Examples with GROUP org.apache.hadoop.ozone.security.acl.IAccessAuthorizer.ACLIdentityType.GROUP used on opensource projects

Example 1 with GROUP

use of org.apache.hadoop.ozone.security.acl.IAccessAuthorizer.ACLIdentityType.GROUP in project ozone by apache.

the class TestOzoneRpcClientAbstract method validateOzoneAccessAcl.

/**
 * Helper function to validate ozone Acl for given object.
 * @param ozObj
 */
private void validateOzoneAccessAcl(OzoneObj ozObj) throws IOException {
    // Get acls for volume.
    List<OzoneAcl> expectedAcls = getAclList(new OzoneConfiguration());
    // Case:1 Add new acl permission to existing acl.
    if (expectedAcls.size() > 0) {
        OzoneAcl oldAcl = expectedAcls.get(0);
        OzoneAcl newAcl = new OzoneAcl(oldAcl.getType(), oldAcl.getName(), ACLType.READ_ACL, oldAcl.getAclScope());
        // Verify that operation successful.
        assertTrue(store.addAcl(ozObj, newAcl));
        assertEquals(expectedAcls.size(), store.getAcl(ozObj).size());
        final Optional<OzoneAcl> readAcl = store.getAcl(ozObj).stream().filter(acl -> acl.getName().equals(newAcl.getName()) && acl.getType().equals(newAcl.getType())).findFirst();
        assertTrue("New acl expected but not found.", readAcl.isPresent());
        assertTrue("READ_ACL should exist in current acls:" + readAcl.get(), readAcl.get().getAclList().contains(ACLType.READ_ACL));
        // Case:2 Remove newly added acl permission.
        assertTrue(store.removeAcl(ozObj, newAcl));
        assertEquals(expectedAcls.size(), store.getAcl(ozObj).size());
        final Optional<OzoneAcl> nonReadAcl = store.getAcl(ozObj).stream().filter(acl -> acl.getName().equals(newAcl.getName()) && acl.getType().equals(newAcl.getType())).findFirst();
        assertTrue("New acl expected but not found.", nonReadAcl.isPresent());
        assertFalse("READ_ACL should not exist in current acls:" + nonReadAcl.get(), nonReadAcl.get().getAclList().contains(ACLType.READ_ACL));
    } else {
        fail("Default acl should not be empty.");
    }
    List<OzoneAcl> keyAcls = store.getAcl(ozObj);
    expectedAcls.forEach(a -> assertTrue(keyAcls.contains(a)));
    // Remove all acl's.
    for (OzoneAcl a : expectedAcls) {
        store.removeAcl(ozObj, a);
    }
    List<OzoneAcl> newAcls = store.getAcl(ozObj);
    assertEquals(0, newAcls.size());
    // Add acl's and then call getAcl.
    int aclCount = 0;
    for (OzoneAcl a : expectedAcls) {
        aclCount++;
        assertTrue(store.addAcl(ozObj, a));
        assertEquals(aclCount, store.getAcl(ozObj).size());
    }
    newAcls = store.getAcl(ozObj);
    assertEquals(expectedAcls.size(), newAcls.size());
    List<OzoneAcl> finalNewAcls = newAcls;
    expectedAcls.forEach(a -> assertTrue(finalNewAcls.contains(a)));
    // Reset acl's.
    OzoneAcl ua = new OzoneAcl(USER, "userx", ACLType.READ_ACL, ACCESS);
    OzoneAcl ug = new OzoneAcl(GROUP, "userx", ACLType.ALL, ACCESS);
    store.setAcl(ozObj, Arrays.asList(ua, ug));
    newAcls = store.getAcl(ozObj);
    assertEquals(2, newAcls.size());
    assertTrue(newAcls.contains(ua));
    assertTrue(newAcls.contains(ug));
}

Example 2 with GROUP

use of org.apache.hadoop.ozone.security.acl.IAccessAuthorizer.ACLIdentityType.GROUP in project ozone by apache.

the class TestOzoneNativeAuthorizer method resetAclsAndValidateAccess.

private void resetAclsAndValidateAccess(OzoneObj obj, ACLIdentityType accessType, OzoneManagerProtocol aclImplementor) throws IOException {
    List<OzoneAcl> acls;
    String user = testUgi.getUserName();
    String group = (testUgi.getGroups().size() > 0) ? testUgi.getGroups().get(0) : "";
    RequestContext.Builder builder = new RequestContext.Builder().setClientUgi(testUgi).setAclType(accessType);
    // Get all acls.
    List<ACLType> allAcls = Arrays.stream(ACLType.values()).collect(Collectors.toList());
    /**
     * 1. Reset default acls to an acl.
     * 2. Test if user/group has access only to it.
     * 3. Add remaining acls one by one and then test
     *    if user/group has access to them.
     */
    for (ACLType a1 : allAcls) {
        OzoneAcl newAcl = new OzoneAcl(accessType, getAclName(accessType), a1, ACCESS);
        // Reset acls to only one right.
        if (obj.getResourceType() == VOLUME) {
            setVolumeAcl(Collections.singletonList(newAcl));
        } else if (obj.getResourceType() == BUCKET) {
            setBucketAcl(Collections.singletonList(newAcl));
        } else {
            aclImplementor.setAcl(obj, Collections.singletonList(newAcl));
        }
        // Fetch current acls and validate.
        acls = aclImplementor.getAcl(obj);
        assertTrue(acls.size() == 1);
        assertTrue(acls.contains(newAcl));
        // Special handling for ALL.
        if (a1.equals(ALL)) {
            validateAll(obj, builder);
            continue;
        }
        // Special handling for NONE.
        if (a1.equals(NONE)) {
            validateNone(obj, builder);
            continue;
        }
        String msg = "Acl to check:" + a1 + " accessType:" + accessType + " path:" + obj.getPath();
        if (a1.equals(CREATE) && obj.getResourceType().equals(VOLUME)) {
            assertEquals(msg, nativeAuthorizer.getOzoneAdmins().contains(user), nativeAuthorizer.checkAccess(obj, builder.setAclRights(a1).build()));
        } else {
            assertEquals(msg, expectedAclResult, nativeAuthorizer.checkAccess(obj, builder.setAclRights(a1).build()));
        }
        List<ACLType> aclsToBeValidated = Arrays.stream(ACLType.values()).collect(Collectors.toList());
        List<ACLType> aclsToBeAdded = Arrays.stream(ACLType.values()).collect(Collectors.toList());
        aclsToBeValidated.remove(NONE);
        // Do not validate "WRITE" since write acl type requires object to be
        // present in OpenKeyTable.
        aclsToBeValidated.remove(WRITE);
        aclsToBeValidated.remove(a1);
        aclsToBeAdded.remove(NONE);
        aclsToBeAdded.remove(ALL);
        // AclType "CREATE" is skipped from access check on objects
        // since the object will not exist during access check.
        aclsToBeAdded.remove(CREATE);
        // AclType "WRITE" is removed from being tested here,
        // because object must always be present in OpenKeyTable for write
        // acl requests. But, here the objects are already committed
        // and will move to keyTable.
        aclsToBeAdded.remove(WRITE);
        // Fetch acls again.
        for (ACLType a2 : aclsToBeAdded) {
            if (!a2.equals(a1)) {
                acls = aclImplementor.getAcl(obj);
                List right = acls.stream().map(a -> a.getAclList()).collect(Collectors.toList());
                assertFalse("Did not expect client to have " + a2 + " acl. " + "Current acls found:" + right + ". Type:" + accessType + "," + " name:" + (accessType == USER ? user : group), nativeAuthorizer.checkAccess(obj, builder.setAclRights(a2).build()));
                // Randomize next type.
                int type = RandomUtils.nextInt(0, 3);
                ACLIdentityType identityType = ACLIdentityType.values()[type];
                // Add remaining acls one by one and then check access.
                OzoneAcl addAcl = new OzoneAcl(identityType, getAclName(identityType), a2, ACCESS);
                // only DB not cache.
                if (obj.getResourceType() == VOLUME) {
                    addVolumeAcl(addAcl);
                } else if (obj.getResourceType() == BUCKET) {
                    addBucketAcl(addAcl);
                } else {
                    aclImplementor.addAcl(obj, addAcl);
                }
                // Fetch acls again.
                acls = aclImplementor.getAcl(obj);
                boolean a2AclFound = false;
                boolean a1AclFound = false;
                for (OzoneAcl acl : acls) {
                    if (acl.getAclList().contains(a2)) {
                        a2AclFound = true;
                    }
                    if (acl.getAclList().contains(a1)) {
                        a1AclFound = true;
                    }
                }
                assertTrue("Current acls :" + acls + ". " + "Type:" + accessType + ", name:" + (accessType == USER ? user : group) + " acl:" + a2, a2AclFound);
                assertTrue("Expected client to have " + a1 + " acl. Current acls " + "found:" + acls + ". Type:" + accessType + ", name:" + (accessType == USER ? user : group), a1AclFound);
                assertEquals("Current acls " + acls + ". Expect acl:" + a2 + " to be set? " + expectedAclResult + " accessType:" + accessType, expectedAclResult, nativeAuthorizer.checkAccess(obj, builder.setAclRights(a2).build()));
                aclsToBeValidated.remove(a2);
                for (ACLType a3 : aclsToBeValidated) {
                    if (!a3.equals(a1) && !a3.equals(a2) && !a3.equals(CREATE)) {
                        assertFalse("User shouldn't have right " + a3 + ". " + "Current acl rights for user:" + a1 + "," + a2, nativeAuthorizer.checkAccess(obj, builder.setAclRights(a3).build()));
                    }
                }
            }
        }
    }
}