{}", e.getMessage(), e);
        throw new AccumuloSecurityException(user, SecurityErrorCode.CONNECTION_ERROR, e);
    } catch (InterruptedException e) {
        log.error("{}", e.getMessage(), e);
        throw new RuntimeException(e);
    }
}

Example 24 with IZooReaderWriter

use of org.apache.accumulo.fate.zookeeper.IZooReaderWriter in project accumulo by apache.

the class ZKPermHandler method initializeSecurity.

@Override
public void initializeSecurity(TCredentials itw, String rootuser) throws AccumuloSecurityException {
    IZooReaderWriter zoo = ZooReaderWriter.getInstance();
    // create the root user with all system privileges, no table privileges, and no record-level authorizations
    Set<SystemPermission> rootPerms = new TreeSet<>();
    for (SystemPermission p : SystemPermission.values()) rootPerms.add(p);
    Map<Table.ID, Set<TablePermission>> tablePerms = new HashMap<>();
    // Allow the root user to flush the system tables
    tablePerms.put(RootTable.ID, Collections.singleton(TablePermission.ALTER_TABLE));
    tablePerms.put(MetadataTable.ID, Collections.singleton(TablePermission.ALTER_TABLE));
    // essentially the same but on the system namespace, the ALTER_TABLE permission is now redundant
    Map<Namespace.ID, Set<NamespacePermission>> namespacePerms = new HashMap<>();
    namespacePerms.put(Namespace.ID.ACCUMULO, Collections.singleton(NamespacePermission.ALTER_NAMESPACE));
    namespacePerms.put(Namespace.ID.ACCUMULO, Collections.singleton(NamespacePermission.ALTER_TABLE));
    try {
        // prep parent node of users with root username
        if (!zoo.exists(ZKUserPath))
            zoo.putPersistentData(ZKUserPath, rootuser.getBytes(UTF_8), NodeExistsPolicy.FAIL);
        initUser(rootuser);
        zoo.putPersistentData(ZKUserPath + "/" + rootuser + ZKUserSysPerms, ZKSecurityTool.convertSystemPermissions(rootPerms), NodeExistsPolicy.FAIL);
        for (Entry<Table.ID, Set<TablePermission>> entry : tablePerms.entrySet()) createTablePerm(rootuser, entry.getKey(), entry.getValue());
        for (Entry<Namespace.ID, Set<NamespacePermission>> entry : namespacePerms.entrySet()) createNamespacePerm(rootuser, entry.getKey(), entry.getValue());
    } catch (KeeperException | InterruptedException e) {
        log.error("{}", e.getMessage(), e);
        throw new RuntimeException(e);
    }
}

Example 25 with IZooReaderWriter

use of org.apache.accumulo.fate.zookeeper.IZooReaderWriter in project accumulo by apache.

the class ZKPermHandler method cleanUser.

@Override
public void cleanUser(String user) throws AccumuloSecurityException {
    try {
        synchronized (zooCache) {
            IZooReaderWriter zoo = ZooReaderWriter.getInstance();
            zoo.recursiveDelete(ZKUserPath + "/" + user + ZKUserSysPerms, NodeMissingPolicy.SKIP);
            zoo.recursiveDelete(ZKUserPath + "/" + user + ZKUserTablePerms, NodeMissingPolicy.SKIP);
            zoo.recursiveDelete(ZKUserPath + "/" + user + ZKUserNamespacePerms, NodeMissingPolicy.SKIP);
            zooCache.clear(ZKUserPath + "/" + user);
        }
    } catch (InterruptedException e) {
        log.error("{}", e.getMessage(), e);
        throw new RuntimeException(e);
    } catch (KeeperException e) {
        log.error("{}", e.getMessage(), e);
        if (e.code().equals(KeeperException.Code.NONODE))
            throw new AccumuloSecurityException(user, SecurityErrorCode.USER_DOESNT_EXIST, e);
        throw new AccumuloSecurityException(user, SecurityErrorCode.CONNECTION_ERROR, e);
    }
}