Java User类代码示例

import org.apache.hadoop.hbase.security.User; //导入依赖的package包/类
/**
 * Authorizes that the current user has any of the given permissions for the
 * given table, column family and column qualifier.
 * @param tableName Table requested
 * @param family Column family requested
 * @param qualifier Column qualifier requested
 * @throws IOException if obtaining the current user fails
 * @throws AccessDeniedException if user has no authorization
 */
private void requirePermission(String request, TableName tableName, byte[] family,
    byte[] qualifier, Action... permissions) throws IOException {
  User user = getActiveUser();
  AuthResult result = null;

  for (Action permission : permissions) {
    if (authManager.authorize(user, tableName, family, qualifier, permission)) {
      result = AuthResult.allow(request, "Table permission granted", user,
                                permission, tableName, family, qualifier);
      break;
    } else {
      // rest of the world
      result = AuthResult.deny(request, "Insufficient permissions", user,
                               permission, tableName, family, qualifier);
    }
  }
  logResult(result);
  if (authorizationEnabled && !result.isAllowed()) {
    throw new AccessDeniedException("Insufficient permissions " + result.toContextString());
  }
}
 

import org.apache.hadoop.hbase.security.User; //导入依赖的package包/类
private void verifyUserAllowedforCheckAndDelete(final User user, final byte[] row,
    final byte[] q1, final byte[] value) throws IOException, InterruptedException {
  user.runAs(new PrivilegedExceptionAction<Void>() {
    @Override
    public Void run() throws Exception {
      try (Connection connection = ConnectionFactory.createConnection(conf)) {
        try (Table t = connection.getTable(TEST_TABLE.getTableName())) {
          Delete d = new Delete(row);
          d.addColumn(TEST_FAMILY1, q1, 120);
          t.checkAndDelete(row, TEST_FAMILY1, q1, value, d);
        }
      }
      return null;
    }
  });
}
 

import org.apache.hadoop.hbase.security.User; //导入依赖的package包/类
private void verifyUserDeniedForDeleteMultipleVersions(final User user, final byte[] row,
    final byte[] q1, final byte[] q2) throws IOException, InterruptedException {
  user.runAs(new PrivilegedExceptionAction<Void>() {
    @Override
    public Void run() throws Exception {
      try (Connection connection = ConnectionFactory.createConnection(conf)) {
        try (Table t = connection.getTable(TEST_TABLE.getTableName())) {
          Delete d = new Delete(row);
          d.addColumns(TEST_FAMILY1, q1);
          d.addColumns(TEST_FAMILY1, q2);
          t.delete(d);
          fail(user.getShortName() + " should not be allowed to delete the row");
        } catch (Exception e) {

        }
      }
      return null;
    }
  });
}
 

import org.apache.hadoop.hbase.security.User; //导入依赖的package包/类
private void verifyUserDeniedForCheckAndDelete(final User user, final byte[] row,
    final byte[] value) throws IOException, InterruptedException {
  user.runAs(new PrivilegedExceptionAction<Void>() {
    @Override
    public Void run() throws Exception {
      try (Connection connection = ConnectionFactory.createConnection(conf)) {
        try (Table t = connection.getTable(TEST_TABLE.getTableName())) {
          Delete d = new Delete(row);
          d.addColumns(TEST_FAMILY1, TEST_Q1);
          t.checkAndDelete(row, TEST_FAMILY1, TEST_Q1, value, d);
          fail(user.getShortName() + " should not be allowed to do checkAndDelete");
        } catch (Exception e) {
        }
      }
      return null;
    }
  });
}
 

import org.apache.hadoop.hbase.security.User; //导入依赖的package包/类
/**
 * This method clones the passed <code>c</code> configuration setting a new
 * user into the clone.  Use it getting new instances of FileSystem.  Only
 * works for DistributedFileSystem w/o Kerberos.
 * @param c Initial configuration
 * @param differentiatingSuffix Suffix to differentiate this user from others.
 * @return A new configuration instance with a different user set into it.
 * @throws IOException
 */
public static User getDifferentUser(final Configuration c,
  final String differentiatingSuffix)
throws IOException {
  FileSystem currentfs = FileSystem.get(c);
  if (!(currentfs instanceof DistributedFileSystem) || User.isHBaseSecurityEnabled(c)) {
    return User.getCurrent();
  }
  // Else distributed filesystem.  Make a new instance per daemon.  Below
  // code is taken from the AppendTestUtil over in hdfs.
  String username = User.getCurrent().getName() +
    differentiatingSuffix;
  User user = User.createUserForTesting(c, username,
      new String[]{"supergroup"});
  return user;
}
 

import org.apache.hadoop.hbase.security.User; //导入依赖的package包/类
HConnectionKey(Configuration conf) {
  Map<String, String> m = new HashMap<String, String>();
  if (conf != null) {
    for (String property : CONNECTION_PROPERTIES) {
      String value = conf.get(property);
      if (value != null) {
        m.put(property, value);
      }
    }
  }
  this.properties = Collections.unmodifiableMap(m);

  try {
    UserProvider provider = UserProvider.instantiate(conf);
    User currentUser = provider.getCurrent();
    if (currentUser != null) {
      username = currentUser.getName();
    }
  } catch (IOException ioe) {
    ConnectionManager.LOG.warn(
        "Error obtaining current user, skipping username in HConnectionKey", ioe);
  }
}
 

import org.apache.hadoop.hbase.security.User; //导入依赖的package包/类
/**
 * Authorizes that the current user has any of the given permissions for the
 * given table, column family and column qualifier.
 * @param tableName Table requested
 * @param family Column family param
 * @param qualifier Column qualifier param
 * @throws IOException if obtaining the current user fails
 * @throws AccessDeniedException if user has no authorization
 */
private void requireTablePermission(String request, TableName tableName, byte[] family,
    byte[] qualifier, Action... permissions) throws IOException {
  User user = getActiveUser();
  AuthResult result = null;

  for (Action permission : permissions) {
    if (authManager.authorize(user, tableName, null, null, permission)) {
      result = AuthResult.allow(request, "Table permission granted", user,
          permission, tableName, null, null);
      result.getParams().setFamily(family).setQualifier(qualifier);
      break;
    } else {
      // rest of the world
      result = AuthResult.deny(request, "Insufficient permissions", user,
          permission, tableName, family, qualifier);
      result.getParams().setFamily(family).setQualifier(qualifier);
    }
  }
  logResult(result);
  if (authorizationEnabled && !result.isAllowed()) {
    throw new AccessDeniedException("Insufficient permissions " + result.toContextString());
  }
}
 

import org.apache.hadoop.hbase.security.User; //导入依赖的package包/类
/**
 * Checks that the user has the given global permission. The generated
 * audit log message will contain context information for the operation
 * being authorized, based on the given parameters.
 * @param perm Action being requested
 * @param tableName Affected table name.
 * @param familyMap Affected column families.
 */
private void requireGlobalPermission(String request, Action perm, TableName tableName,
    Map<byte[], ? extends Collection<byte[]>> familyMap) throws IOException {
  User user = getActiveUser();
  AuthResult result = null;
  if (authManager.authorize(user, perm)) {
    result = AuthResult.allow(request, "Global check allowed", user, perm, tableName, familyMap);
    result.getParams().setTableName(tableName).setFamilies(familyMap);
    logResult(result);
  } else {
    result = AuthResult.deny(request, "Global check failed", user, perm, tableName, familyMap);
    result.getParams().setTableName(tableName).setFamilies(familyMap);
    logResult(result);
    if (authorizationEnabled) {
      throw new AccessDeniedException("Insufficient permissions for user '" +
        (user != null ? user.getShortName() : "null") +"' (global, action=" +
        perm.toString() + ")");
    }
  }
}
 

import org.apache.hadoop.hbase.security.User; //导入依赖的package包/类
/**
 * Obtain an authentication token for the given user and add it to the
 * user's credentials.
 * @param conn The HBase cluster connection
 * @param user The user for whom to obtain the token
 * @throws IOException If making a remote call to the authentication service fails
 * @throws InterruptedException If executing as the given user is interrupted
 */
public static void obtainAndCacheToken(final Connection conn,
    User user)
    throws IOException, InterruptedException {
  try {
    Token<AuthenticationTokenIdentifier> token = obtainToken(conn, user);

    if (token == null) {
      throw new IOException("No token returned for user " + user.getName());
    }
    if (LOG.isDebugEnabled()) {
      LOG.debug("Obtained token " + token.getKind().toString() + " for user " +
          user.getName());
    }
    user.addToken(token);
  } catch (IOException ioe) {
    throw ioe;
  } catch (InterruptedException ie) {
    throw ie;
  } catch (RuntimeException re) {
    throw re;
  } catch (Exception e) {
    throw new UndeclaredThrowableException(e,
        "Unexpected exception obtaining token for user " + user.getName());
  }
}
 

import org.apache.hadoop.hbase.security.User; //导入依赖的package包/类
/**
 * Checks that the user has the given global or namespace permission.
 * @param namespace
 * @param permissions Actions being requested
 */
public void requireNamespacePermission(String request, String namespace, TableName tableName,
    Map<byte[], ? extends Collection<byte[]>> familyMap, Action... permissions)
    throws IOException {
  User user = getActiveUser();
  AuthResult result = null;

  for (Action permission : permissions) {
    if (authManager.authorize(user, namespace, permission)) {
      result = AuthResult.allow(request, "Namespace permission granted",
          user, permission, namespace);
      result.getParams().setTableName(tableName).setFamilies(familyMap);
      break;
    } else {
      // rest of the world
      result = AuthResult.deny(request, "Insufficient permissions", user,
          permission, namespace);
      result.getParams().setTableName(tableName).setFamilies(familyMap);
    }
  }
  logResult(result);
  if (authorizationEnabled && !result.isAllowed()) {
    throw new AccessDeniedException("Insufficient permissions "
        + result.toContextString());
  }
}
 

import org.apache.hadoop.hbase.security.User; //导入依赖的package包/类
@Override
public void preTruncateTable(ObserverContext<MasterCoprocessorEnvironment> c,
    final TableName tableName) throws IOException {
  requirePermission("truncateTable", tableName, null, null, Action.ADMIN, Action.CREATE);

  final Configuration conf = c.getEnvironment().getConfiguration();
  User.runAsLoginUser(new PrivilegedExceptionAction<Void>() {
    @Override
    public Void run() throws Exception {
      List<UserPermission> acls = AccessControlLists.getUserTablePermissions(conf, tableName);
      if (acls != null) {
        tableAcls.put(tableName, acls);
      }
      return null;
    }
  });
}
 

import org.apache.hadoop.hbase.security.User; //导入依赖的package包/类
@Override
public void postTruncateTable(ObserverContext<MasterCoprocessorEnvironment> ctx,
    final TableName tableName) throws IOException {
  final Configuration conf = ctx.getEnvironment().getConfiguration();
  User.runAsLoginUser(new PrivilegedExceptionAction<Void>() {
    @Override
    public Void run() throws Exception {
      List<UserPermission> perms = tableAcls.get(tableName);
      if (perms != null) {
        for (UserPermission perm : perms) {
          AccessControlLists.addUserPermission(conf, perm);
        }
      }
      tableAcls.remove(tableName);
      return null;
    }
  });
}
 

import org.apache.hadoop.hbase.security.User; //导入依赖的package包/类
@Override
public void postListProcedures(
    ObserverContext<MasterCoprocessorEnvironment> ctx,
    List<ProcedureInfo> procInfoList) throws IOException {
  if (procInfoList.isEmpty()) {
    return;
  }

  // Retains only those which passes authorization checks, as the checks weren't done as part
  // of preListProcedures.
  Iterator<ProcedureInfo> itr = procInfoList.iterator();
  User user = getActiveUser();
  while (itr.hasNext()) {
    ProcedureInfo procInfo = itr.next();
    try {
      if (!ProcedureInfo.isProcedureOwner(procInfo, user)) {
        // If the user is not the procedure owner, then we should further probe whether
        // he can see the procedure.
        requirePermission("listProcedures", Action.ADMIN);
      }
    } catch (AccessDeniedException e) {
      itr.remove();
    }
  }
}
 

import org.apache.hadoop.hbase.security.User; //导入依赖的package包/类
@Override
public long preIncrementColumnValue(final ObserverContext<RegionCoprocessorEnvironment> c,
    final byte [] row, final byte [] family, final byte [] qualifier,
    final long amount, final boolean writeToWAL)
    throws IOException {
  // Require WRITE permission to the table, CF, and the KV to be replaced by the
  // incremented value
  RegionCoprocessorEnvironment env = c.getEnvironment();
  Map<byte[],? extends Collection<byte[]>> families = makeFamilyMap(family, qualifier);
  User user = getActiveUser();
  AuthResult authResult = permissionGranted(OpType.INCREMENT_COLUMN_VALUE, user, env, families,
    Action.WRITE);
  if (!authResult.isAllowed() && cellFeaturesEnabled && !compatibleEarlyTermination) {
    authResult.setAllowed(checkCoveringPermission(OpType.INCREMENT_COLUMN_VALUE, env, row,
      families, HConstants.LATEST_TIMESTAMP, Action.WRITE));
    authResult.setReason("Covering cell set");
  }
  logResult(authResult);
  if (authorizationEnabled && !authResult.isAllowed()) {
    throw new AccessDeniedException("Insufficient permissions " + authResult.toContextString());
  }
  return -1;
}
 

import org.apache.hadoop.hbase.security.User; //导入依赖的package包/类
/**
 * Constructor for netty RPC channel
 *
 * @param bootstrap to construct channel on
 * @param client    to connect with
 * @param ticket of user which uses connection
 *               @param serviceName name of service to connect to
 * @param address to connect to
 */
public AsyncRpcChannel(Bootstrap bootstrap, final AsyncRpcClient client, User ticket, String
    serviceName, InetSocketAddress address) {
  this.client = client;

  this.ticket = ticket;
  this.serviceName = serviceName;
  this.address = address;

  this.channel = connect(bootstrap).channel();

  name = ("IPC Client (" + channel.hashCode() + ") to " +
      address.toString() +
      ((ticket == null) ?
          " from unknown user" :
          (" from " + ticket.getName())));
}