Java AccessControlLists类代码示例

import org.apache.hadoop.hbase.security.access.AccessControlLists; //导入依赖的package包/类
@BeforeClass
public static void setUpBeforeClass() throws Exception {
  // set the always on security provider
  UserProvider.setUserProviderForTesting(util.getConfiguration(),
    HadoopSecurityEnabledUserProviderForTesting.class);
  // setup configuration
  SecureTestUtil.enableSecurity(util.getConfiguration());
  util.getConfiguration().setInt(
      LoadIncrementalHFiles.MAX_FILES_PER_REGION_PER_FAMILY,
      MAX_FILES_PER_REGION_PER_FAMILY);
  // change default behavior so that tag values are returned with normal rpcs
  util.getConfiguration().set(HConstants.RPC_CODEC_CONF_KEY,
      KeyValueCodecWithTags.class.getCanonicalName());

  util.startMiniCluster();

  // Wait for the ACL table to become available
  util.waitTableEnabled(AccessControlLists.ACL_TABLE_NAME);

  setupNamespace();
}
 

import org.apache.hadoop.hbase.security.access.AccessControlLists; //导入依赖的package包/类
@BeforeClass
public static void setUpBeforeClass() throws Exception {
  setUpBaseConf(TEST_UTIL.getConfiguration());

  // set the always on security provider
  UserProvider.setUserProviderForTesting(TEST_UTIL.getConfiguration(),
    HadoopSecurityEnabledUserProviderForTesting.class);

  // setup configuration
  SecureTestUtil.enableSecurity(TEST_UTIL.getConfiguration());

  TEST_UTIL.startMiniCluster(3);
  TEST_UTIL.startMiniMapReduceCluster();

  // Wait for the ACL table to become available
  TEST_UTIL.waitTableEnabled(AccessControlLists.ACL_TABLE_NAME);
}
 

import org.apache.hadoop.hbase.security.access.AccessControlLists; //导入依赖的package包/类
/**
 * Get the super users and groups defined in the configuration.
 * The user running the hbase server is always included.
 * @param conf
 * @return Pair of super user list and super group list.
 * @throws IOException
 */
public static Pair<List<String>, List<String>> getSystemAndSuperUsers(Configuration conf)
    throws IOException {
  ArrayList<String> superUsers = new ArrayList<String>();
  ArrayList<String> superGroups = new ArrayList<String>();
  User user = User.getCurrent();
  if (user == null) {
    throw new IOException("Unable to obtain the current user, "
        + "authorization checks for internal operations will not work correctly!");
  }
  if (LOG.isTraceEnabled()) {
    LOG.trace("Current user name is " + user.getShortName());
  }
  String currentUser = user.getShortName();
  String[] superUserList = conf.getStrings(AccessControlLists.SUPERUSER_CONF_KEY, new String[0]);
  for (String name : superUserList) {
    if (AccessControlLists.isGroupPrincipal(name)) {
      superGroups.add(AccessControlLists.getGroupName(name));
    } else {
      superUsers.add(name);
    }
  }
  superUsers.add(currentUser);
  return new Pair<List<String>, List<String>>(superUsers, superGroups);
}
 

import org.apache.hadoop.hbase.security.access.AccessControlLists; //导入依赖的package包/类
private void initSystemAndSuperUsers() throws IOException {
  this.superUsers = new ArrayList<String>();
  this.superGroups = new ArrayList<String>();
  User user = User.getCurrent();
  if (user == null) {
    throw new IOException("Unable to obtain the current user, "
        + "authorization checks for internal operations will not work correctly!");
  }
  if (LOG.isTraceEnabled()) {
    LOG.trace("Current user name is " + user.getShortName());
  }
  String currentUser = user.getShortName();
  List<String> superUserList = Lists.asList(currentUser,
      this.conf.getStrings(AccessControlLists.SUPERUSER_CONF_KEY, new String[0]));
  if (superUserList != null) {
    for (String name : superUserList) {
      if (AccessControlLists.isGroupPrincipal(name)) {
        this.superGroups.add(AccessControlLists.getGroupName(name));
      } else {
        this.superUsers.add(name);
      }
    }
  };
}
 

import org.apache.hadoop.hbase.security.access.AccessControlLists; //导入依赖的package包/类
@BeforeClass
public static void setUpBeforeClass() throws Exception {
  // set the always on security provider
  UserProvider.setUserProviderForTesting(util.getConfiguration(),
    HadoopSecurityEnabledUserProviderForTesting.class);
  // setup configuration
  SecureTestUtil.enableSecurity(util.getConfiguration());
  util.getConfiguration().setInt(
      LoadIncrementalHFiles.MAX_FILES_PER_REGION_PER_FAMILY,
      MAX_FILES_PER_REGION_PER_FAMILY);

  util.startMiniCluster();

  // Wait for the ACL table to become available
  util.waitTableEnabled(AccessControlLists.ACL_TABLE_NAME);

  setupNamespace();
}
 

import org.apache.hadoop.hbase.security.access.AccessControlLists; //导入依赖的package包/类
@BeforeClass
public static void setUpBeforeClass() throws Exception {
  // set the always on security provider
  UserProvider.setUserProviderForTesting(util.getConfiguration(),
    HadoopSecurityEnabledUserProviderForTesting.class);
  // setup configuration
  SecureTestUtil.enableSecurity(util.getConfiguration());
  util.getConfiguration().setInt(
      LoadIncrementalHFiles.MAX_FILES_PER_REGION_PER_FAMILY,
      MAX_FILES_PER_REGION_PER_FAMILY);

  util.startMiniCluster();

  // Wait for the ACL table to become available
  util.waitTableEnabled(AccessControlLists.ACL_TABLE_NAME.getName());
}
 

import org.apache.hadoop.hbase.security.access.AccessControlLists; //导入依赖的package包/类
@BeforeClass
public static void setUpBeforeClass() throws Exception {
  setUpBaseConf(TEST_UTIL.getConfiguration());

  // set the always on security provider
  UserProvider.setUserProviderForTesting(TEST_UTIL.getConfiguration(),
    HadoopSecurityEnabledUserProviderForTesting.class);

  // setup configuration
  SecureTestUtil.enableSecurity(TEST_UTIL.getConfiguration());

  TEST_UTIL.startMiniCluster(3);
  TEST_UTIL.startMiniMapReduceCluster();

  // Wait for the ACL table to become available
  TEST_UTIL.waitTableEnabled(AccessControlLists.ACL_TABLE_NAME.getName());
}
 

import org.apache.hadoop.hbase.security.access.AccessControlLists; //导入依赖的package包/类
@Test
public void testTableDisable() throws Exception {
  PrivilegedExceptionAction disableTable = new PrivilegedExceptionAction() {
    public Object run() throws Exception {
      ACCESS_CONTROLLER.preDisableTable(ObserverContext.createAndPrepare(CP_ENV, null),
        TEST_TABLE);
      return null;
    }
  };

  PrivilegedExceptionAction disableAclTable = new PrivilegedExceptionAction() {
    public Object run() throws Exception {
      ACCESS_CONTROLLER.preDisableTable(ObserverContext.createAndPrepare(CP_ENV, null),
          AccessControlLists.ACL_TABLE_NAME);
      return null;
    }
  };

  verifyAllowed(disableTable, SUPERUSER, USER_ADMIN, USER_CREATE, USER_OWNER);
  verifyDenied(disableTable, USER_RW, USER_RO, USER_NONE);
  
  // No user should be allowed to disable _acl_ table
  verifyDenied(disableAclTable, SUPERUSER, USER_ADMIN, USER_CREATE, USER_OWNER, USER_RW, USER_RO);
}
 

import org.apache.hadoop.hbase.security.access.AccessControlLists; //导入依赖的package包/类
/**
 * Sets the security firstly for getting the correct default realm.
 * @throws Exception
 */
@BeforeClass
public static void beforeClass() throws Exception {
  UserProvider.setUserProviderForTesting(UTIL.getConfiguration(), HadoopSecurityEnabledUserProviderForTesting.class);
  setUpKdcServer();
  SecureTestUtil.enableSecurity(UTIL.getConfiguration());
  UTIL.getConfiguration().setBoolean(AccessControlConstants.EXEC_PERMISSION_CHECKS_KEY, true);
  VisibilityTestUtil.enableVisiblityLabels(UTIL.getConfiguration());
  SecureTestUtil.verifyConfiguration(UTIL.getConfiguration());
  setUpClusterKdc();
  UTIL.startMiniCluster();
  UTIL.waitUntilAllRegionsAssigned(AccessControlLists.ACL_TABLE_NAME);
  UTIL.waitUntilAllRegionsAssigned(VisibilityConstants.LABELS_TABLE_NAME);
  UTIL.waitTableEnabled(AccessControlLists.ACL_TABLE_NAME, 50000);
  UTIL.waitTableEnabled(VisibilityConstants.LABELS_TABLE_NAME, 50000);
  SecureTestUtil.grantGlobal(UTIL, USER_ADMIN,
          Permission.Action.ADMIN,
          Permission.Action.CREATE,
          Permission.Action.EXEC,
          Permission.Action.READ,
          Permission.Action.WRITE);
  addLabels(UTIL.getConfiguration(), Arrays.asList(USER_OWNER),
          Arrays.asList(PRIVATE, CONFIDENTIAL, SECRET, TOPSECRET));
}
 

import org.apache.hadoop.hbase.security.access.AccessControlLists; //导入依赖的package包/类
@BeforeClass
public static void setUpBeforeClass() throws Exception {
  // set the always on security provider
  UserProvider.setUserProviderForTesting(util.getConfiguration(),
    HadoopSecurityEnabledUserProviderForTesting.class);
  // setup configuration
  SecureTestUtil.enableSecurity(util.getConfiguration());
  util.getConfiguration().setInt(LoadIncrementalHFiles.MAX_FILES_PER_REGION_PER_FAMILY,
    MAX_FILES_PER_REGION_PER_FAMILY);
  // change default behavior so that tag values are returned with normal rpcs
  util.getConfiguration().set(HConstants.RPC_CODEC_CONF_KEY,
    KeyValueCodecWithTags.class.getCanonicalName());

  util.startMiniCluster();

  // Wait for the ACL table to become available
  util.waitTableEnabled(AccessControlLists.ACL_TABLE_NAME);

  setupNamespace();
}
 

import org.apache.hadoop.hbase.security.access.AccessControlLists; //导入依赖的package包/类
@BeforeClass
public static void setupBeforeClass() throws Exception {
  conf = TEST_UTIL.getConfiguration();
  // Enable security
  enableSecurity(conf);
  conf.set(CoprocessorHost.REGION_COPROCESSOR_CONF_KEY, AccessController.class.getName());
  // Verify enableSecurity sets up what we require
  verifyConfiguration(conf);
  // Enable EXEC permission checking
  conf.setBoolean(AccessControlConstants.EXEC_PERMISSION_CHECKS_KEY, true);
  TEST_UTIL.startMiniCluster();
  TEST_UTIL.waitUntilAllRegionsAssigned(AccessControlLists.ACL_TABLE_NAME);
  MasterCoprocessorHost cpHost =
      TEST_UTIL.getMiniHBaseCluster().getMaster().getMasterCoprocessorHost();
  cpHost.load(AccessController.class, Coprocessor.PRIORITY_HIGHEST, conf);

  USER_OWNER = User.createUserForTesting(conf, "owner", new String[0]);
  USER_RW = User.createUserForTesting(conf, "rwuser", new String[0]);
  USER_RO = User.createUserForTesting(conf, "rouser", new String[0]);
  USER_NONE = User.createUserForTesting(conf, "usernone", new String[0]);
}
 

import org.apache.hadoop.hbase.security.access.AccessControlLists; //导入依赖的package包/类
@BeforeClass
public static void setUpBeforeClass() throws Exception {
  setUpBaseConf(TEST_UTIL.getConfiguration());
  // Setup separate test-data directory for MR cluster and set corresponding configurations.
  // Otherwise, different test classes running MR cluster can step on each other.
  TEST_UTIL.getDataTestDir();

  // set the always on security provider
  UserProvider.setUserProviderForTesting(TEST_UTIL.getConfiguration(),
    HadoopSecurityEnabledUserProviderForTesting.class);

  // setup configuration
  SecureTestUtil.enableSecurity(TEST_UTIL.getConfiguration());

  TEST_UTIL.startMiniCluster(1, 3);
  TEST_UTIL.startMiniMapReduceCluster();

  // Wait for the ACL table to become available
  TEST_UTIL.waitTableEnabled(AccessControlLists.ACL_TABLE_NAME);
}
 

import org.apache.hadoop.hbase.security.access.AccessControlLists; //导入依赖的package包/类
/**
 * Deletes the old _acl_ entry, and inserts a new one using namespace.
 * @param region
 * @throws IOException
 */
private void updateAcls(HRegion region) throws IOException {
  byte[] rowKey = Bytes.toBytes(NamespaceUpgrade.OLD_ACL);
  // get the old _acl_ entry, if present.
  Get g = new Get(rowKey);
  Result r = region.get(g);
  if (r == null || r.size() == 0) return;
  // create a put for new _acl_ entry with rowkey as hbase:acl
  Put p = new Put(AccessControlLists.ACL_GLOBAL_NAME);
  for (Cell c : r.rawCells()) {
    p.addImmutable(CellUtil.cloneFamily(c), CellUtil.cloneQualifier(c), CellUtil.cloneValue(c));
  }
  region.put(p);
  // delete the old entry
  Delete del = new Delete(rowKey);
  region.delete(del);
}
 

import org.apache.hadoop.hbase.security.access.AccessControlLists; //导入依赖的package包/类
@BeforeClass
public static void setupBeforeClass() throws Exception {
  // setup configuration
  conf = TEST_UTIL.getConfiguration();
  conf.setInt(HConstants.REGION_SERVER_HIGH_PRIORITY_HANDLER_COUNT, 10);
  SecureTestUtil.enableSecurity(conf);
  conf.set("hbase.coprocessor.master.classes", AccessController.class.getName() + ","
      + VisibilityController.class.getName());
  conf.set("hbase.coprocessor.region.classes", AccessController.class.getName() + ","
      + VisibilityController.class.getName());
  TEST_UTIL.startMiniCluster(2);

  TEST_UTIL.waitTableEnabled(AccessControlLists.ACL_TABLE_NAME.getName(), 50000);
  // Wait for the labels table to become available
  TEST_UTIL.waitTableEnabled(LABELS_TABLE_NAME.getName(), 50000);
  addLabels();

  // Create users for testing
  SUPERUSER = User.createUserForTesting(conf, "admin", new String[] { "supergroup" });
  NORMAL_USER1 = User.createUserForTesting(conf, "user1", new String[] {});
  NORMAL_USER2 = User.createUserForTesting(conf, "user2", new String[] {});
  // Grant users EXEC privilege on the labels table. For the purposes of this
  // test, we want to insure that access is denied even with the ability to access
  // the endpoint.
  SecureTestUtil.grantOnTable(TEST_UTIL, NORMAL_USER1.getShortName(), LABELS_TABLE_NAME,
    null, null, Permission.Action.EXEC);
  SecureTestUtil.grantOnTable(TEST_UTIL, NORMAL_USER2.getShortName(), LABELS_TABLE_NAME,
    null, null, Permission.Action.EXEC);
}
 

import org.apache.hadoop.hbase.security.access.AccessControlLists; //导入依赖的package包/类
@BeforeClass
public static void setupCluster() throws Exception {
  util = new HBaseTestingUtility();
  // set the always on security provider
  UserProvider.setUserProviderForTesting(util.getConfiguration(),
    HadoopSecurityEnabledUserProviderForTesting.class);
  // setup configuration
  SecureTestUtil.enableSecurity(util.getConfiguration());

  util.startMiniCluster();

  // Wait for the ACL table to become available
  util.waitTableEnabled(AccessControlLists.ACL_TABLE_NAME);
}