Examples with AccessTestAction org.apache.hadoop.hbase.security.access.SecureTestUtil.AccessTestAction used on opensource projects

Example 1 with AccessTestAction

use of org.apache.hadoop.hbase.security.access.SecureTestUtil.AccessTestAction in project hbase by apache.

the class TestSecureExport method testVisibilityLabels.

@Test
// See HBASE-23990
@org.junit.Ignore
public void testVisibilityLabels() throws IOException, Throwable {
    final String exportTable = name.getMethodName() + "_export";
    final String importTable = name.getMethodName() + "_import";
    final TableDescriptor exportHtd = TableDescriptorBuilder.newBuilder(TableName.valueOf(exportTable)).setColumnFamily(ColumnFamilyDescriptorBuilder.of(FAMILYA)).build();
    User owner = User.createUserForTesting(UTIL.getConfiguration(), USER_OWNER, new String[0]);
    SecureTestUtil.createTable(UTIL, owner, exportHtd, new byte[][] { Bytes.toBytes("s") });
    AccessTestAction putAction = () -> {
        Put p1 = new Put(ROW1);
        p1.addColumn(FAMILYA, QUAL, NOW, QUAL);
        p1.setCellVisibility(new CellVisibility(SECRET));
        Put p2 = new Put(ROW2);
        p2.addColumn(FAMILYA, QUAL, NOW, QUAL);
        p2.setCellVisibility(new CellVisibility(PRIVATE + " & " + CONFIDENTIAL));
        Put p3 = new Put(ROW3);
        p3.addColumn(FAMILYA, QUAL, NOW, QUAL);
        p3.setCellVisibility(new CellVisibility("!" + CONFIDENTIAL + " & " + TOPSECRET));
        try (Connection conn = ConnectionFactory.createConnection(UTIL.getConfiguration());
            Table t = conn.getTable(TableName.valueOf(exportTable))) {
            t.put(p1);
            t.put(p2);
            t.put(p3);
        }
        return null;
    };
    SecureTestUtil.verifyAllowed(putAction, getUserByLogin(USER_OWNER));
    List<Pair<List<String>, Integer>> labelsAndRowCounts = new LinkedList<>();
    labelsAndRowCounts.add(new Pair<>(Arrays.asList(SECRET), 1));
    labelsAndRowCounts.add(new Pair<>(Arrays.asList(PRIVATE, CONFIDENTIAL), 1));
    labelsAndRowCounts.add(new Pair<>(Arrays.asList(TOPSECRET), 1));
    labelsAndRowCounts.add(new Pair<>(Arrays.asList(TOPSECRET, CONFIDENTIAL), 0));
    labelsAndRowCounts.add(new Pair<>(Arrays.asList(TOPSECRET, CONFIDENTIAL, PRIVATE, SECRET), 2));
    for (final Pair<List<String>, Integer> labelsAndRowCount : labelsAndRowCounts) {
        final List<String> labels = labelsAndRowCount.getFirst();
        final int rowCount = labelsAndRowCount.getSecond();
        // create a open permission directory.
        final Path openDir = new Path("testAccessCase");
        final FileSystem fs = openDir.getFileSystem(UTIL.getConfiguration());
        fs.mkdirs(openDir);
        fs.setPermission(openDir, new FsPermission(FsAction.ALL, FsAction.ALL, FsAction.ALL));
        final Path output = fs.makeQualified(new Path(openDir, "output"));
        AccessTestAction exportAction = () -> {
            StringBuilder buf = new StringBuilder();
            labels.forEach(v -> buf.append(v).append(","));
            buf.deleteCharAt(buf.length() - 1);
            try {
                String[] args = new String[] { "-D " + ExportUtils.EXPORT_VISIBILITY_LABELS + "=" + buf.toString(), exportTable, output.toString() };
                Export.run(new Configuration(UTIL.getConfiguration()), args);
                return null;
            } catch (ServiceException | IOException ex) {
                throw ex;
            } catch (Throwable ex) {
                throw new Exception(ex);
            }
        };
        SecureTestUtil.verifyAllowed(exportAction, getUserByLogin(USER_OWNER));
        final TableDescriptor importHtd = TableDescriptorBuilder.newBuilder(TableName.valueOf(importTable)).setColumnFamily(ColumnFamilyDescriptorBuilder.of(FAMILYB)).build();
        SecureTestUtil.createTable(UTIL, owner, importHtd, new byte[][] { Bytes.toBytes("s") });
        AccessTestAction importAction = () -> {
            String[] args = new String[] { "-D" + Import.CF_RENAME_PROP + "=" + FAMILYA_STRING + ":" + FAMILYB_STRING, importTable, output.toString() };
            assertEquals(0, ToolRunner.run(new Configuration(UTIL.getConfiguration()), new Import(), args));
            return null;
        };
        SecureTestUtil.verifyAllowed(importAction, getUserByLogin(USER_OWNER));
        AccessTestAction scanAction = () -> {
            Scan scan = new Scan();
            scan.setAuthorizations(new Authorizations(labels));
            try (Connection conn = ConnectionFactory.createConnection(UTIL.getConfiguration());
                Table table = conn.getTable(importHtd.getTableName());
                ResultScanner scanner = table.getScanner(scan)) {
                int count = 0;
                for (Result r : scanner) {
                    ++count;
                }
                assertEquals(rowCount, count);
            }
            return null;
        };
        SecureTestUtil.verifyAllowed(scanAction, getUserByLogin(USER_OWNER));
        AccessTestAction deleteAction = () -> {
            UTIL.deleteTable(importHtd.getTableName());
            return null;
        };
        SecureTestUtil.verifyAllowed(deleteAction, getUserByLogin(USER_OWNER));
        clearOutput(output);
    }
    AccessTestAction deleteAction = () -> {
        UTIL.deleteTable(exportHtd.getTableName());
        return null;
    };
    SecureTestUtil.verifyAllowed(deleteAction, getUserByLogin(USER_OWNER));
}

Example 2 with AccessTestAction

use of org.apache.hadoop.hbase.security.access.SecureTestUtil.AccessTestAction in project hbase by apache.

the class TestAsyncAccessControlAdminApi method test.

@Test
public void test() throws Exception {
    TableName tableName = TableName.valueOf("test-table");
    String userName1 = "user1";
    String userName2 = "user2";
    User user2 = User.createUserForTesting(TEST_UTIL.getConfiguration(), userName2, new String[0]);
    Permission permission = Permission.newBuilder(tableName).withActions(Permission.Action.READ).build();
    UserPermission userPermission = new UserPermission(userName1, permission);
    // grant user1 table permission
    admin.grant(userPermission, false).get();
    // get table permissions
    List<UserPermission> userPermissions = admin.getUserPermissions(GetUserPermissionsRequest.newBuilder(tableName).build()).get();
    assertEquals(1, userPermissions.size());
    assertEquals(userPermission, userPermissions.get(0));
    // get table permissions
    userPermissions = admin.getUserPermissions(GetUserPermissionsRequest.newBuilder(tableName).withUserName(userName1).build()).get();
    assertEquals(1, userPermissions.size());
    assertEquals(userPermission, userPermissions.get(0));
    userPermissions = admin.getUserPermissions(GetUserPermissionsRequest.newBuilder(tableName).withUserName(userName2).build()).get();
    assertEquals(0, userPermissions.size());
    // has user permission
    List<Permission> permissions = Lists.newArrayList(permission);
    boolean hasPermission = admin.hasUserPermissions(userName1, permissions).get().get(0).booleanValue();
    assertTrue(hasPermission);
    hasPermission = admin.hasUserPermissions(userName2, permissions).get().get(0).booleanValue();
    assertFalse(hasPermission);
    AccessTestAction hasPermissionAction = new AccessTestAction() {

        @Override
        public Object run() throws Exception {
            try (AsyncConnection conn = ConnectionFactory.createAsyncConnection(TEST_UTIL.getConfiguration()).get()) {
                return conn.getAdmin().hasUserPermissions(userName1, permissions).get().get(0);
            }
        }
    };
    try {
        user2.runAs(hasPermissionAction);
        fail("Should not come here");
    } catch (Exception e) {
        LOG.error("Call has permission error", e);
    }
    // check permission
    admin.hasUserPermissions(permissions);
    AccessTestAction checkPermissionsAction = new AccessTestAction() {

        @Override
        public Object run() throws Exception {
            try (AsyncConnection conn = ConnectionFactory.createAsyncConnection(TEST_UTIL.getConfiguration()).get()) {
                return conn.getAdmin().hasUserPermissions(permissions).get().get(0);
            }
        }
    };
    assertFalse((Boolean) user2.runAs(checkPermissionsAction));
}

Example 3 with AccessTestAction

use of org.apache.hadoop.hbase.security.access.SecureTestUtil.AccessTestAction in project hbase by apache.

the class TestSecureExport method testAccessCase.

/**
 * Test the ExportEndpoint's access levels. The {@link Export} test is ignored
 * since the access exceptions cannot be collected from the mappers.
 */
@Test
public void testAccessCase() throws Throwable {
    final String exportTable = name.getMethodName();
    TableDescriptor exportHtd = TableDescriptorBuilder.newBuilder(TableName.valueOf(exportTable)).setColumnFamily(ColumnFamilyDescriptorBuilder.of(FAMILYA)).build();
    User owner = User.createUserForTesting(UTIL.getConfiguration(), USER_OWNER, new String[0]);
    SecureTestUtil.createTable(UTIL, owner, exportHtd, new byte[][] { Bytes.toBytes("s") });
    SecureTestUtil.grantOnTable(UTIL, USER_RO, TableName.valueOf(exportTable), null, null, Permission.Action.READ);
    SecureTestUtil.grantOnTable(UTIL, USER_RX, TableName.valueOf(exportTable), null, null, Permission.Action.READ, Permission.Action.EXEC);
    SecureTestUtil.grantOnTable(UTIL, USER_XO, TableName.valueOf(exportTable), null, null, Permission.Action.EXEC);
    assertEquals(4, PermissionStorage.getTablePermissions(UTIL.getConfiguration(), TableName.valueOf(exportTable)).size());
    AccessTestAction putAction = () -> {
        Put p = new Put(ROW1);
        p.addColumn(FAMILYA, Bytes.toBytes("qual_0"), NOW, QUAL);
        p.addColumn(FAMILYA, Bytes.toBytes("qual_1"), NOW, QUAL);
        try (Connection conn = ConnectionFactory.createConnection(UTIL.getConfiguration());
            Table t = conn.getTable(TableName.valueOf(exportTable))) {
            t.put(p);
        }
        return null;
    };
    // no hdfs access.
    SecureTestUtil.verifyAllowed(putAction, getUserByLogin(USER_ADMIN), getUserByLogin(USER_OWNER));
    SecureTestUtil.verifyDenied(putAction, getUserByLogin(USER_RO), getUserByLogin(USER_XO), getUserByLogin(USER_RX), getUserByLogin(USER_NONE));
    final FileSystem fs = UTIL.getDFSCluster().getFileSystem();
    final Path openDir = fs.makeQualified(new Path("testAccessCase"));
    fs.mkdirs(openDir);
    fs.setPermission(openDir, new FsPermission(FsAction.ALL, FsAction.ALL, FsAction.ALL));
    final Path output = fs.makeQualified(new Path(openDir, "output"));
    AccessTestAction exportAction = () -> {
        try {
            String[] args = new String[] { exportTable, output.toString() };
            Map<byte[], Export.Response> result = Export.run(new Configuration(UTIL.getConfiguration()), args);
            long rowCount = 0;
            long cellCount = 0;
            for (Export.Response r : result.values()) {
                rowCount += r.getRowCount();
                cellCount += r.getCellCount();
            }
            assertEquals(1, rowCount);
            assertEquals(2, cellCount);
            return null;
        } catch (ServiceException | IOException ex) {
            throw ex;
        } catch (Throwable ex) {
            LOG.error(ex.toString(), ex);
            throw new Exception(ex);
        } finally {
            if (fs.exists(new Path(openDir, "output"))) {
                // if export completes successfully, every file under the output directory should be
                // owned by the current user, not the hbase service user.
                FileStatus outputDirFileStatus = fs.getFileStatus(new Path(openDir, "output"));
                String currentUserName = User.getCurrent().getShortName();
                assertEquals("Unexpected file owner", currentUserName, outputDirFileStatus.getOwner());
                FileStatus[] outputFileStatus = fs.listStatus(new Path(openDir, "output"));
                for (FileStatus fileStatus : outputFileStatus) {
                    assertEquals("Unexpected file owner", currentUserName, fileStatus.getOwner());
                }
            } else {
                LOG.info("output directory doesn't exist. Skip check");
            }
            clearOutput(output);
        }
    };
    SecureTestUtil.verifyDenied(exportAction, getUserByLogin(USER_RO), getUserByLogin(USER_XO), getUserByLogin(USER_NONE));
    SecureTestUtil.verifyAllowed(exportAction, getUserByLogin(USER_ADMIN), getUserByLogin(USER_OWNER), getUserByLogin(USER_RX));
    AccessTestAction deleteAction = () -> {
        UTIL.deleteTable(TableName.valueOf(exportTable));
        return null;
    };
    SecureTestUtil.verifyAllowed(deleteAction, getUserByLogin(USER_OWNER));
    fs.delete(openDir, true);
}