Examples with READ org.apache.hadoop.ozone.security.acl.IAccessAuthorizer.ACLType.READ used on opensource projects

Example 1 with READ

use of org.apache.hadoop.ozone.security.acl.IAccessAuthorizer.ACLType.READ in project ozone by apache.

the class TestOzoneRpcClientAbstract method testMultipartUploadWithACL.

@Test
public void testMultipartUploadWithACL() throws Exception {
    String volumeName = UUID.randomUUID().toString();
    String bucketName = UUID.randomUUID().toString();
    String keyName = UUID.randomUUID().toString();
    store.createVolume(volumeName);
    OzoneVolume volume = store.getVolume(volumeName);
    volume.createBucket(bucketName);
    OzoneBucket bucket = volume.getBucket(bucketName);
    // Add ACL on Bucket
    OzoneAcl acl1 = new OzoneAcl(USER, "Monday", ACLType.ALL, DEFAULT);
    OzoneAcl acl2 = new OzoneAcl(USER, "Friday", ACLType.ALL, DEFAULT);
    OzoneAcl acl3 = new OzoneAcl(USER, "Jan", ACLType.ALL, ACCESS);
    OzoneAcl acl4 = new OzoneAcl(USER, "Feb", ACLType.ALL, ACCESS);
    bucket.addAcl(acl1);
    bucket.addAcl(acl2);
    bucket.addAcl(acl3);
    bucket.addAcl(acl4);
    ReplicationConfig replication = RatisReplicationConfig.getInstance(HddsProtos.ReplicationFactor.ONE);
    doMultipartUpload(bucket, keyName, (byte) 98, replication);
    OzoneObj keyObj = OzoneObjInfo.Builder.newBuilder().setBucketName(bucketName).setVolumeName(volumeName).setKeyName(keyName).setResType(OzoneObj.ResourceType.KEY).setStoreType(OzoneObj.StoreType.OZONE).build();
    List<OzoneAcl> aclList = store.getAcl(keyObj);
    // key should inherit bucket's DEFAULT type acl
    Assert.assertTrue(aclList.stream().anyMatch(acl -> acl.getName().equals(acl1.getName())));
    Assert.assertTrue(aclList.stream().anyMatch(acl -> acl.getName().equals(acl2.getName())));
    // kye should not inherit bucket's ACCESS type acl
    Assert.assertFalse(aclList.stream().anyMatch(acl -> acl.getName().equals(acl3.getName())));
    Assert.assertFalse(aclList.stream().anyMatch(acl -> acl.getName().equals(acl4.getName())));
    // User without permission should fail to upload the object
    String userName = "test-user";
    UserGroupInformation remoteUser = UserGroupInformation.createRemoteUser(userName);
    OzoneClient client = remoteUser.doAs((PrivilegedExceptionAction<OzoneClient>) () -> {
        return OzoneClientFactory.getRpcClient(cluster.getConf());
    });
    OzoneAcl acl5 = new OzoneAcl(USER, userName, ACLType.READ, DEFAULT);
    OzoneAcl acl6 = new OzoneAcl(USER, userName, ACLType.READ, ACCESS);
    OzoneObj volumeObj = OzoneObjInfo.Builder.newBuilder().setVolumeName(volumeName).setStoreType(OzoneObj.StoreType.OZONE).setResType(OzoneObj.ResourceType.VOLUME).build();
    OzoneObj bucketObj = OzoneObjInfo.Builder.newBuilder().setVolumeName(volumeName).setBucketName(bucketName).setStoreType(OzoneObj.StoreType.OZONE).setResType(OzoneObj.ResourceType.BUCKET).build();
    store.addAcl(volumeObj, acl5);
    store.addAcl(volumeObj, acl6);
    store.addAcl(bucketObj, acl5);
    store.addAcl(bucketObj, acl6);
    // User without permission cannot start multi-upload
    String keyName2 = UUID.randomUUID().toString();
    OzoneBucket bucket2 = client.getObjectStore().getVolume(volumeName).getBucket(bucketName);
    try {
        initiateMultipartUpload(bucket2, keyName2, anyReplication());
        fail("User without permission should fail");
    } catch (Exception e) {
        assertTrue(e instanceof OMException);
        assertEquals(ResultCodes.PERMISSION_DENIED, ((OMException) e).getResult());
    }
    // Add create permission for user, and try multi-upload init again
    OzoneAcl acl7 = new OzoneAcl(USER, userName, ACLType.CREATE, DEFAULT);
    OzoneAcl acl8 = new OzoneAcl(USER, userName, ACLType.CREATE, ACCESS);
    OzoneAcl acl9 = new OzoneAcl(USER, userName, WRITE, DEFAULT);
    OzoneAcl acl10 = new OzoneAcl(USER, userName, WRITE, ACCESS);
    store.addAcl(volumeObj, acl7);
    store.addAcl(volumeObj, acl8);
    store.addAcl(volumeObj, acl9);
    store.addAcl(volumeObj, acl10);
    store.addAcl(bucketObj, acl7);
    store.addAcl(bucketObj, acl8);
    store.addAcl(bucketObj, acl9);
    store.addAcl(bucketObj, acl10);
    String uploadId = initiateMultipartUpload(bucket2, keyName2, anyReplication());
    // Upload part
    byte[] data = generateData(OzoneConsts.OM_MULTIPART_MIN_SIZE, (byte) 1);
    String partName = uploadPart(bucket, keyName2, uploadId, 1, data);
    Map<Integer, String> partsMap = new TreeMap<>();
    partsMap.put(1, partName);
    // Complete multipart upload request
    completeMultipartUpload(bucket2, keyName2, uploadId, partsMap);
    // User without permission cannot read multi-uploaded object
    try {
        OzoneInputStream inputStream = bucket2.readKey(keyName);
        fail("User without permission should fail");
    } catch (Exception e) {
        assertTrue(e instanceof OMException);
        assertEquals(ResultCodes.PERMISSION_DENIED, ((OMException) e).getResult());
    }
}