Examples with AuthorizationException org.apache.hadoop.security.authorize.AuthorizationException used on opensource projects

Example 61 with AuthorizationException

use of org.apache.hadoop.security.authorize.AuthorizationException in project testcases by coheigea.

the class RangerKmsAuthorizerTest method testDeleteKeys.

@org.junit.Test
public void testDeleteKeys() throws Throwable {
    // bob should have permission to delete
    final UserGroupInformation ugi = UserGroupInformation.createRemoteUser("bob");
    ugi.doAs(new PrivilegedExceptionAction<Void>() {

        public Void run() throws Exception {
            KMSWebApp.getACLs().assertAccess(Type.DELETE, ugi, KMSOp.DELETE_KEY, "newkey1", "127.0.0.1");
            return null;
        }
    });
    // "eve" should not have permission to delete
    final UserGroupInformation ugi2 = UserGroupInformation.createRemoteUser("eve");
    ugi2.doAs(new PrivilegedExceptionAction<Void>() {

        public Void run() throws Exception {
            try {
                KMSWebApp.getACLs().assertAccess(Type.DELETE, ugi2, KMSOp.DELETE_KEY, "newkey1", "127.0.0.1");
                Assert.fail("Failure expected");
            } catch (AuthorizationException ex) {
            // expected
            }
            return null;
        }
    });
    // the IT group should not have permission to delete
    final UserGroupInformation ugi3 = UserGroupInformation.createUserForTesting("alice", new String[] { "IT" });
    ugi3.doAs(new PrivilegedExceptionAction<Void>() {

        public Void run() throws Exception {
            try {
                KMSWebApp.getACLs().assertAccess(Type.DELETE, ugi3, KMSOp.DELETE_KEY, "newkey1", "127.0.0.1");
                Assert.fail("Failure expected");
            } catch (AuthorizationException ex) {
            // expected
            }
            return null;
        }
    });
}

Example 62 with AuthorizationException

use of org.apache.hadoop.security.authorize.AuthorizationException in project testcases by coheigea.

the class RangerKmsAuthorizerTest method testDecryptEEK.

@org.junit.Test
public void testDecryptEEK() throws Throwable {
    // bob should have permission to generate EEK
    final UserGroupInformation ugi = UserGroupInformation.createRemoteUser("bob");
    ugi.doAs(new PrivilegedExceptionAction<Void>() {

        public Void run() throws Exception {
            KMSWebApp.getACLs().assertAccess(Type.DECRYPT_EEK, ugi, KMSOp.DECRYPT_EEK, "newkey1", "127.0.0.1");
            return null;
        }
    });
    // "eve" should not have permission to decrypt EEK
    final UserGroupInformation ugi2 = UserGroupInformation.createRemoteUser("eve");
    ugi2.doAs(new PrivilegedExceptionAction<Void>() {

        public Void run() throws Exception {
            try {
                KMSWebApp.getACLs().assertAccess(Type.DECRYPT_EEK, ugi2, KMSOp.DECRYPT_EEK, "newkey1", "127.0.0.1");
                Assert.fail("Failure expected");
            } catch (AuthorizationException ex) {
            // expected
            }
            return null;
        }
    });
    // the IT group should not have permission to decrypt EEK
    final UserGroupInformation ugi3 = UserGroupInformation.createUserForTesting("alice", new String[] { "IT" });
    ugi3.doAs(new PrivilegedExceptionAction<Void>() {

        public Void run() throws Exception {
            try {
                KMSWebApp.getACLs().assertAccess(Type.DECRYPT_EEK, ugi3, KMSOp.DECRYPT_EEK, "newkey1", "127.0.0.1");
                Assert.fail("Failure expected");
            } catch (AuthorizationException ex) {
            // expected
            }
            return null;
        }
    });
}

Example 63 with AuthorizationException

use of org.apache.hadoop.security.authorize.AuthorizationException in project oozie by apache.

the class TestHadoopAccessorService method testCreateYarnClient.

public void testCreateYarnClient() throws Exception {
    HadoopAccessorService has = Services.get().get(HadoopAccessorService.class);
    Configuration conf = has.createConfiguration(getJobTrackerUri());
    YarnClient yc = has.createYarnClient(getTestUser(), conf);
    assertNotNull(yc);
    yc.getApplications();
    try {
        yc = has.createYarnClient("invalid-user", conf);
        assertNotNull(yc);
        yc.getApplications();
        fail("Should have thrown exception because not allowed to impersonate 'invalid-user'");
    } catch (AuthorizationException ex) {
    }
    JobConf conf2 = new JobConf(false);
    conf2.set("yarn.resourcemanager.address", getJobTrackerUri());
    try {
        has.createYarnClient(getTestUser(), conf2);
        fail("Should have thrown exception because Configuration not created by HadoopAccessorService");
    } catch (HadoopAccessorException ex) {
        assertEquals(ErrorCode.E0903, ex.getErrorCode());
    }
}

Example 64 with AuthorizationException

use of org.apache.hadoop.security.authorize.AuthorizationException in project ranger by apache.

the class KeyAuthorizationKeyProvider method authorizeCreateKey.

// This method first checks if "key.acl.name" attribute is present as an
// attribute in the provider Options. If yes, use the aclName for any
// subsequent access checks, else use the keyName as the aclName and set it
// as the value of the "key.acl.name" in the key's metadata.
private void authorizeCreateKey(String keyName, Options options, UserGroupInformation ugi) throws IOException {
    Preconditions.checkNotNull(ugi, "UserGroupInformation cannot be null");
    Map<String, String> attributes = options.getAttributes();
    String aclName = attributes.get(KEY_ACL_NAME);
    boolean success = false;
    if (Strings.isNullOrEmpty(aclName)) {
        if (acls.isACLPresent(keyName, KeyOpType.MANAGEMENT)) {
            options.setAttributes(ImmutableMap.<String, String>builder().putAll(attributes).put(KEY_ACL_NAME, keyName).build());
            success = acls.hasAccessToKey(keyName, ugi, KeyOpType.MANAGEMENT) || acls.hasAccessToKey(keyName, ugi, KeyOpType.ALL);
        } else {
            success = false;
        }
    } else {
        success = acls.isACLPresent(aclName, KeyOpType.MANAGEMENT) && (acls.hasAccessToKey(aclName, ugi, KeyOpType.MANAGEMENT) || acls.hasAccessToKey(aclName, ugi, KeyOpType.ALL));
    }
    if (!success)
        throw new AuthorizationException(String.format("User [%s] is not" + " authorized to create key !!", ugi.getShortUserName()));
}

Example 65 with AuthorizationException

use of org.apache.hadoop.security.authorize.AuthorizationException in project ranger by apache.

the class RangerKmsAuthorizerTest method testDecryptEEK.

@Test
public void testDecryptEEK() throws Throwable {
    if (!UNRESTRICTED_POLICIES_INSTALLED) {
        return;
    }
    // bob should have permission to generate EEK
    final UserGroupInformation ugi = UserGroupInformation.createRemoteUser("bob");
    ugi.doAs(new PrivilegedExceptionAction<Void>() {

        public Void run() throws Exception {
            KMSWebApp.getACLs().assertAccess(Type.DECRYPT_EEK, ugi, KMSOp.DECRYPT_EEK, "newkey1", "127.0.0.1");
            return null;
        }
    });
    // "eve" should not have permission to decrypt EEK
    final UserGroupInformation ugi2 = UserGroupInformation.createRemoteUser("eve");
    ugi2.doAs(new PrivilegedExceptionAction<Void>() {

        public Void run() throws Exception {
            try {
                KMSWebApp.getACLs().assertAccess(Type.DECRYPT_EEK, ugi2, KMSOp.DECRYPT_EEK, "newkey1", "127.0.0.1");
                Assert.fail("Failure expected");
            } catch (AuthorizationException ex) {
                LOG.error("", ex);
            }
            return null;
        }
    });
    // the IT group should not have permission to decrypt EEK
    final UserGroupInformation ugi3 = UserGroupInformation.createUserForTesting("alice", new String[] { "IT" });
    ugi3.doAs(new PrivilegedExceptionAction<Void>() {

        public Void run() throws Exception {
            try {
                KMSWebApp.getACLs().assertAccess(Type.DECRYPT_EEK, ugi3, KMSOp.DECRYPT_EEK, "newkey1", "127.0.0.1");
                Assert.fail("Failure expected");
            } catch (AuthorizationException ex) {
                LOG.error("", ex);
            }
            return null;
        }
    });
}