Examples with RegionActionResult org.apache.hadoop.hbase.shaded.protobuf.generated.ClientProtos.RegionActionResult used on opensource projects

Example 6 with RegionActionResult

use of org.apache.hadoop.hbase.shaded.protobuf.generated.ClientProtos.RegionActionResult in project hbase by apache.

the class TestVisibilityLabelsWithDefaultVisLabelService method testAddLabels.

@Test
public void testAddLabels() throws Throwable {
    PrivilegedExceptionAction<VisibilityLabelsResponse> action = new PrivilegedExceptionAction<VisibilityLabelsResponse>() {

        @Override
        public VisibilityLabelsResponse run() throws Exception {
            String[] labels = { "L1", SECRET, "L2", "invalid~", "L3" };
            VisibilityLabelsResponse response = null;
            try (Connection conn = ConnectionFactory.createConnection(conf)) {
                response = VisibilityClient.addLabels(conn, labels);
            } catch (Throwable e) {
                throw new IOException(e);
            }
            List<RegionActionResult> resultList = response.getResultList();
            assertEquals(5, resultList.size());
            assertTrue(resultList.get(0).getException().getValue().isEmpty());
            assertEquals("org.apache.hadoop.hbase.DoNotRetryIOException", resultList.get(1).getException().getName());
            assertTrue(Bytes.toString(resultList.get(1).getException().getValue().toByteArray()).contains("org.apache.hadoop.hbase.security.visibility.LabelAlreadyExistsException: " + "Label 'secret' already exists"));
            assertTrue(resultList.get(2).getException().getValue().isEmpty());
            assertTrue(resultList.get(3).getException().getValue().isEmpty());
            assertTrue(resultList.get(4).getException().getValue().isEmpty());
            return null;
        }
    };
    SUPERUSER.runAs(action);
}

Example 7 with RegionActionResult

use of org.apache.hadoop.hbase.shaded.protobuf.generated.ClientProtos.RegionActionResult in project hbase by apache.

the class TestVisibilityLabels method testClearUserAuths.

@Test
public void testClearUserAuths() throws Throwable {
    PrivilegedExceptionAction<Void> action = new PrivilegedExceptionAction<Void>() {

        @Override
        public Void run() throws Exception {
            String[] auths = { SECRET, CONFIDENTIAL, PRIVATE };
            String user = "testUser";
            try (Connection conn = ConnectionFactory.createConnection(conf)) {
                VisibilityClient.setAuths(conn, auths, user);
            } catch (Throwable e) {
                throw new IOException(e);
            }
            // Removing the auths for SECRET and CONFIDENTIAL for the user.
            // Passing a non existing auth also.
            auths = new String[] { SECRET, PUBLIC, CONFIDENTIAL };
            VisibilityLabelsResponse response = null;
            try (Connection conn = ConnectionFactory.createConnection(conf)) {
                response = VisibilityClient.clearAuths(conn, auths, user);
            } catch (Throwable e) {
                fail("Should not have failed");
            }
            List<RegionActionResult> resultList = response.getResultList();
            assertEquals(3, resultList.size());
            assertTrue(resultList.get(0).getException().getValue().isEmpty());
            assertEquals("org.apache.hadoop.hbase.DoNotRetryIOException", resultList.get(1).getException().getName());
            assertTrue(Bytes.toString(resultList.get(1).getException().getValue().toByteArray()).contains("org.apache.hadoop.hbase.security.visibility.InvalidLabelException: " + "Label 'public' is not set for the user testUser"));
            assertTrue(resultList.get(2).getException().getValue().isEmpty());
            try (Connection connection = ConnectionFactory.createConnection(conf);
                Table ht = connection.getTable(LABELS_TABLE_NAME)) {
                ResultScanner scanner = ht.getScanner(new Scan());
                Result result = null;
                List<Result> results = new ArrayList<>();
                while ((result = scanner.next()) != null) {
                    results.add(result);
                }
                List<String> curAuths = extractAuths(user, results);
                assertTrue(curAuths.contains(PRIVATE));
                assertEquals(1, curAuths.size());
            }
            GetAuthsResponse authsResponse = null;
            try (Connection conn = ConnectionFactory.createConnection(conf)) {
                authsResponse = VisibilityClient.getAuths(conn, user);
            } catch (Throwable e) {
                throw new IOException(e);
            }
            List<String> authsList = new ArrayList<>(authsResponse.getAuthList().size());
            for (ByteString authBS : authsResponse.getAuthList()) {
                authsList.add(Bytes.toString(authBS.toByteArray()));
            }
            assertEquals(1, authsList.size());
            assertTrue(authsList.contains(PRIVATE));
            return null;
        }
    };
    SUPERUSER.runAs(action);
}

Example 8 with RegionActionResult

use of org.apache.hadoop.hbase.shaded.protobuf.generated.ClientProtos.RegionActionResult in project hbase by apache.

the class VisibilityController method setAuths.

@Override
public synchronized void setAuths(RpcController controller, SetAuthsRequest request, RpcCallback<VisibilityLabelsResponse> done) {
    VisibilityLabelsResponse.Builder response = VisibilityLabelsResponse.newBuilder();
    List<ByteString> auths = request.getAuthList();
    if (!initialized) {
        setExceptionResults(auths.size(), new VisibilityControllerNotReadyException("VisibilityController not yet initialized!"), response);
    } else {
        byte[] user = request.getUser().toByteArray();
        List<byte[]> labelAuths = new ArrayList<>(auths.size());
        try {
            if (authorizationEnabled) {
                checkCallingUserAuth();
            }
            for (ByteString authBS : auths) {
                labelAuths.add(authBS.toByteArray());
            }
            OperationStatus[] opStatus = this.visibilityLabelService.setAuths(user, labelAuths);
            logResult(true, "setAuths", "Setting authorization for labels allowed", user, labelAuths, null);
            RegionActionResult successResult = RegionActionResult.newBuilder().build();
            for (OperationStatus status : opStatus) {
                if (status.getOperationStatusCode() == SUCCESS) {
                    response.addResult(successResult);
                } else {
                    RegionActionResult.Builder failureResultBuilder = RegionActionResult.newBuilder();
                    failureResultBuilder.setException(buildException(new DoNotRetryIOException(status.getExceptionMsg())));
                    response.addResult(failureResultBuilder.build());
                }
            }
        } catch (AccessDeniedException e) {
            logResult(false, "setAuths", e.getMessage(), user, labelAuths, null);
            LOG.error("User is not having required permissions to set authorization", e);
            setExceptionResults(auths.size(), e, response);
        } catch (IOException e) {
            LOG.error(e.toString(), e);
            setExceptionResults(auths.size(), e, response);
        }
    }
    done.run(response.build());
}

Example 9 with RegionActionResult

use of org.apache.hadoop.hbase.shaded.protobuf.generated.ClientProtos.RegionActionResult in project hbase by apache.

the class VisibilityController method setExceptionResults.

private void setExceptionResults(int size, IOException e, VisibilityLabelsResponse.Builder response) {
    RegionActionResult.Builder failureResultBuilder = RegionActionResult.newBuilder();
    failureResultBuilder.setException(buildException(e));
    RegionActionResult failureResult = failureResultBuilder.build();
    for (int i = 0; i < size; i++) {
        response.addResult(i, failureResult);
    }
}

Example 10 with RegionActionResult

use of org.apache.hadoop.hbase.shaded.protobuf.generated.ClientProtos.RegionActionResult in project hbase by apache.

the class VisibilityController method clearAuths.

@Override
public synchronized void clearAuths(RpcController controller, SetAuthsRequest request, RpcCallback<VisibilityLabelsResponse> done) {
    VisibilityLabelsResponse.Builder response = VisibilityLabelsResponse.newBuilder();
    List<ByteString> auths = request.getAuthList();
    if (!initialized) {
        setExceptionResults(auths.size(), new CoprocessorException("VisibilityController not yet initialized"), response);
    } else {
        byte[] requestUser = request.getUser().toByteArray();
        List<byte[]> labelAuths = new ArrayList<>(auths.size());
        try {
            // When AC is ON, do AC based user auth check
            if (authorizationEnabled && accessControllerAvailable && !isSystemOrSuperUser()) {
                User user = VisibilityUtils.getActiveUser();
                throw new AccessDeniedException("User '" + (user != null ? user.getShortName() : "null") + " is not authorized to perform this action.");
            }
            if (authorizationEnabled) {
                // When AC is not in place the calling user should have
                checkCallingUserAuth();
            // SYSTEM_LABEL auth to do this action.
            }
            for (ByteString authBS : auths) {
                labelAuths.add(authBS.toByteArray());
            }
            OperationStatus[] opStatus = this.visibilityLabelService.clearAuths(requestUser, labelAuths);
            logResult(true, "clearAuths", "Removing authorization for labels allowed", requestUser, labelAuths, null);
            RegionActionResult successResult = RegionActionResult.newBuilder().build();
            for (OperationStatus status : opStatus) {
                if (status.getOperationStatusCode() == SUCCESS) {
                    response.addResult(successResult);
                } else {
                    RegionActionResult.Builder failureResultBuilder = RegionActionResult.newBuilder();
                    failureResultBuilder.setException(buildException(new DoNotRetryIOException(status.getExceptionMsg())));
                    response.addResult(failureResultBuilder.build());
                }
            }
        } catch (AccessDeniedException e) {
            logResult(false, "clearAuths", e.getMessage(), requestUser, labelAuths, null);
            LOG.error("User is not having required permissions to clear authorization", e);
            setExceptionResults(auths.size(), e, response);
        } catch (IOException e) {
            LOG.error(e.toString(), e);
            setExceptionResults(auths.size(), e, response);
        }
    }
    done.run(response.build());
}