Examples with GetAuthsResponse org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.GetAuthsResponse used on opensource projects

Example 1 with GetAuthsResponse

use of org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.GetAuthsResponse in project hbase by apache.

the class TestWithDisabledAuthorization method testManageUserAuths.

@Test(timeout = 180000)
public void testManageUserAuths() throws Throwable {
    // Even though authorization is disabled, we should be able to manage user auths
    SUPERUSER.runAs(new PrivilegedExceptionAction<Void>() {

        public Void run() throws Exception {
            try (Connection conn = ConnectionFactory.createConnection(conf)) {
                VisibilityClient.setAuths(conn, new String[] { SECRET, CONFIDENTIAL }, USER_RW.getShortName());
            } catch (Throwable t) {
                fail("Should not have failed");
            }
            return null;
        }
    });
    PrivilegedExceptionAction<List<String>> getAuths = new PrivilegedExceptionAction<List<String>>() {

        public List<String> run() throws Exception {
            GetAuthsResponse authsResponse = null;
            try (Connection conn = ConnectionFactory.createConnection(conf)) {
                authsResponse = VisibilityClient.getAuths(conn, USER_RW.getShortName());
            } catch (Throwable t) {
                fail("Should not have failed");
            }
            List<String> authsList = new ArrayList<>(authsResponse.getAuthList().size());
            for (ByteString authBS : authsResponse.getAuthList()) {
                authsList.add(Bytes.toString(authBS.toByteArray()));
            }
            return authsList;
        }
    };
    List<String> authsList = SUPERUSER.runAs(getAuths);
    assertEquals(2, authsList.size());
    assertTrue(authsList.contains(SECRET));
    assertTrue(authsList.contains(CONFIDENTIAL));
    SUPERUSER.runAs(new PrivilegedExceptionAction<Void>() {

        public Void run() throws Exception {
            try (Connection conn = ConnectionFactory.createConnection(conf)) {
                VisibilityClient.clearAuths(conn, new String[] { SECRET }, USER_RW.getShortName());
            } catch (Throwable t) {
                fail("Should not have failed");
            }
            return null;
        }
    });
    authsList = SUPERUSER.runAs(getAuths);
    assertEquals(1, authsList.size());
    assertTrue(authsList.contains(CONFIDENTIAL));
    SUPERUSER.runAs(new PrivilegedExceptionAction<Void>() {

        public Void run() throws Exception {
            try (Connection conn = ConnectionFactory.createConnection(conf)) {
                VisibilityClient.clearAuths(conn, new String[] { CONFIDENTIAL }, USER_RW.getShortName());
            } catch (Throwable t) {
                fail("Should not have failed");
            }
            return null;
        }
    });
    authsList = SUPERUSER.runAs(getAuths);
    assertEquals(0, authsList.size());
}

Example 2 with GetAuthsResponse

use of org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.GetAuthsResponse in project hbase by apache.

the class TestVisibilityLabels method testClearUserAuths.

@Test
public void testClearUserAuths() throws Throwable {
    PrivilegedExceptionAction<Void> action = new PrivilegedExceptionAction<Void>() {

        public Void run() throws Exception {
            String[] auths = { SECRET, CONFIDENTIAL, PRIVATE };
            String user = "testUser";
            try (Connection conn = ConnectionFactory.createConnection(conf)) {
                VisibilityClient.setAuths(conn, auths, user);
            } catch (Throwable e) {
                fail("Should not have failed");
            }
            // Removing the auths for SECRET and CONFIDENTIAL for the user.
            // Passing a non existing auth also.
            auths = new String[] { SECRET, PUBLIC, CONFIDENTIAL };
            VisibilityLabelsResponse response = null;
            try (Connection conn = ConnectionFactory.createConnection(conf)) {
                response = VisibilityClient.clearAuths(conn, auths, user);
            } catch (Throwable e) {
                fail("Should not have failed");
            }
            List<RegionActionResult> resultList = response.getResultList();
            assertEquals(3, resultList.size());
            assertTrue(resultList.get(0).getException().getValue().isEmpty());
            assertEquals("org.apache.hadoop.hbase.DoNotRetryIOException", resultList.get(1).getException().getName());
            assertTrue(Bytes.toString(resultList.get(1).getException().getValue().toByteArray()).contains("org.apache.hadoop.hbase.security.visibility.InvalidLabelException: " + "Label 'public' is not set for the user testUser"));
            assertTrue(resultList.get(2).getException().getValue().isEmpty());
            try (Connection connection = ConnectionFactory.createConnection(conf);
                Table ht = connection.getTable(LABELS_TABLE_NAME)) {
                ResultScanner scanner = ht.getScanner(new Scan());
                Result result = null;
                List<Result> results = new ArrayList<>();
                while ((result = scanner.next()) != null) {
                    results.add(result);
                }
                List<String> curAuths = extractAuths(user, results);
                assertTrue(curAuths.contains(PRIVATE));
                assertEquals(1, curAuths.size());
            }
            GetAuthsResponse authsResponse = null;
            try (Connection conn = ConnectionFactory.createConnection(conf)) {
                authsResponse = VisibilityClient.getAuths(conn, user);
            } catch (Throwable e) {
                fail("Should not have failed");
            }
            List<String> authsList = new ArrayList<>(authsResponse.getAuthList().size());
            for (ByteString authBS : authsResponse.getAuthList()) {
                authsList.add(Bytes.toString(authBS.toByteArray()));
            }
            assertEquals(1, authsList.size());
            assertTrue(authsList.contains(PRIVATE));
            return null;
        }
    };
    SUPERUSER.runAs(action);
}

Example 3 with GetAuthsResponse

use of org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.GetAuthsResponse in project hbase by apache.

the class VisibilityController method getAuths.

@Override
public synchronized void getAuths(RpcController controller, GetAuthsRequest request, RpcCallback<GetAuthsResponse> done) {
    GetAuthsResponse.Builder response = GetAuthsResponse.newBuilder();
    if (!initialized) {
        controller.setFailed("VisibilityController not yet initialized");
    } else {
        byte[] user = request.getUser().toByteArray();
        List<String> labels = null;
        try {
            // AccessController CP methods.
            if (authorizationEnabled && accessControllerAvailable && !isSystemOrSuperUser()) {
                User requestingUser = VisibilityUtils.getActiveUser();
                throw new AccessDeniedException("User '" + (requestingUser != null ? requestingUser.getShortName() : "null") + "' is not authorized to perform this action.");
            }
            if (AuthUtil.isGroupPrincipal(Bytes.toString(user))) {
                String group = AuthUtil.getGroupName(Bytes.toString(user));
                labels = this.visibilityLabelService.getGroupAuths(new String[] { group }, false);
            } else {
                labels = this.visibilityLabelService.getUserAuths(user, false);
            }
            logResult(true, "getAuths", "Get authorizations for user allowed", user, null, null);
        } catch (AccessDeniedException e) {
            logResult(false, "getAuths", e.getMessage(), user, null, null);
            CoprocessorRpcUtils.setControllerException(controller, e);
        } catch (IOException e) {
            CoprocessorRpcUtils.setControllerException(controller, e);
        }
        response.setUser(request.getUser());
        if (labels != null) {
            for (String label : labels) {
                response.addAuth(ByteStringer.wrap(Bytes.toBytes(label)));
            }
        }
    }
    done.run(response.build());
}

Example 4 with GetAuthsResponse

use of org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.GetAuthsResponse in project hbase by apache.

the class TestVisibilityLablesWithGroups method testGroupAuths.

@Test
public void testGroupAuths() throws Exception {
    final TableName tableName = TableName.valueOf(TEST_NAME.getMethodName());
    // create the table
    TEST_UTIL.createTable(tableName, CF);
    // put the data.
    SUPERUSER.runAs(new PrivilegedExceptionAction<Void>() {

        public Void run() throws Exception {
            try (Connection connection = ConnectionFactory.createConnection(conf);
                Table table = connection.getTable(tableName)) {
                Put put = new Put(ROW_1);
                put.addColumn(CF, Q1, HConstants.LATEST_TIMESTAMP, value1);
                put.setCellVisibility(new CellVisibility(SECRET));
                table.put(put);
                put = new Put(ROW_1);
                put.addColumn(CF, Q2, HConstants.LATEST_TIMESTAMP, value2);
                put.setCellVisibility(new CellVisibility(CONFIDENTIAL));
                table.put(put);
                put = new Put(ROW_1);
                put.addColumn(CF, Q3, HConstants.LATEST_TIMESTAMP, value3);
                table.put(put);
            }
            return null;
        }
    });
    // 'admin' user is part of 'supergroup', thus can see all the cells.
    SUPERUSER.runAs(new PrivilegedExceptionAction<Void>() {

        public Void run() throws Exception {
            try (Connection connection = ConnectionFactory.createConnection(conf);
                Table table = connection.getTable(tableName)) {
                Scan s = new Scan();
                ResultScanner scanner = table.getScanner(s);
                Result[] next = scanner.next(1);
                // Test that super user can see all the cells.
                assertTrue(next.length == 1);
                CellScanner cellScanner = next[0].cellScanner();
                cellScanner.advance();
                Cell current = cellScanner.current();
                assertTrue(Bytes.equals(current.getRowArray(), current.getRowOffset(), current.getRowLength(), ROW_1, 0, ROW_1.length));
                assertTrue(Bytes.equals(current.getQualifierArray(), current.getQualifierOffset(), current.getQualifierLength(), Q1, 0, Q1.length));
                assertTrue(Bytes.equals(current.getValueArray(), current.getValueOffset(), current.getValueLength(), value1, 0, value1.length));
                cellScanner.advance();
                current = cellScanner.current();
                assertTrue(Bytes.equals(current.getRowArray(), current.getRowOffset(), current.getRowLength(), ROW_1, 0, ROW_1.length));
                assertTrue(Bytes.equals(current.getQualifierArray(), current.getQualifierOffset(), current.getQualifierLength(), Q2, 0, Q2.length));
                assertTrue(Bytes.equals(current.getValueArray(), current.getValueOffset(), current.getValueLength(), value2, 0, value2.length));
                cellScanner.advance();
                current = cellScanner.current();
                assertTrue(Bytes.equals(current.getRowArray(), current.getRowOffset(), current.getRowLength(), ROW_1, 0, ROW_1.length));
                assertTrue(Bytes.equals(current.getQualifierArray(), current.getQualifierOffset(), current.getQualifierLength(), Q3, 0, Q3.length));
                assertTrue(Bytes.equals(current.getValueArray(), current.getValueOffset(), current.getValueLength(), value3, 0, value3.length));
            }
            return null;
        }
    });
    // Get testgroup's labels.
    SUPERUSER.runAs(new PrivilegedExceptionAction<Void>() {

        public Void run() throws Exception {
            GetAuthsResponse authsResponse = null;
            try (Connection conn = ConnectionFactory.createConnection(conf)) {
                authsResponse = VisibilityClient.getAuths(conn, "@testgroup");
            } catch (Throwable e) {
                fail("Should not have failed");
            }
            List<String> authsList = new ArrayList<>(authsResponse.getAuthList().size());
            for (ByteString authBS : authsResponse.getAuthList()) {
                authsList.add(Bytes.toString(authBS.toByteArray()));
            }
            assertEquals(1, authsList.size());
            assertTrue(authsList.contains(CONFIDENTIAL));
            return null;
        }
    });
    // Test that test user can see what 'testgroup' has been authorized to.
    TESTUSER.runAs(new PrivilegedExceptionAction<Void>() {

        public Void run() throws Exception {
            try (Connection connection = ConnectionFactory.createConnection(conf);
                Table table = connection.getTable(tableName)) {
                // Test scan with no auth attribute
                Scan s = new Scan();
                ResultScanner scanner = table.getScanner(s);
                Result[] next = scanner.next(1);
                assertTrue(next.length == 1);
                CellScanner cellScanner = next[0].cellScanner();
                cellScanner.advance();
                Cell current = cellScanner.current();
                // test user can see value2 (CONFIDENTIAL) and value3 (no label)
                assertTrue(Bytes.equals(current.getRowArray(), current.getRowOffset(), current.getRowLength(), ROW_1, 0, ROW_1.length));
                assertTrue(Bytes.equals(current.getQualifierArray(), current.getQualifierOffset(), current.getQualifierLength(), Q2, 0, Q2.length));
                assertTrue(Bytes.equals(current.getValueArray(), current.getValueOffset(), current.getValueLength(), value2, 0, value2.length));
                cellScanner.advance();
                current = cellScanner.current();
                // test user can see value2 (CONFIDENTIAL) and value3 (no label)
                assertTrue(Bytes.equals(current.getRowArray(), current.getRowOffset(), current.getRowLength(), ROW_1, 0, ROW_1.length));
                assertTrue(Bytes.equals(current.getQualifierArray(), current.getQualifierOffset(), current.getQualifierLength(), Q3, 0, Q3.length));
                assertTrue(Bytes.equals(current.getValueArray(), current.getValueOffset(), current.getValueLength(), value3, 0, value3.length));
                // Test scan with correct auth attribute for test user
                Scan s1 = new Scan();
                // test user is entitled to 'CONFIDENTIAL'.
                // If we set both labels in the scan, 'SECRET' will be dropped by the SLGs.
                s1.setAuthorizations(new Authorizations(new String[] { SECRET, CONFIDENTIAL }));
                ResultScanner scanner1 = table.getScanner(s1);
                Result[] next1 = scanner1.next(1);
                assertTrue(next1.length == 1);
                CellScanner cellScanner1 = next1[0].cellScanner();
                cellScanner1.advance();
                Cell current1 = cellScanner1.current();
                // test user can see value2 (CONFIDENTIAL) and value3 (no label)
                assertTrue(Bytes.equals(current1.getRowArray(), current1.getRowOffset(), current1.getRowLength(), ROW_1, 0, ROW_1.length));
                assertTrue(Bytes.equals(current1.getQualifierArray(), current1.getQualifierOffset(), current1.getQualifierLength(), Q2, 0, Q2.length));
                assertTrue(Bytes.equals(current1.getValueArray(), current1.getValueOffset(), current1.getValueLength(), value2, 0, value2.length));
                cellScanner1.advance();
                current1 = cellScanner1.current();
                // test user can see value2 (CONFIDENTIAL) and value3 (no label)
                assertTrue(Bytes.equals(current1.getRowArray(), current1.getRowOffset(), current1.getRowLength(), ROW_1, 0, ROW_1.length));
                assertTrue(Bytes.equals(current1.getQualifierArray(), current1.getQualifierOffset(), current1.getQualifierLength(), Q3, 0, Q3.length));
                assertTrue(Bytes.equals(current1.getValueArray(), current1.getValueOffset(), current1.getValueLength(), value3, 0, value3.length));
                // Test scan with incorrect auth attribute for test user
                Scan s2 = new Scan();
                // test user is entitled to 'CONFIDENTIAL'.
                // If we set 'SECRET', it will be dropped by the SLGs.
                s2.setAuthorizations(new Authorizations(new String[] { SECRET }));
                ResultScanner scanner2 = table.getScanner(s2);
                Result next2 = scanner2.next();
                CellScanner cellScanner2 = next2.cellScanner();
                cellScanner2.advance();
                Cell current2 = cellScanner2.current();
                // This scan will only see value3 (no label)
                assertTrue(Bytes.equals(current2.getRowArray(), current2.getRowOffset(), current2.getRowLength(), ROW_1, 0, ROW_1.length));
                assertTrue(Bytes.equals(current2.getQualifierArray(), current2.getQualifierOffset(), current2.getQualifierLength(), Q3, 0, Q3.length));
                assertTrue(Bytes.equals(current2.getValueArray(), current2.getValueOffset(), current2.getValueLength(), value3, 0, value3.length));
                assertFalse(cellScanner2.advance());
            }
            return null;
        }
    });
    // Clear 'testgroup' of CONFIDENTIAL label.
    SUPERUSER.runAs(new PrivilegedExceptionAction<Void>() {

        public Void run() throws Exception {
            VisibilityLabelsResponse response = null;
            try (Connection conn = ConnectionFactory.createConnection(conf)) {
                response = VisibilityClient.clearAuths(conn, new String[] { CONFIDENTIAL }, "@testgroup");
            } catch (Throwable e) {
                fail("Should not have failed");
            }
            return null;
        }
    });
    // Get testgroup's labels.  No label is returned.
    SUPERUSER.runAs(new PrivilegedExceptionAction<Void>() {

        public Void run() throws Exception {
            GetAuthsResponse authsResponse = null;
            try (Connection conn = ConnectionFactory.createConnection(conf)) {
                authsResponse = VisibilityClient.getAuths(conn, "@testgroup");
            } catch (Throwable e) {
                fail("Should not have failed");
            }
            List<String> authsList = new ArrayList<>(authsResponse.getAuthList().size());
            for (ByteString authBS : authsResponse.getAuthList()) {
                authsList.add(Bytes.toString(authBS.toByteArray()));
            }
            assertEquals(0, authsList.size());
            return null;
        }
    });
    // Test that test user cannot see the cells with the labels anymore.
    TESTUSER.runAs(new PrivilegedExceptionAction<Void>() {

        public Void run() throws Exception {
            try (Connection connection = ConnectionFactory.createConnection(conf);
                Table table = connection.getTable(tableName)) {
                Scan s1 = new Scan();
                // test user is not entitled to 'CONFIDENTIAL' anymore since we dropped
                // testgroup's label.  test user has no auth labels now.
                // scan's labels will be dropped on the server side.
                s1.setAuthorizations(new Authorizations(new String[] { SECRET, CONFIDENTIAL }));
                ResultScanner scanner1 = table.getScanner(s1);
                Result[] next1 = scanner1.next(1);
                assertTrue(next1.length == 1);
                CellScanner cellScanner1 = next1[0].cellScanner();
                cellScanner1.advance();
                Cell current1 = cellScanner1.current();
                // test user can only see value3 (no label)
                assertTrue(Bytes.equals(current1.getRowArray(), current1.getRowOffset(), current1.getRowLength(), ROW_1, 0, ROW_1.length));
                assertTrue(Bytes.equals(current1.getQualifierArray(), current1.getQualifierOffset(), current1.getQualifierLength(), Q3, 0, Q3.length));
                assertTrue(Bytes.equals(current1.getValueArray(), current1.getValueOffset(), current1.getValueLength(), value3, 0, value3.length));
                assertFalse(cellScanner1.advance());
            }
            return null;
        }
    });
}

Example 5 with GetAuthsResponse

use of org.apache.hadoop.hbase.protobuf.generated.VisibilityLabelsProtos.GetAuthsResponse in project hbase by apache.

the class TestVisibilityLabelsOpWithDifferentUsersNoACL method testLabelsTableOpsWithDifferentUsers.

@Test
public void testLabelsTableOpsWithDifferentUsers() throws Throwable {
    PrivilegedExceptionAction<VisibilityLabelsResponse> action = new PrivilegedExceptionAction<VisibilityLabelsResponse>() {

        public VisibilityLabelsResponse run() throws Exception {
            try (Connection conn = ConnectionFactory.createConnection(conf)) {
                return VisibilityClient.setAuths(conn, new String[] { CONFIDENTIAL, PRIVATE }, "user1");
            } catch (Throwable e) {
            }
            return null;
        }
    };
    VisibilityLabelsResponse response = SUPERUSER.runAs(action);
    assertTrue(response.getResult(0).getException().getValue().isEmpty());
    assertTrue(response.getResult(1).getException().getValue().isEmpty());
    // Ideally this should not be allowed.  this operation should fail or do nothing.
    action = new PrivilegedExceptionAction<VisibilityLabelsResponse>() {

        public VisibilityLabelsResponse run() throws Exception {
            try (Connection conn = ConnectionFactory.createConnection(conf)) {
                return VisibilityClient.setAuths(conn, new String[] { CONFIDENTIAL, PRIVATE }, "user3");
            } catch (Throwable e) {
            }
            return null;
        }
    };
    response = NORMAL_USER1.runAs(action);
    assertEquals("org.apache.hadoop.hbase.security.AccessDeniedException", response.getResult(0).getException().getName());
    assertEquals("org.apache.hadoop.hbase.security.AccessDeniedException", response.getResult(1).getException().getName());
    PrivilegedExceptionAction<GetAuthsResponse> action1 = new PrivilegedExceptionAction<GetAuthsResponse>() {

        public GetAuthsResponse run() throws Exception {
            try (Connection conn = ConnectionFactory.createConnection(conf)) {
                return VisibilityClient.getAuths(conn, "user1");
            } catch (Throwable e) {
            }
            return null;
        }
    };
    GetAuthsResponse authsResponse = NORMAL_USER.runAs(action1);
    assertTrue(authsResponse.getAuthList().isEmpty());
    authsResponse = NORMAL_USER1.runAs(action1);
    assertTrue(authsResponse.getAuthList().isEmpty());
    authsResponse = SUPERUSER.runAs(action1);
    List<String> authsList = new ArrayList<>(authsResponse.getAuthList().size());
    for (ByteString authBS : authsResponse.getAuthList()) {
        authsList.add(Bytes.toString(authBS.toByteArray()));
    }
    assertEquals(2, authsList.size());
    assertTrue(authsList.contains(CONFIDENTIAL));
    assertTrue(authsList.contains(PRIVATE));
    PrivilegedExceptionAction<VisibilityLabelsResponse> action2 = new PrivilegedExceptionAction<VisibilityLabelsResponse>() {

        public VisibilityLabelsResponse run() throws Exception {
            try (Connection conn = ConnectionFactory.createConnection(conf)) {
                return VisibilityClient.clearAuths(conn, new String[] { CONFIDENTIAL, PRIVATE }, "user1");
            } catch (Throwable e) {
            }
            return null;
        }
    };
    response = NORMAL_USER1.runAs(action2);
    assertEquals("org.apache.hadoop.hbase.security.AccessDeniedException", response.getResult(0).getException().getName());
    assertEquals("org.apache.hadoop.hbase.security.AccessDeniedException", response.getResult(1).getException().getName());
    response = SUPERUSER.runAs(action2);
    assertTrue(response.getResult(0).getException().getValue().isEmpty());
    assertTrue(response.getResult(1).getException().getValue().isEmpty());
    authsResponse = SUPERUSER.runAs(action1);
    assertTrue(authsResponse.getAuthList().isEmpty());
}