Examples with NamespaceDescriptor org.apache.hadoop.hbase.NamespaceDescriptor used on opensource projects

Example 36 with NamespaceDescriptor

use of org.apache.hadoop.hbase.NamespaceDescriptor in project hbase by apache.

the class TestModifyNamespaceProcedure method testModifyNonExistNamespace.

@Test
public void testModifyNonExistNamespace() throws Exception {
    final String namespaceName = "testModifyNonExistNamespace";
    final ProcedureExecutor<MasterProcedureEnv> procExec = getMasterProcedureExecutor();
    try {
        NamespaceDescriptor nsDescriptor = UTIL.getAdmin().getNamespaceDescriptor(namespaceName);
        assertNull(nsDescriptor);
    } catch (NamespaceNotFoundException nsnfe) {
        // Expected
        LOG.debug("The namespace " + namespaceName + " does not exist.  This is expected.");
    }
    final NamespaceDescriptor nsd = NamespaceDescriptor.create(namespaceName).build();
    long procId = procExec.submitProcedure(new ModifyNamespaceProcedure(procExec.getEnvironment(), nsd));
    // Wait the completion
    ProcedureTestingUtility.waitProcedure(procExec, procId);
    // Expect fail with NamespaceNotFoundException
    Procedure<?> result = procExec.getResult(procId);
    assertTrue(result.isFailed());
    LOG.debug("modify namespace failed with exception: " + result.getException());
    assertTrue(ProcedureTestingUtility.getExceptionCause(result) instanceof NamespaceNotFoundException);
}

Example 37 with NamespaceDescriptor

use of org.apache.hadoop.hbase.NamespaceDescriptor in project hbase by apache.

the class TestAccessController method testAccessControllerUserPermsRegexHandling.

@Test
public void testAccessControllerUserPermsRegexHandling() throws Exception {
    User testRegexHandler = User.createUserForTesting(conf, "testRegexHandling", new String[0]);
    final String REGEX_ALL_TABLES = ".*";
    final String tableName = name.getMethodName();
    final TableName table1 = TableName.valueOf(tableName);
    final byte[] family = Bytes.toBytes("f1");
    // create table in default ns
    TableDescriptor tableDescriptor = TableDescriptorBuilder.newBuilder(table1).setColumnFamily(ColumnFamilyDescriptorBuilder.of(family)).build();
    createTable(TEST_UTIL, tableDescriptor);
    // creating the ns and table in it
    String ns = "testNamespace";
    NamespaceDescriptor desc = NamespaceDescriptor.create(ns).build();
    final TableName table2 = TableName.valueOf(ns, tableName);
    createNamespace(TEST_UTIL, desc);
    tableDescriptor = TableDescriptorBuilder.newBuilder(table2).setColumnFamily(ColumnFamilyDescriptorBuilder.of(family)).build();
    createTable(TEST_UTIL, tableDescriptor);
    // Verify that we can read sys-tables
    String aclTableName = PermissionStorage.ACL_TABLE_NAME.getNameAsString();
    assertEquals(6, SUPERUSER.runAs(getPrivilegedAction(aclTableName)).size());
    assertEquals(0, testRegexHandler.runAs(getPrivilegedAction(aclTableName)).size());
    // Grant TABLE ADMIN privs to testUserPerms
    assertEquals(0, testRegexHandler.runAs(getPrivilegedAction(REGEX_ALL_TABLES)).size());
    grantOnTable(TEST_UTIL, testRegexHandler.getShortName(), table1, null, null, Action.ADMIN);
    assertEquals(2, testRegexHandler.runAs(getPrivilegedAction(REGEX_ALL_TABLES)).size());
    grantOnTable(TEST_UTIL, testRegexHandler.getShortName(), table2, null, null, Action.ADMIN);
    assertEquals(4, testRegexHandler.runAs(getPrivilegedAction(REGEX_ALL_TABLES)).size());
    // USER_ADMIN, testUserPerms must have a row each.
    assertEquals(2, testRegexHandler.runAs(getPrivilegedAction(tableName)).size());
    assertEquals(2, testRegexHandler.runAs(getPrivilegedAction(NamespaceDescriptor.DEFAULT_NAMESPACE_NAME_STR + TableName.NAMESPACE_DELIM + tableName)).size());
    assertEquals(2, testRegexHandler.runAs(getPrivilegedAction(ns + TableName.NAMESPACE_DELIM + tableName)).size());
    assertEquals(0, testRegexHandler.runAs(getPrivilegedAction("notMatchingAny")).size());
    deleteTable(TEST_UTIL, table1);
    deleteTable(TEST_UTIL, table2);
    deleteNamespace(TEST_UTIL, ns);
}

Example 38 with NamespaceDescriptor

use of org.apache.hadoop.hbase.NamespaceDescriptor in project hbase by apache.

the class TestAccessController method testGetUserPermissions.

@Test
public void testGetUserPermissions() throws Throwable {
    Connection conn = null;
    try {
        conn = ConnectionFactory.createConnection(conf);
        User nSUser1 = User.createUserForTesting(conf, "nsuser1", new String[0]);
        User nSUser2 = User.createUserForTesting(conf, "nsuser2", new String[0]);
        User nSUser3 = User.createUserForTesting(conf, "nsuser3", new String[0]);
        // Global access groups
        User globalGroupUser1 = User.createUserForTesting(conf, "globalGroupUser1", new String[] { "group_admin" });
        User globalGroupUser2 = User.createUserForTesting(conf, "globalGroupUser2", new String[] { "group_admin", "group_create" });
        // Namespace access groups
        User nsGroupUser1 = User.createUserForTesting(conf, "nsGroupUser1", new String[] { "ns_group1" });
        User nsGroupUser2 = User.createUserForTesting(conf, "nsGroupUser2", new String[] { "ns_group2" });
        // table Access groups
        User tableGroupUser1 = User.createUserForTesting(conf, "tableGroupUser1", new String[] { "table_group1" });
        User tableGroupUser2 = User.createUserForTesting(conf, "tableGroupUser2", new String[] { "table_group2" });
        // Create namespaces
        String nsPrefix = "testNS";
        final String namespace1 = nsPrefix + "1";
        NamespaceDescriptor desc1 = NamespaceDescriptor.create(namespace1).build();
        createNamespace(TEST_UTIL, desc1);
        String namespace2 = nsPrefix + "2";
        NamespaceDescriptor desc2 = NamespaceDescriptor.create(namespace2).build();
        createNamespace(TEST_UTIL, desc2);
        // Grant namespace permission
        grantOnNamespace(TEST_UTIL, nSUser1.getShortName(), namespace1, Permission.Action.ADMIN);
        grantOnNamespace(TEST_UTIL, nSUser3.getShortName(), namespace1, Permission.Action.READ);
        grantOnNamespace(TEST_UTIL, toGroupEntry("ns_group1"), namespace1, Permission.Action.ADMIN);
        grantOnNamespace(TEST_UTIL, nSUser2.getShortName(), namespace2, Permission.Action.ADMIN);
        grantOnNamespace(TEST_UTIL, nSUser3.getShortName(), namespace2, Permission.Action.ADMIN);
        grantOnNamespace(TEST_UTIL, toGroupEntry("ns_group2"), namespace2, Permission.Action.READ, Permission.Action.WRITE);
        // Create tables
        TableName table1 = TableName.valueOf(namespace1 + TableName.NAMESPACE_DELIM + "t1");
        TableName table2 = TableName.valueOf(namespace2 + TableName.NAMESPACE_DELIM + "t2");
        byte[] TEST_FAMILY2 = Bytes.toBytes("f2");
        byte[] TEST_QUALIFIER2 = Bytes.toBytes("q2");
        createTestTable(table1, TEST_FAMILY);
        createTestTable(table2, TEST_FAMILY2);
        // Grant table permissions
        grantOnTable(TEST_UTIL, toGroupEntry("table_group1"), table1, null, null, Permission.Action.ADMIN);
        grantOnTable(TEST_UTIL, USER_ADMIN.getShortName(), table1, null, null, Permission.Action.ADMIN);
        grantOnTable(TEST_UTIL, USER_ADMIN_CF.getShortName(), table1, TEST_FAMILY, null, Permission.Action.ADMIN);
        grantOnTable(TEST_UTIL, USER_RW.getShortName(), table1, TEST_FAMILY, TEST_QUALIFIER, Permission.Action.READ);
        grantOnTable(TEST_UTIL, USER_RW.getShortName(), table1, TEST_FAMILY, TEST_QUALIFIER2, Permission.Action.WRITE);
        grantOnTable(TEST_UTIL, toGroupEntry("table_group2"), table2, null, null, Permission.Action.ADMIN);
        grantOnTable(TEST_UTIL, USER_ADMIN.getShortName(), table2, null, null, Permission.Action.ADMIN);
        grantOnTable(TEST_UTIL, USER_ADMIN_CF.getShortName(), table2, TEST_FAMILY2, null, Permission.Action.ADMIN);
        grantOnTable(TEST_UTIL, USER_RW.getShortName(), table2, TEST_FAMILY2, TEST_QUALIFIER, Permission.Action.READ);
        grantOnTable(TEST_UTIL, USER_RW.getShortName(), table2, TEST_FAMILY2, TEST_QUALIFIER2, Permission.Action.WRITE);
        List<UserPermission> userPermissions = null;
        Collection<String> superUsers = Superusers.getSuperUsers();
        int superUserCount = superUsers.size();
        // Global User ACL
        validateGlobalUserACLForGetUserPermissions(conn, nSUser1, globalGroupUser1, globalGroupUser2, superUsers, superUserCount);
        // Namespace ACL
        validateNamespaceUserACLForGetUserPermissions(conn, nSUser1, nSUser3, nsGroupUser1, nsGroupUser2, nsPrefix, namespace1, namespace2);
        // Table + Users
        validateTableACLForGetUserPermissions(conn, nSUser1, tableGroupUser1, tableGroupUser2, nsPrefix, table1, table2, TEST_QUALIFIER2, superUsers);
        try {
            // test case with table name as null
            assertEquals(3, AccessControlClient.getUserPermissions(conn, null, TEST_FAMILY).size());
            fail("this should have thrown IllegalArgumentException");
        } catch (IllegalArgumentException ex) {
        // expected
        }
        try {
            // test case with table name as emplty
            assertEquals(3, AccessControlClient.getUserPermissions(conn, HConstants.EMPTY_STRING, TEST_FAMILY).size());
            fail("this should have thrown IllegalArgumentException");
        } catch (IllegalArgumentException ex) {
        // expected
        }
        try {
            // test case with table name as namespace name
            assertEquals(3, AccessControlClient.getUserPermissions(conn, "@" + namespace2, TEST_FAMILY).size());
            fail("this should have thrown IllegalArgumentException");
        } catch (IllegalArgumentException ex) {
        // expected
        }
        // Clean the table and namespace
        deleteTable(TEST_UTIL, table1);
        deleteTable(TEST_UTIL, table2);
        deleteNamespace(TEST_UTIL, namespace1);
        deleteNamespace(TEST_UTIL, namespace2);
    } finally {
        if (conn != null) {
            conn.close();
        }
    }
}

Example 39 with NamespaceDescriptor

use of org.apache.hadoop.hbase.NamespaceDescriptor in project hbase by apache.

the class TestAccessController method testGetNamespacePermission.

@Test
public void testGetNamespacePermission() throws Exception {
    String namespace = "testGetNamespacePermission";
    NamespaceDescriptor desc = NamespaceDescriptor.create(namespace).build();
    createNamespace(TEST_UTIL, desc);
    grantOnNamespace(TEST_UTIL, USER_NONE.getShortName(), namespace, Permission.Action.READ);
    // Test 1: A specific namespace
    getNamespacePermissionsAndVerify(namespace, 1, namespace);
    // Test 2: '@.*'
    getNamespacePermissionsAndVerify(".*", 1, namespace);
    // Test 3: A more complex regex
    getNamespacePermissionsAndVerify("^test[a-zA-Z]*", 1, namespace);
    deleteNamespace(TEST_UTIL, namespace);
}

Example 40 with NamespaceDescriptor

use of org.apache.hadoop.hbase.NamespaceDescriptor in project hbase by apache.

the class TestAccessController2 method testACLZNodeDeletion.

@Test
public void testACLZNodeDeletion() throws Exception {
    String baseAclZNode = "/hbase/acl/";
    String ns = "testACLZNodeDeletionNamespace";
    NamespaceDescriptor desc = NamespaceDescriptor.create(ns).build();
    createNamespace(TEST_UTIL, desc);
    final TableName table = TableName.valueOf(ns, "testACLZNodeDeletionTable");
    final byte[] family = Bytes.toBytes("f1");
    TableDescriptor tableDescriptor = TableDescriptorBuilder.newBuilder(table).setColumnFamily(ColumnFamilyDescriptorBuilder.of(family)).build();
    createTable(TEST_UTIL, tableDescriptor);
    // Namespace needs this, as they follow the lazy creation of ACL znode.
    grantOnNamespace(TEST_UTIL, TESTGROUP1_USER1.getShortName(), ns, Action.ADMIN);
    ZKWatcher zkw = TEST_UTIL.getMiniHBaseCluster().getMaster().getZooKeeper();
    assertTrue("The acl znode for table should exist", ZKUtil.checkExists(zkw, baseAclZNode + table.getNameAsString()) != -1);
    assertTrue("The acl znode for namespace should exist", ZKUtil.checkExists(zkw, baseAclZNode + convertToNamespace(ns)) != -1);
    revokeFromNamespace(TEST_UTIL, TESTGROUP1_USER1.getShortName(), ns, Action.ADMIN);
    deleteTable(TEST_UTIL, table);
    deleteNamespace(TEST_UTIL, ns);
    assertTrue("The acl znode for table should have been deleted", ZKUtil.checkExists(zkw, baseAclZNode + table.getNameAsString()) == -1);
    assertTrue("The acl znode for namespace should have been deleted", ZKUtil.checkExists(zkw, baseAclZNode + convertToNamespace(ns)) == -1);
}