Java AccessControlList类代码示例

import org.apache.hadoop.security.authorize.AccessControlList; //导入依赖的package包/类
private static WebAppContext createWebAppContext(String name,
    Configuration conf, AccessControlList adminsAcl, final String appDir) {
  WebAppContext ctx = new WebAppContext();
  ctx.setDefaultsDescriptor(null);
  ServletHolder holder = new ServletHolder(new DefaultServlet());
  Map<String, String> params = ImmutableMap. <String, String> builder()
          .put("acceptRanges", "true")
          .put("dirAllowed", "false")
          .put("gzip", "true")
          .put("useFileMappedBuffer", "true")
          .build();
  holder.setInitParameters(params);
  ctx.setWelcomeFiles(new String[] {"index.html"});
  ctx.addServlet(holder, "/");
  ctx.setDisplayName(name);
  ctx.setContextPath("/");
  ctx.setWar(appDir + "/" + name);
  ctx.getServletContext().setAttribute(CONF_CONTEXT_ATTRIBUTE, conf);
  ctx.getServletContext().setAttribute(ADMINS_ACL, adminsAcl);
  addNoCacheFilter(ctx);
  return ctx;
}
 

import org.apache.hadoop.security.authorize.AccessControlList; //导入依赖的package包/类
@Test
public void testRequiresAuthorizationAccess() throws Exception {
  Configuration conf = new Configuration();
  ServletContext context = Mockito.mock(ServletContext.class);
  Mockito.when(context.getAttribute(HttpServer2.CONF_CONTEXT_ATTRIBUTE)).thenReturn(conf);
  HttpServletRequest request = Mockito.mock(HttpServletRequest.class);
  HttpServletResponse response = Mockito.mock(HttpServletResponse.class);

  //requires admin access to instrumentation, FALSE by default
  Assert.assertTrue(HttpServer2.isInstrumentationAccessAllowed(context, request, response));

  //requires admin access to instrumentation, TRUE
  conf.setBoolean(CommonConfigurationKeys.HADOOP_SECURITY_INSTRUMENTATION_REQUIRES_ADMIN, true);
  conf.setBoolean(CommonConfigurationKeys.HADOOP_SECURITY_AUTHORIZATION, true);
  AccessControlList acls = Mockito.mock(AccessControlList.class);
  Mockito.when(acls.isUserAllowed(Mockito.<UserGroupInformation>any())).thenReturn(false);
  Mockito.when(context.getAttribute(HttpServer2.ADMINS_ACL)).thenReturn(acls);
  Assert.assertFalse(HttpServer2.isInstrumentationAccessAllowed(context, request, response));
}
 

import org.apache.hadoop.security.authorize.AccessControlList; //导入依赖的package包/类
private void setKMSACLs(Configuration conf) {
  Map<Type, AccessControlList> tempAcls = new HashMap<Type, AccessControlList>();
  Map<Type, AccessControlList> tempBlacklist = new HashMap<Type, AccessControlList>();
  for (Type aclType : Type.values()) {
    String aclStr = conf.get(aclType.getAclConfigKey(), ACL_DEFAULT);
    tempAcls.put(aclType, new AccessControlList(aclStr));
    String blacklistStr = conf.get(aclType.getBlacklistConfigKey());
    if (blacklistStr != null) {
      // Only add if blacklist is present
      tempBlacklist.put(aclType, new AccessControlList(blacklistStr));
      LOG.info("'{}' Blacklist '{}'", aclType, blacklistStr);
    }
    LOG.info("'{}' ACL '{}'", aclType, aclStr);
  }
  acls = tempAcls;
  blacklistedAcls = tempBlacklist;
}
 

import org.apache.hadoop.security.authorize.AccessControlList; //导入依赖的package包/类
/**
 * Constructs and initializes this AdminACLsManager
 *
 * @param conf configuration for this object to use
 */
public AdminACLsManager(Configuration conf) {

  this.adminAcl = new AccessControlList(conf.get(
        YarnConfiguration.YARN_ADMIN_ACL,
        YarnConfiguration.DEFAULT_YARN_ADMIN_ACL));
  try {
    owner = UserGroupInformation.getCurrentUser();
    adminAcl.addUser(owner.getShortUserName());
  } catch (IOException e){
    LOG.warn("Could not add current user to admin:" + e);
    throw new YarnRuntimeException(e);
  }

  aclsEnabled = conf.getBoolean(YarnConfiguration.YARN_ACL_ENABLE,
      YarnConfiguration.DEFAULT_YARN_ACL_ENABLE);
}
 

import org.apache.hadoop.security.authorize.AccessControlList; //导入依赖的package包/类
@Override
public boolean checkPermission(AccessType accessType,
    PrivilegedEntity target, UserGroupInformation user) {
  boolean ret = false;
  Map<AccessType, AccessControlList> acls = allAcls.get(target);
  if (acls != null) {
    AccessControlList list = acls.get(accessType);
    if (list != null) {
      ret = list.isUserAllowed(user);
    }
  }

  // recursively look up the queue to see if parent queue has the permission.
  if (target.getType() == EntityType.QUEUE && !ret) {
    String queueName = target.getName();
    if (!queueName.contains(".")) {
      return ret;
    }
    String parentQueueName = queueName.substring(0, queueName.lastIndexOf("."));
    return checkPermission(accessType, new PrivilegedEntity(target.getType(),
      parentQueueName), user);
  }
  return ret;
}
 

import org.apache.hadoop.security.authorize.AccessControlList; //导入依赖的package包/类
public AllocationConfiguration(Configuration conf) {
  minQueueResources = new HashMap<String, Resource>();
  maxQueueResources = new HashMap<String, Resource>();
  queueWeights = new HashMap<String, ResourceWeights>();
  queueMaxApps = new HashMap<String, Integer>();
  userMaxApps = new HashMap<String, Integer>();
  queueMaxAMShares = new HashMap<String, Float>();
  userMaxAppsDefault = Integer.MAX_VALUE;
  queueMaxAppsDefault = Integer.MAX_VALUE;
  queueMaxAMShareDefault = 0.5f;
  queueAcls = new HashMap<String, Map<QueueACL, AccessControlList>>();
  minSharePreemptionTimeouts = new HashMap<String, Long>();
  fairSharePreemptionTimeouts = new HashMap<String, Long>();
  fairSharePreemptionThresholds = new HashMap<String, Float>();
  schedulingPolicies = new HashMap<String, SchedulingPolicy>();
  defaultSchedulingPolicy = SchedulingPolicy.DEFAULT_POLICY;
  reservableQueues = new HashSet<>();
  configuredQueues = new HashMap<FSQueueType, Set<String>>();
  for (FSQueueType queueType : FSQueueType.values()) {
    configuredQueues.put(queueType, new HashSet<String>());
  }
  placementPolicy = QueuePlacementPolicy.fromConfiguration(conf,
      configuredQueues);
}
 

import org.apache.hadoop.security.authorize.AccessControlList; //导入依赖的package包/类
synchronized void setupQueueConfigs(Resource clusterResource)
    throws IOException {
  super.setupQueueConfigs(clusterResource);
  StringBuilder aclsString = new StringBuilder();
  for (Map.Entry<AccessType, AccessControlList> e : acls.entrySet()) {
    aclsString.append(e.getKey() + ":" + e.getValue().getAclString());
  }

  StringBuilder labelStrBuilder = new StringBuilder(); 
  if (accessibleLabels != null) {
    for (String s : accessibleLabels) {
      labelStrBuilder.append(s);
      labelStrBuilder.append(",");
    }
  }

  LOG.info(queueName +
      ", capacity=" + this.queueCapacities.getCapacity() +
      ", asboluteCapacity=" + this.queueCapacities.getAbsoluteCapacity() +
      ", maxCapacity=" + this.queueCapacities.getMaximumCapacity() +
      ", asboluteMaxCapacity=" + this.queueCapacities.getAbsoluteMaximumCapacity() + 
      ", state=" + state +
      ", acls=" + aclsString + 
      ", labels=" + labelStrBuilder.toString() + "\n" +
      ", reservationsContinueLooking=" + reservationsContinueLooking);
}
 

import org.apache.hadoop.security.authorize.AccessControlList; //导入依赖的package包/类
private Map<ApplicationAccessType, String> createACLs(String submitter,
    boolean setupACLs) {
  AccessControlList viewACL = new AccessControlList("");
  AccessControlList modifyACL = new AccessControlList("");
  if (setupACLs) {
    viewACL.addUser(submitter);
    viewACL.addUser(COMMON_USER);
    modifyACL.addUser(submitter);
    modifyACL.addUser(COMMON_USER);
  }
  Map<ApplicationAccessType, String> acls =
      new HashMap<ApplicationAccessType, String>();
  acls.put(ApplicationAccessType.VIEW_APP, viewACL.getAclString());
  acls.put(ApplicationAccessType.MODIFY_APP, modifyACL.getAclString());
  return acls;
}
 

import org.apache.hadoop.security.authorize.AccessControlList; //导入依赖的package包/类
private List<Queue> createQueues(Configuration conf) {
  String[] queueNameValues = conf.getStrings(
    MAPRED_QUEUE_NAMES_KEY);
  List<Queue> list = new ArrayList<Queue>();
  for (String name : queueNameValues) {
    try {
      Map<String, AccessControlList> acls = getQueueAcls(
        name, conf);
      QueueState state = getQueueState(name, conf);
      Queue q = new Queue(name, acls, state);
      list.add(q);
    } catch (Throwable t) {
      LOG.warn("Not able to initialize queue " + name);
    }
  }
  return list;
}
 

import org.apache.hadoop.security.authorize.AccessControlList; //导入依赖的package包/类
/**
 * If authorization is enabled, checks whether the user (in the callerUGI)
 * is authorized to perform the operation specified by 'jobOperation' on
 * the job by checking if the user is jobOwner or part of job ACL for the
 * specific job operation.
 * <ul>
 * <li>The owner of the job can do any operation on the job</li>
 * <li>For all other users/groups job-acls are checked</li>
 * </ul>
 * @param callerUGI
 * @param jobOperation
 * @param jobOwner
 * @param jobACL
 */
public boolean checkAccess(UserGroupInformation callerUGI,
    JobACL jobOperation, String jobOwner, AccessControlList jobACL) {

  if (LOG.isDebugEnabled()) {
    LOG.debug("checkAccess job acls, jobOwner: " + jobOwner + " jobacl: "
        + jobOperation.toString() + " user: " + callerUGI.getShortUserName());
  }
  String user = callerUGI.getShortUserName();
  if (!areACLsEnabled()) {
    return true;
  }

  // Allow Job-owner for any operation on the job
  if (isMRAdmin(callerUGI)
      || user.equals(jobOwner)
      || jobACL.isUserAllowed(callerUGI)) {
    return true;
  }

  return false;
}
 

import org.apache.hadoop.security.authorize.AccessControlList; //导入依赖的package包/类
public synchronized void write(DataOutput out) throws IOException {
  jobid.write(out);
  out.writeFloat(setupProgress);
  out.writeFloat(mapProgress);
  out.writeFloat(reduceProgress);
  out.writeFloat(cleanupProgress);
  WritableUtils.writeEnum(out, runState);
  out.writeLong(startTime);
  Text.writeString(out, user);
  WritableUtils.writeEnum(out, priority);
  Text.writeString(out, schedulingInfo);
  out.writeLong(finishTime);
  out.writeBoolean(isRetired);
  Text.writeString(out, historyFile);
  Text.writeString(out, jobName);
  Text.writeString(out, trackingUrl);
  Text.writeString(out, jobFile);
  out.writeBoolean(isUber);

  // Serialize the job's ACLs
  out.writeInt(jobACLs.size());
  for (Entry<JobACL, AccessControlList> entry : jobACLs.entrySet()) {
    WritableUtils.writeEnum(out, entry.getKey());
    entry.getValue().write(out);
  }
}
 

import org.apache.hadoop.security.authorize.AccessControlList; //导入依赖的package包/类
@Test
public void testAclsOff() {
  Map<JobACL, AccessControlList> tmpJobACLs = new HashMap<JobACL, AccessControlList>();
  Configuration conf = new Configuration();
  String jobOwner = "testuser";
  conf.set(JobACL.VIEW_JOB.getAclName(), jobOwner);
  conf.setBoolean(MRConfig.MR_ACLS_ENABLED, false);
  String noAdminUser = "testuser2";

  JobACLsManager aclsManager = new JobACLsManager(conf);
  tmpJobACLs = aclsManager.constructJobACLs(conf);
  final Map<JobACL, AccessControlList> jobACLs = tmpJobACLs;

  UserGroupInformation callerUGI = UserGroupInformation.createUserForTesting(
      noAdminUser, new String[] {});
  // acls off so anyone should have access
  boolean val = aclsManager.checkAccess(callerUGI, JobACL.VIEW_JOB, jobOwner,
      jobACLs.get(JobACL.VIEW_JOB));
  assertTrue("acls off so anyone should have access", val);
}
 

import org.apache.hadoop.security.authorize.AccessControlList; //导入依赖的package包/类
@Test
public void testRequiresAuthorizationAccess() throws Exception {
  Configuration conf = new Configuration();
  ServletContext context = Mockito.mock(ServletContext.class);
  Mockito.when(context.getAttribute(HttpServer.CONF_CONTEXT_ATTRIBUTE)).thenReturn(conf);
  HttpServletRequest request = Mockito.mock(HttpServletRequest.class);
  HttpServletResponse response = Mockito.mock(HttpServletResponse.class);

  //requires admin access to instrumentation, FALSE by default
  Assert.assertTrue(HttpServer.isInstrumentationAccessAllowed(context, request, response));

  //requires admin access to instrumentation, TRUE
  conf.setBoolean(CommonConfigurationKeys.HADOOP_SECURITY_INSTRUMENTATION_REQUIRES_ADMIN, true);
  conf.setBoolean(CommonConfigurationKeys.HADOOP_SECURITY_AUTHORIZATION, true);
  AccessControlList acls = Mockito.mock(AccessControlList.class);
  Mockito.when(acls.isUserAllowed(Mockito.<UserGroupInformation>any())).thenReturn(false);
  Mockito.when(context.getAttribute(HttpServer.ADMINS_ACL)).thenReturn(acls);
  Assert.assertFalse(HttpServer.isInstrumentationAccessAllowed(context, request, response));
}
 

import org.apache.hadoop.security.authorize.AccessControlList; //导入依赖的package包/类
/**
 * Verify the administrator access for /logs, /stacks, /conf, /logLevel and
 * /metrics servlets.
 * 
 * @throws Exception
 */
@Test
public void testAuthorizationOfDefaultServlets() throws Exception {
  Configuration conf = new Configuration();
  conf.setBoolean(CommonConfigurationKeys.HADOOP_SECURITY_AUTHORIZATION,
      true);
  conf.setBoolean(CommonConfigurationKeys.HADOOP_SECURITY_INSTRUMENTATION_REQUIRES_ADMIN,
      true);
  conf.set(HttpServer2.FILTER_INITIALIZER_PROPERTY,
      DummyFilterInitializer.class.getName());

  conf.set(CommonConfigurationKeys.HADOOP_SECURITY_GROUP_MAPPING,
      MyGroupsProvider.class.getName());
  Groups.getUserToGroupsMappingService(conf);
  MyGroupsProvider.clearMapping();
  MyGroupsProvider.mapping.put("userA", Arrays.asList("groupA"));
  MyGroupsProvider.mapping.put("userB", Arrays.asList("groupB"));
  MyGroupsProvider.mapping.put("userC", Arrays.asList("groupC"));
  MyGroupsProvider.mapping.put("userD", Arrays.asList("groupD"));
  MyGroupsProvider.mapping.put("userE", Arrays.asList("groupE"));

  HttpServer2 myServer = new HttpServer2.Builder().setName("test")
      .addEndpoint(new URI("http://localhost:0")).setFindPort(true).setConf(conf)
      .setACL(new AccessControlList("userA,userB groupC,groupD")).build();
  myServer.setAttribute(HttpServer2.CONF_CONTEXT_ATTRIBUTE, conf);
  myServer.start();

  String serverURL = "http://"
      + NetUtils.getHostPortString(myServer.getConnectorAddress(0)) + "/";
  for (String servlet : new String[] { "conf", "logs", "stacks",
      "logLevel", "metrics" }) {
    for (String user : new String[] { "userA", "userB", "userC", "userD" }) {
      assertEquals(HttpURLConnection.HTTP_OK, getHttpStatusCode(serverURL
          + servlet, user));
    }
    assertEquals(HttpURLConnection.HTTP_FORBIDDEN, getHttpStatusCode(
        serverURL + servlet, "userE"));
  }
  myServer.stop();
}
 

import org.apache.hadoop.security.authorize.AccessControlList; //导入依赖的package包/类
@Test
public void testHasAdministratorAccess() throws Exception {
  Configuration conf = new Configuration();
  conf.setBoolean(CommonConfigurationKeys.HADOOP_SECURITY_AUTHORIZATION, false);
  ServletContext context = Mockito.mock(ServletContext.class);
  Mockito.when(context.getAttribute(HttpServer2.CONF_CONTEXT_ATTRIBUTE)).thenReturn(conf);
  Mockito.when(context.getAttribute(HttpServer2.ADMINS_ACL)).thenReturn(null);
  HttpServletRequest request = Mockito.mock(HttpServletRequest.class);
  Mockito.when(request.getRemoteUser()).thenReturn(null);
  HttpServletResponse response = Mockito.mock(HttpServletResponse.class);

  //authorization OFF
  Assert.assertTrue(HttpServer2.hasAdministratorAccess(context, request, response));

  //authorization ON & user NULL
  response = Mockito.mock(HttpServletResponse.class);
  conf.setBoolean(CommonConfigurationKeys.HADOOP_SECURITY_AUTHORIZATION, true);
  Assert.assertFalse(HttpServer2.hasAdministratorAccess(context, request, response));
  Mockito.verify(response).sendError(Mockito.eq(HttpServletResponse.SC_FORBIDDEN), Mockito.anyString());

  //authorization ON & user NOT NULL & ACLs NULL
  response = Mockito.mock(HttpServletResponse.class);
  Mockito.when(request.getRemoteUser()).thenReturn("foo");
  Assert.assertTrue(HttpServer2.hasAdministratorAccess(context, request, response));

  //authorization ON & user NOT NULL & ACLs NOT NULL & user not in ACLs
  response = Mockito.mock(HttpServletResponse.class);
  AccessControlList acls = Mockito.mock(AccessControlList.class);
  Mockito.when(acls.isUserAllowed(Mockito.<UserGroupInformation>any())).thenReturn(false);
  Mockito.when(context.getAttribute(HttpServer2.ADMINS_ACL)).thenReturn(acls);
  Assert.assertFalse(HttpServer2.hasAdministratorAccess(context, request, response));
  Mockito.verify(response).sendError(Mockito.eq(HttpServletResponse.SC_FORBIDDEN), Mockito.anyString());

  //authorization ON & user NOT NULL & ACLs NOT NULL & user in in ACLs
  response = Mockito.mock(HttpServletResponse.class);
  Mockito.when(acls.isUserAllowed(Mockito.<UserGroupInformation>any())).thenReturn(true);
  Mockito.when(context.getAttribute(HttpServer2.ADMINS_ACL)).thenReturn(acls);
  Assert.assertTrue(HttpServer2.hasAdministratorAccess(context, request, response));

}