Java AccessDeniedException类代码示例

import org.apache.hadoop.hbase.security.AccessDeniedException; //导入依赖的package包/类
/**
 * Authorizes that the current user has any of the given permissions for the
 * given table, column family and column qualifier.
 * @param tableName Table requested
 * @param family Column family requested
 * @param qualifier Column qualifier requested
 * @throws IOException if obtaining the current user fails
 * @throws AccessDeniedException if user has no authorization
 */
private void requirePermission(String request, TableName tableName, byte[] family,
    byte[] qualifier, Action... permissions) throws IOException {
  User user = getActiveUser();
  AuthResult result = null;

  for (Action permission : permissions) {
    if (authManager.authorize(user, tableName, family, qualifier, permission)) {
      result = AuthResult.allow(request, "Table permission granted", user,
                                permission, tableName, family, qualifier);
      break;
    } else {
      // rest of the world
      result = AuthResult.deny(request, "Insufficient permissions", user,
                               permission, tableName, family, qualifier);
    }
  }
  logResult(result);
  if (authorizationEnabled && !result.isAllowed()) {
    throw new AccessDeniedException("Insufficient permissions " + result.toContextString());
  }
}
 

import org.apache.hadoop.hbase.security.AccessDeniedException; //导入依赖的package包/类
/**
 * Authorizes that the current user has any of the given permissions for the
 * given table, column family and column qualifier.
 * @param tableName Table requested
 * @param family Column family param
 * @param qualifier Column qualifier param
 * @throws IOException if obtaining the current user fails
 * @throws AccessDeniedException if user has no authorization
 */
private void requireTablePermission(String request, TableName tableName, byte[] family,
    byte[] qualifier, Action... permissions) throws IOException {
  User user = getActiveUser();
  AuthResult result = null;

  for (Action permission : permissions) {
    if (authManager.authorize(user, tableName, null, null, permission)) {
      result = AuthResult.allow(request, "Table permission granted", user,
          permission, tableName, null, null);
      result.getParams().setFamily(family).setQualifier(qualifier);
      break;
    } else {
      // rest of the world
      result = AuthResult.deny(request, "Insufficient permissions", user,
          permission, tableName, family, qualifier);
      result.getParams().setFamily(family).setQualifier(qualifier);
    }
  }
  logResult(result);
  if (authorizationEnabled && !result.isAllowed()) {
    throw new AccessDeniedException("Insufficient permissions " + result.toContextString());
  }
}
 

import org.apache.hadoop.hbase.security.AccessDeniedException; //导入依赖的package包/类
/**
 * Checks that the user has the given global permission. The generated
 * audit log message will contain context information for the operation
 * being authorized, based on the given parameters.
 * @param perm Action being requested
 * @param tableName Affected table name.
 * @param familyMap Affected column families.
 */
private void requireGlobalPermission(String request, Action perm, TableName tableName,
    Map<byte[], ? extends Collection<byte[]>> familyMap) throws IOException {
  User user = getActiveUser();
  AuthResult result = null;
  if (authManager.authorize(user, perm)) {
    result = AuthResult.allow(request, "Global check allowed", user, perm, tableName, familyMap);
    result.getParams().setTableName(tableName).setFamilies(familyMap);
    logResult(result);
  } else {
    result = AuthResult.deny(request, "Global check failed", user, perm, tableName, familyMap);
    result.getParams().setTableName(tableName).setFamilies(familyMap);
    logResult(result);
    if (authorizationEnabled) {
      throw new AccessDeniedException("Insufficient permissions for user '" +
        (user != null ? user.getShortName() : "null") +"' (global, action=" +
        perm.toString() + ")");
    }
  }
}
 

import org.apache.hadoop.hbase.security.AccessDeniedException; //导入依赖的package包/类
/**
 * Checks that the user has the given global or namespace permission.
 * @param namespace
 * @param permissions Actions being requested
 */
public void requireNamespacePermission(String request, String namespace,
    Action... permissions) throws IOException {
  User user = getActiveUser();
  AuthResult result = null;

  for (Action permission : permissions) {
    if (authManager.authorize(user, namespace, permission)) {
      result = AuthResult.allow(request, "Namespace permission granted",
          user, permission, namespace);
      break;
    } else {
      // rest of the world
      result = AuthResult.deny(request, "Insufficient permissions", user,
          permission, namespace);
    }
  }
  logResult(result);
  if (authorizationEnabled && !result.isAllowed()) {
    throw new AccessDeniedException("Insufficient permissions "
        + result.toContextString());
  }
}
 

import org.apache.hadoop.hbase.security.AccessDeniedException; //导入依赖的package包/类
@Override
public void postListProcedures(
    ObserverContext<MasterCoprocessorEnvironment> ctx,
    List<ProcedureInfo> procInfoList) throws IOException {
  if (procInfoList.isEmpty()) {
    return;
  }

  // Retains only those which passes authorization checks, as the checks weren't done as part
  // of preListProcedures.
  Iterator<ProcedureInfo> itr = procInfoList.iterator();
  User user = getActiveUser();
  while (itr.hasNext()) {
    ProcedureInfo procInfo = itr.next();
    try {
      if (!ProcedureInfo.isProcedureOwner(procInfo, user)) {
        // If the user is not the procedure owner, then we should further probe whether
        // he can see the procedure.
        requirePermission("listProcedures", Action.ADMIN);
      }
    } catch (AccessDeniedException e) {
      itr.remove();
    }
  }
}
 

import org.apache.hadoop.hbase.security.AccessDeniedException; //导入依赖的package包/类
@Override
public boolean preCheckAndPutAfterRowLock(final ObserverContext<RegionCoprocessorEnvironment> c,
    final byte[] row, final byte[] family, final byte[] qualifier,
    final CompareFilter.CompareOp compareOp, final ByteArrayComparable comparator, final Put put,
    final boolean result) throws IOException {
  if (put.getAttribute(CHECK_COVERING_PERM) != null) {
    // We had failure with table, cf and q perm checks and now giving a chance for cell
    // perm check
    TableName table = c.getEnvironment().getRegion().getRegionInfo().getTable();
    Map<byte[], ? extends Collection<byte[]>> families = makeFamilyMap(family, qualifier);
    AuthResult authResult = null;
    if (checkCoveringPermission(OpType.CHECK_AND_PUT, c.getEnvironment(), row, families,
        HConstants.LATEST_TIMESTAMP, Action.READ)) {
      authResult = AuthResult.allow(OpType.CHECK_AND_PUT.toString(), "Covering cell set",
          getActiveUser(), Action.READ, table, families);
    } else {
      authResult = AuthResult.deny(OpType.CHECK_AND_PUT.toString(), "Covering cell set",
          getActiveUser(), Action.READ, table, families);
    }
    logResult(authResult);
    if (authorizationEnabled && !authResult.isAllowed()) {
      throw new AccessDeniedException("Insufficient permissions " + authResult.toContextString());
    }
  }
  return result;
}
 

import org.apache.hadoop.hbase.security.AccessDeniedException; //导入依赖的package包/类
@Override
public long preIncrementColumnValue(final ObserverContext<RegionCoprocessorEnvironment> c,
    final byte [] row, final byte [] family, final byte [] qualifier,
    final long amount, final boolean writeToWAL)
    throws IOException {
  // Require WRITE permission to the table, CF, and the KV to be replaced by the
  // incremented value
  RegionCoprocessorEnvironment env = c.getEnvironment();
  Map<byte[],? extends Collection<byte[]>> families = makeFamilyMap(family, qualifier);
  User user = getActiveUser();
  AuthResult authResult = permissionGranted(OpType.INCREMENT_COLUMN_VALUE, user, env, families,
    Action.WRITE);
  if (!authResult.isAllowed() && cellFeaturesEnabled && !compatibleEarlyTermination) {
    authResult.setAllowed(checkCoveringPermission(OpType.INCREMENT_COLUMN_VALUE, env, row,
      families, HConstants.LATEST_TIMESTAMP, Action.WRITE));
    authResult.setReason("Covering cell set");
  }
  logResult(authResult);
  if (authorizationEnabled && !authResult.isAllowed()) {
    throw new AccessDeniedException("Insufficient permissions " + authResult.toContextString());
  }
  return -1;
}
 

import org.apache.hadoop.hbase.security.AccessDeniedException; //导入依赖的package包/类
@Override
public Result preAppendAfterRowLock(final ObserverContext<RegionCoprocessorEnvironment> c,
    final Append append) throws IOException {
  if (append.getAttribute(CHECK_COVERING_PERM) != null) {
    // We had failure with table, cf and q perm checks and now giving a chance for cell
    // perm check
    TableName table = c.getEnvironment().getRegion().getRegionInfo().getTable();
    AuthResult authResult = null;
    if (checkCoveringPermission(OpType.APPEND, c.getEnvironment(), append.getRow(),
        append.getFamilyCellMap(), HConstants.LATEST_TIMESTAMP, Action.WRITE)) {
      authResult = AuthResult.allow(OpType.APPEND.toString(), "Covering cell set",
          getActiveUser(), Action.WRITE, table, append.getFamilyCellMap());
    } else {
      authResult = AuthResult.deny(OpType.APPEND.toString(), "Covering cell set",
          getActiveUser(), Action.WRITE, table, append.getFamilyCellMap());
    }
    logResult(authResult);
    if (authorizationEnabled && !authResult.isAllowed()) {
      throw new AccessDeniedException("Insufficient permissions " +
        authResult.toContextString());
    }
  }
  return null;
}
 

import org.apache.hadoop.hbase.security.AccessDeniedException; //导入依赖的package包/类
@Override
public Result preIncrementAfterRowLock(final ObserverContext<RegionCoprocessorEnvironment> c,
    final Increment increment) throws IOException {
  if (increment.getAttribute(CHECK_COVERING_PERM) != null) {
    // We had failure with table, cf and q perm checks and now giving a chance for cell
    // perm check
    TableName table = c.getEnvironment().getRegion().getRegionInfo().getTable();
    AuthResult authResult = null;
    if (checkCoveringPermission(OpType.INCREMENT, c.getEnvironment(), increment.getRow(),
        increment.getFamilyCellMap(), increment.getTimeRange().getMax(), Action.WRITE)) {
      authResult = AuthResult.allow(OpType.INCREMENT.toString(), "Covering cell set",
          getActiveUser(), Action.WRITE, table, increment.getFamilyCellMap());
    } else {
      authResult = AuthResult.deny(OpType.INCREMENT.toString(), "Covering cell set",
          getActiveUser(), Action.WRITE, table, increment.getFamilyCellMap());
    }
    logResult(authResult);
    if (authorizationEnabled && !authResult.isAllowed()) {
      throw new AccessDeniedException("Insufficient permissions " +
        authResult.toContextString());
    }
  }
  return null;
}
 

import org.apache.hadoop.hbase.security.AccessDeniedException; //导入依赖的package包/类
@Override
public void postGetTableDescriptors(ObserverContext<MasterCoprocessorEnvironment> ctx,
    List<TableName> tableNamesList, List<HTableDescriptor> descriptors,
    String regex) throws IOException {
  // Skipping as checks in this case are already done by preGetTableDescriptors.
  if (regex == null && tableNamesList != null && !tableNamesList.isEmpty()) {
    return;
  }

  // Retains only those which passes authorization checks, as the checks weren't done as part
  // of preGetTableDescriptors.
  Iterator<HTableDescriptor> itr = descriptors.iterator();
  while (itr.hasNext()) {
    HTableDescriptor htd = itr.next();
    try {
      requirePermission("getTableDescriptors", htd.getTableName(), null, null,
          Action.ADMIN, Action.CREATE);
    } catch (AccessDeniedException e) {
      itr.remove();
    }
  }
}
 

import org.apache.hadoop.hbase.security.AccessDeniedException; //导入依赖的package包/类
/**
 * Throw an exception if an action is not permitted by a user on a file.
 *
 * @param ugi
 *          the user
 * @param file
 *          the file
 * @param action
 *          the action
 */
public static void checkAccess(UserGroupInformation ugi, FileStatus file,
    FsAction action) throws AccessDeniedException {
  if (ugi.getShortUserName().equals(file.getOwner())) {
    if (file.getPermission().getUserAction().implies(action)) {
      return;
    }
  } else if (contains(ugi.getGroupNames(), file.getGroup())) {
    if (file.getPermission().getGroupAction().implies(action)) {
      return;
    }
  } else if (file.getPermission().getOtherAction().implies(action)) {
    return;
  }
  throw new AccessDeniedException("Permission denied:" + " action=" + action
      + " path=" + file.getPath() + " user=" + ugi.getShortUserName());
}
 

import org.apache.hadoop.hbase.security.AccessDeniedException; //导入依赖的package包/类
private void preCheckPermission() throws IOException, AccessDeniedException {
  if (shouldIgnorePreCheckPermission()) {
    return;
  }

  Path hbaseDir = FSUtils.getRootDir(getConf());
  FileSystem fs = hbaseDir.getFileSystem(getConf());
  UserProvider userProvider = UserProvider.instantiate(getConf());
  UserGroupInformation ugi = userProvider.getCurrent().getUGI();
  FileStatus[] files = fs.listStatus(hbaseDir);
  for (FileStatus file : files) {
    try {
      FSUtils.checkAccess(ugi, file, FsAction.WRITE);
    } catch (AccessDeniedException ace) {
      LOG.warn("Got AccessDeniedException when preCheckPermission ", ace);
      errors.reportError(ERROR_CODE.WRONG_USAGE, "Current user " + ugi.getUserName()
        + " does not have write perms to " + file.getPath()
        + ". Please rerun hbck as hdfs user " + file.getOwner());
      throw ace;
    }
  }
}
 

import org.apache.hadoop.hbase.security.AccessDeniedException; //导入依赖的package包/类
private UserGroupInformation getAuthorizedUgi(String authorizedId)
    throws IOException {
  UserGroupInformation authorizedUgi;
  if (authMethod == AuthMethod.DIGEST) {
    TokenIdentifier tokenId = HBaseSaslRpcServer.getIdentifier(authorizedId,
        secretManager);
    authorizedUgi = tokenId.getUser();
    if (authorizedUgi == null) {
      throw new AccessDeniedException(
          "Can't retrieve username from tokenIdentifier.");
    }
    authorizedUgi.addTokenIdentifier(tokenId);
  } else {
    authorizedUgi = UserGroupInformation.createRemoteUser(authorizedId);
  }
  authorizedUgi.setAuthenticationMethod(authMethod.authenticationMethod.getAuthMethod());
  return authorizedUgi;
}
 

import org.apache.hadoop.hbase.security.AccessDeniedException; //导入依赖的package包/类
private boolean authorizeConnection() throws IOException {
  try {
    // If auth method is DIGEST, the token was obtained by the
    // real user for the effective user, therefore not required to
    // authorize real user. doAs is allowed only for simple or kerberos
    // authentication
    if (ugi != null && ugi.getRealUser() != null
        && (authMethod != AuthMethod.DIGEST)) {
      ProxyUsers.authorize(ugi, this.getHostAddress(), conf);
    }
    authorize(ugi, connectionHeader, getHostInetAddress());
    metrics.authorizationSuccess();
  } catch (AuthorizationException ae) {
    if (LOG.isDebugEnabled()) {
      LOG.debug("Connection authorization failed: " + ae.getMessage(), ae);
    }
    metrics.authorizationFailure();
    setupResponse(authFailedResponse, authFailedCall,
      new AccessDeniedException(ae), ae.getMessage());
    responder.doRespond(authFailedCall);
    return false;
  }
  return true;
}
 

import org.apache.hadoop.hbase.security.AccessDeniedException; //导入依赖的package包/类
private void testTokenAuth(Class<? extends RpcClient> rpcImplClass) throws IOException,
    ServiceException {
  TEST_UTIL.getConfiguration().set(RpcClientFactory.CUSTOM_RPC_CLIENT_IMPL_CONF_KEY,
    rpcImplClass.getName());
  try (Connection conn = ConnectionFactory.createConnection(TEST_UTIL.getConfiguration());
      Table table = conn.getTable(TableName.META_TABLE_NAME)) {
    CoprocessorRpcChannel rpcChannel = table.coprocessorService(HConstants.EMPTY_START_ROW);
    AuthenticationProtos.AuthenticationService.BlockingInterface service =
        AuthenticationProtos.AuthenticationService.newBlockingStub(rpcChannel);
    WhoAmIResponse response = service.whoAmI(null, WhoAmIRequest.getDefaultInstance());
    assertEquals(USERNAME, response.getUsername());
    assertEquals(AuthenticationMethod.TOKEN.name(), response.getAuthMethod());
    try {
      service.getAuthenticationToken(null, GetAuthenticationTokenRequest.getDefaultInstance());
    } catch (ServiceException e) {
      AccessDeniedException exc = (AccessDeniedException) ProtobufUtil.getRemoteException(e);
      assertTrue(exc.getMessage().contains(
        "Token generation only allowed for Kerberos authenticated clients"));
    }
  }
}