Examples with ACCESS org.apache.hadoop.ozone.OzoneAcl.AclScope.ACCESS used on opensource projects

Example 1 with ACCESS

use of org.apache.hadoop.ozone.OzoneAcl.AclScope.ACCESS in project ozone by apache.

the class TestOzoneRpcClientAbstract method validateOzoneAccessAcl.

/**
 * Helper function to validate ozone Acl for given object.
 * @param ozObj
 */
private void validateOzoneAccessAcl(OzoneObj ozObj) throws IOException {
    // Get acls for volume.
    List<OzoneAcl> expectedAcls = getAclList(new OzoneConfiguration());
    // Case:1 Add new acl permission to existing acl.
    if (expectedAcls.size() > 0) {
        OzoneAcl oldAcl = expectedAcls.get(0);
        OzoneAcl newAcl = new OzoneAcl(oldAcl.getType(), oldAcl.getName(), ACLType.READ_ACL, oldAcl.getAclScope());
        // Verify that operation successful.
        assertTrue(store.addAcl(ozObj, newAcl));
        assertEquals(expectedAcls.size(), store.getAcl(ozObj).size());
        final Optional<OzoneAcl> readAcl = store.getAcl(ozObj).stream().filter(acl -> acl.getName().equals(newAcl.getName()) && acl.getType().equals(newAcl.getType())).findFirst();
        assertTrue("New acl expected but not found.", readAcl.isPresent());
        assertTrue("READ_ACL should exist in current acls:" + readAcl.get(), readAcl.get().getAclList().contains(ACLType.READ_ACL));
        // Case:2 Remove newly added acl permission.
        assertTrue(store.removeAcl(ozObj, newAcl));
        assertEquals(expectedAcls.size(), store.getAcl(ozObj).size());
        final Optional<OzoneAcl> nonReadAcl = store.getAcl(ozObj).stream().filter(acl -> acl.getName().equals(newAcl.getName()) && acl.getType().equals(newAcl.getType())).findFirst();
        assertTrue("New acl expected but not found.", nonReadAcl.isPresent());
        assertFalse("READ_ACL should not exist in current acls:" + nonReadAcl.get(), nonReadAcl.get().getAclList().contains(ACLType.READ_ACL));
    } else {
        fail("Default acl should not be empty.");
    }
    List<OzoneAcl> keyAcls = store.getAcl(ozObj);
    expectedAcls.forEach(a -> assertTrue(keyAcls.contains(a)));
    // Remove all acl's.
    for (OzoneAcl a : expectedAcls) {
        store.removeAcl(ozObj, a);
    }
    List<OzoneAcl> newAcls = store.getAcl(ozObj);
    assertEquals(0, newAcls.size());
    // Add acl's and then call getAcl.
    int aclCount = 0;
    for (OzoneAcl a : expectedAcls) {
        aclCount++;
        assertTrue(store.addAcl(ozObj, a));
        assertEquals(aclCount, store.getAcl(ozObj).size());
    }
    newAcls = store.getAcl(ozObj);
    assertEquals(expectedAcls.size(), newAcls.size());
    List<OzoneAcl> finalNewAcls = newAcls;
    expectedAcls.forEach(a -> assertTrue(finalNewAcls.contains(a)));
    // Reset acl's.
    OzoneAcl ua = new OzoneAcl(USER, "userx", ACLType.READ_ACL, ACCESS);
    OzoneAcl ug = new OzoneAcl(GROUP, "userx", ACLType.ALL, ACCESS);
    store.setAcl(ozObj, Arrays.asList(ua, ug));
    newAcls = store.getAcl(ozObj);
    assertEquals(2, newAcls.size());
    assertTrue(newAcls.contains(ua));
    assertTrue(newAcls.contains(ug));
}

Example 2 with ACCESS

use of org.apache.hadoop.ozone.OzoneAcl.AclScope.ACCESS in project ozone by apache.

the class TestOzoneNativeAuthorizer method resetAclsAndValidateAccess.

private void resetAclsAndValidateAccess(OzoneObj obj, ACLIdentityType accessType, OzoneManagerProtocol aclImplementor) throws IOException {
    List<OzoneAcl> acls;
    String user = testUgi.getUserName();
    String group = (testUgi.getGroups().size() > 0) ? testUgi.getGroups().get(0) : "";
    RequestContext.Builder builder = new RequestContext.Builder().setClientUgi(testUgi).setAclType(accessType);
    // Get all acls.
    List<ACLType> allAcls = Arrays.stream(ACLType.values()).collect(Collectors.toList());
    /**
     * 1. Reset default acls to an acl.
     * 2. Test if user/group has access only to it.
     * 3. Add remaining acls one by one and then test
     *    if user/group has access to them.
     */
    for (ACLType a1 : allAcls) {
        OzoneAcl newAcl = new OzoneAcl(accessType, getAclName(accessType), a1, ACCESS);
        // Reset acls to only one right.
        if (obj.getResourceType() == VOLUME) {
            setVolumeAcl(Collections.singletonList(newAcl));
        } else if (obj.getResourceType() == BUCKET) {
            setBucketAcl(Collections.singletonList(newAcl));
        } else {
            aclImplementor.setAcl(obj, Collections.singletonList(newAcl));
        }
        // Fetch current acls and validate.
        acls = aclImplementor.getAcl(obj);
        assertTrue(acls.size() == 1);
        assertTrue(acls.contains(newAcl));
        // Special handling for ALL.
        if (a1.equals(ALL)) {
            validateAll(obj, builder);
            continue;
        }
        // Special handling for NONE.
        if (a1.equals(NONE)) {
            validateNone(obj, builder);
            continue;
        }
        String msg = "Acl to check:" + a1 + " accessType:" + accessType + " path:" + obj.getPath();
        if (a1.equals(CREATE) && obj.getResourceType().equals(VOLUME)) {
            assertEquals(msg, nativeAuthorizer.getOzoneAdmins().contains(user), nativeAuthorizer.checkAccess(obj, builder.setAclRights(a1).build()));
        } else {
            assertEquals(msg, expectedAclResult, nativeAuthorizer.checkAccess(obj, builder.setAclRights(a1).build()));
        }
        List<ACLType> aclsToBeValidated = Arrays.stream(ACLType.values()).collect(Collectors.toList());
        List<ACLType> aclsToBeAdded = Arrays.stream(ACLType.values()).collect(Collectors.toList());
        aclsToBeValidated.remove(NONE);
        // Do not validate "WRITE" since write acl type requires object to be
        // present in OpenKeyTable.
        aclsToBeValidated.remove(WRITE);
        aclsToBeValidated.remove(a1);
        aclsToBeAdded.remove(NONE);
        aclsToBeAdded.remove(ALL);
        // AclType "CREATE" is skipped from access check on objects
        // since the object will not exist during access check.
        aclsToBeAdded.remove(CREATE);
        // AclType "WRITE" is removed from being tested here,
        // because object must always be present in OpenKeyTable for write
        // acl requests. But, here the objects are already committed
        // and will move to keyTable.
        aclsToBeAdded.remove(WRITE);
        // Fetch acls again.
        for (ACLType a2 : aclsToBeAdded) {
            if (!a2.equals(a1)) {
                acls = aclImplementor.getAcl(obj);
                List right = acls.stream().map(a -> a.getAclList()).collect(Collectors.toList());
                assertFalse("Did not expect client to have " + a2 + " acl. " + "Current acls found:" + right + ". Type:" + accessType + "," + " name:" + (accessType == USER ? user : group), nativeAuthorizer.checkAccess(obj, builder.setAclRights(a2).build()));
                // Randomize next type.
                int type = RandomUtils.nextInt(0, 3);
                ACLIdentityType identityType = ACLIdentityType.values()[type];
                // Add remaining acls one by one and then check access.
                OzoneAcl addAcl = new OzoneAcl(identityType, getAclName(identityType), a2, ACCESS);
                // only DB not cache.
                if (obj.getResourceType() == VOLUME) {
                    addVolumeAcl(addAcl);
                } else if (obj.getResourceType() == BUCKET) {
                    addBucketAcl(addAcl);
                } else {
                    aclImplementor.addAcl(obj, addAcl);
                }
                // Fetch acls again.
                acls = aclImplementor.getAcl(obj);
                boolean a2AclFound = false;
                boolean a1AclFound = false;
                for (OzoneAcl acl : acls) {
                    if (acl.getAclList().contains(a2)) {
                        a2AclFound = true;
                    }
                    if (acl.getAclList().contains(a1)) {
                        a1AclFound = true;
                    }
                }
                assertTrue("Current acls :" + acls + ". " + "Type:" + accessType + ", name:" + (accessType == USER ? user : group) + " acl:" + a2, a2AclFound);
                assertTrue("Expected client to have " + a1 + " acl. Current acls " + "found:" + acls + ". Type:" + accessType + ", name:" + (accessType == USER ? user : group), a1AclFound);
                assertEquals("Current acls " + acls + ". Expect acl:" + a2 + " to be set? " + expectedAclResult + " accessType:" + accessType, expectedAclResult, nativeAuthorizer.checkAccess(obj, builder.setAclRights(a2).build()));
                aclsToBeValidated.remove(a2);
                for (ACLType a3 : aclsToBeValidated) {
                    if (!a3.equals(a1) && !a3.equals(a2) && !a3.equals(CREATE)) {
                        assertFalse("User shouldn't have right " + a3 + ". " + "Current acl rights for user:" + a1 + "," + a2, nativeAuthorizer.checkAccess(obj, builder.setAclRights(a3).build()));
                    }
                }
            }
        }
    }
}

Example 3 with ACCESS

use of org.apache.hadoop.ozone.OzoneAcl.AclScope.ACCESS in project ozone by apache.

the class TestOzoneRpcClientAbstract method testMultipartUploadWithACL.

@Test
public void testMultipartUploadWithACL() throws Exception {
    String volumeName = UUID.randomUUID().toString();
    String bucketName = UUID.randomUUID().toString();
    String keyName = UUID.randomUUID().toString();
    store.createVolume(volumeName);
    OzoneVolume volume = store.getVolume(volumeName);
    volume.createBucket(bucketName);
    OzoneBucket bucket = volume.getBucket(bucketName);
    // Add ACL on Bucket
    OzoneAcl acl1 = new OzoneAcl(USER, "Monday", ACLType.ALL, DEFAULT);
    OzoneAcl acl2 = new OzoneAcl(USER, "Friday", ACLType.ALL, DEFAULT);
    OzoneAcl acl3 = new OzoneAcl(USER, "Jan", ACLType.ALL, ACCESS);
    OzoneAcl acl4 = new OzoneAcl(USER, "Feb", ACLType.ALL, ACCESS);
    bucket.addAcl(acl1);
    bucket.addAcl(acl2);
    bucket.addAcl(acl3);
    bucket.addAcl(acl4);
    doMultipartUpload(bucket, keyName, (byte) 98);
    OzoneObj keyObj = OzoneObjInfo.Builder.newBuilder().setBucketName(bucketName).setVolumeName(volumeName).setKeyName(keyName).setResType(OzoneObj.ResourceType.KEY).setStoreType(OzoneObj.StoreType.OZONE).build();
    List<OzoneAcl> aclList = store.getAcl(keyObj);
    // key should inherit bucket's DEFAULT type acl
    Assert.assertTrue(aclList.stream().anyMatch(acl -> acl.getName().equals(acl1.getName())));
    Assert.assertTrue(aclList.stream().anyMatch(acl -> acl.getName().equals(acl2.getName())));
    // kye should not inherit bucket's ACCESS type acl
    Assert.assertFalse(aclList.stream().anyMatch(acl -> acl.getName().equals(acl3.getName())));
    Assert.assertFalse(aclList.stream().anyMatch(acl -> acl.getName().equals(acl4.getName())));
    // User without permission should fail to upload the object
    String userName = "test-user";
    UserGroupInformation remoteUser = UserGroupInformation.createRemoteUser(userName);
    OzoneClient client = remoteUser.doAs((PrivilegedExceptionAction<OzoneClient>) () -> {
        return OzoneClientFactory.getRpcClient(cluster.getConf());
    });
    OzoneAcl acl5 = new OzoneAcl(USER, userName, ACLType.READ, DEFAULT);
    OzoneAcl acl6 = new OzoneAcl(USER, userName, ACLType.READ, ACCESS);
    OzoneObj volumeObj = OzoneObjInfo.Builder.newBuilder().setVolumeName(volumeName).setStoreType(OzoneObj.StoreType.OZONE).setResType(OzoneObj.ResourceType.VOLUME).build();
    OzoneObj bucketObj = OzoneObjInfo.Builder.newBuilder().setVolumeName(volumeName).setBucketName(bucketName).setStoreType(OzoneObj.StoreType.OZONE).setResType(OzoneObj.ResourceType.BUCKET).build();
    store.addAcl(volumeObj, acl5);
    store.addAcl(volumeObj, acl6);
    store.addAcl(bucketObj, acl5);
    store.addAcl(bucketObj, acl6);
    // User without permission cannot start multi-upload
    String keyName2 = UUID.randomUUID().toString();
    OzoneBucket bucket2 = client.getObjectStore().getVolume(volumeName).getBucket(bucketName);
    try {
        initiateMultipartUpload(bucket2, keyName2, ReplicationType.RATIS, THREE);
        fail("User without permission should fail");
    } catch (Exception e) {
        assertTrue(e instanceof OMException);
        assertEquals(ResultCodes.PERMISSION_DENIED, ((OMException) e).getResult());
    }
    // Add create permission for user, and try multi-upload init again
    OzoneAcl acl7 = new OzoneAcl(USER, userName, ACLType.CREATE, DEFAULT);
    OzoneAcl acl8 = new OzoneAcl(USER, userName, ACLType.CREATE, ACCESS);
    OzoneAcl acl9 = new OzoneAcl(USER, userName, WRITE, DEFAULT);
    OzoneAcl acl10 = new OzoneAcl(USER, userName, WRITE, ACCESS);
    store.addAcl(volumeObj, acl7);
    store.addAcl(volumeObj, acl8);
    store.addAcl(volumeObj, acl9);
    store.addAcl(volumeObj, acl10);
    store.addAcl(bucketObj, acl7);
    store.addAcl(bucketObj, acl8);
    store.addAcl(bucketObj, acl9);
    store.addAcl(bucketObj, acl10);
    String uploadId = initiateMultipartUpload(bucket2, keyName2, ReplicationType.RATIS, THREE);
    // Upload part
    byte[] data = generateData(OzoneConsts.OM_MULTIPART_MIN_SIZE, (byte) 1);
    String partName = uploadPart(bucket, keyName2, uploadId, 1, data);
    Map<Integer, String> partsMap = new TreeMap<>();
    partsMap.put(1, partName);
    // Complete multipart upload request
    completeMultipartUpload(bucket2, keyName2, uploadId, partsMap);
    // User without permission cannot read multi-uploaded object
    try {
        OzoneInputStream inputStream = bucket2.readKey(keyName);
        fail("User without permission should fail");
    } catch (Exception e) {
        assertTrue(e instanceof OMException);
        assertEquals(ResultCodes.PERMISSION_DENIED, ((OMException) e).getResult());
    }
}