Java Groups.getGroups方法代码示例

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
@Test
public void testCacheEntriesExpire() throws Exception {
  conf.setLong(
    CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_CACHE_SECS, 1);
  FakeTimer timer = new FakeTimer();
  final Groups groups = new Groups(conf, timer);
  groups.cacheGroupsAdd(Arrays.asList(myGroups));
  groups.refresh();
  FakeGroupMapping.clearBlackList();

  // We make an entry
  groups.getGroups("me");
  int startingRequestCount = FakeGroupMapping.getRequestCount();

  timer.advance(20 * 1000);

  // Cache entry has expired so it results in a new fetch
  groups.getGroups("me");
  assertEquals(startingRequestCount + 1, FakeGroupMapping.getRequestCount());
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
/**
 * Validate the netgroups, both group membership and ACL
 * functionality
 *
 * Note: assumes a specific acl setup done by testNetgroups
 *
 * @param groups group to user mapping service
 * @param acl ACL set up in a specific way, see testNetgroups
 */
private void validateNetgroups(Groups groups,
  AccessControlList acl) throws Exception {

  // check that the netgroups are working
  List<String> elvisGroups = groups.getGroups("elvis");
  assertTrue(elvisGroups.contains("@lasVegas"));
  assertTrue(elvisGroups.contains("@memphis"));
  List<String> jerryLeeLewisGroups = groups.getGroups("jerryLeeLewis");
  assertTrue(jerryLeeLewisGroups.contains("@memphis"));

  // allowed because his netgroup is in ACL
  UserGroupInformation elvis = 
    UserGroupInformation.createRemoteUser("elvis");
  assertUserAllowed(elvis, acl);

  // allowed because he's in ACL
  UserGroupInformation carlPerkins = 
    UserGroupInformation.createRemoteUser("carlPerkins");
  assertUserAllowed(carlPerkins, acl);

  // not allowed because he's not in ACL and has no netgroups
  UserGroupInformation littleRichard = 
    UserGroupInformation.createRemoteUser("littleRichard");
  assertUserNotAllowed(littleRichard, acl);
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
@Override
protected String getQueueForApp(String requestedQueue, String user,
    Groups groups, Map<FSQueueType, Set<String>> configuredQueues)
    throws IOException {
  List<String> groupNames = groups.getGroups(user);
  for (int i = 1; i < groupNames.size(); i++) {
    String group = cleanName(groupNames.get(i));
    if (configuredQueues.get(FSQueueType.LEAF).contains("root." + group)
        || configuredQueues.get(FSQueueType.PARENT).contains(
            "root." + group)) {
      return "root." + group;
    }
  }
  
  return "";
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
/**
 * Validate the netgroups, both group membership and ACL
 * functionality
 *
 * Note: assumes a specific acl setup done by testNetgroups
 *
 * @param groups group to user mapping service
 * @param acl ACL set up in a specific way, see testNetgroups
 */
private void validateNetgroups(Groups groups,
  AccessControlList acl) throws Exception {

  // check that the netgroups are working
  List<String> elvisGroups = groups.getGroups("elvis");
  assertTrue(elvisGroups.contains("@lasVegas"));
  assertTrue(elvisGroups.contains("@memphis"));
  List<String> jerryLeeLewisGroups = groups.getGroups("jerryLeeLewis");
  assertTrue(jerryLeeLewisGroups.contains("@memphis"));

  // allowed becuase his netgroup is in ACL
  UserGroupInformation elvis = 
    UserGroupInformation.createRemoteUser("elvis");
  assertUserAllowed(elvis, acl);

  // allowed because he's in ACL
  UserGroupInformation carlPerkins = 
    UserGroupInformation.createRemoteUser("carlPerkins");
  assertUserAllowed(carlPerkins, acl);

  // not allowed because he's not in ACL and has no netgroups
  UserGroupInformation littleRichard = 
    UserGroupInformation.createRemoteUser("littleRichard");
  assertUserNotAllowed(littleRichard, acl);
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
@Test
public void testGroupLookupForStaticUsers() throws Exception {
  conf.setClass(CommonConfigurationKeys.HADOOP_SECURITY_GROUP_MAPPING,
      FakeunPrivilegedGroupMapping.class, ShellBasedUnixGroupsMapping.class);
  conf.set(CommonConfigurationKeys.HADOOP_USER_GROUP_STATIC_OVERRIDES, "me=;user1=group1;user2=group1,group2");
  Groups groups = new Groups(conf);
  List<String> userGroups = groups.getGroups("me");
  assertTrue("non-empty groups for static user", userGroups.isEmpty());
  assertFalse("group lookup done for static user",
      FakeunPrivilegedGroupMapping.invoked);
  
  List<String> expected = new ArrayList<String>();
  expected.add("group1");

  FakeunPrivilegedGroupMapping.invoked = false;
  userGroups = groups.getGroups("user1");
  assertTrue("groups not correct", expected.equals(userGroups));
  assertFalse("group lookup done for unprivileged user",
      FakeunPrivilegedGroupMapping.invoked);

  expected.add("group2");
  FakeunPrivilegedGroupMapping.invoked = false;
  userGroups = groups.getGroups("user2");
  assertTrue("groups not correct", expected.equals(userGroups));
  assertFalse("group lookup done for unprivileged user",
      FakeunPrivilegedGroupMapping.invoked);

}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
@Test
public void testRefreshUserToGroupsMappings() throws Exception {

  String[] args = new String[] { "-refreshUserToGroupsMappings" };
  Groups groups = Groups.getUserToGroupsMappingService(conf);
  String user = UserGroupInformation.getCurrentUser().getUserName();
  System.out.println("first attempt:");
  List<String> g1 = groups.getGroups(user);
  String[] str_groups = new String[g1.size()];
  g1.toArray(str_groups);
  System.out.println(Arrays.toString(str_groups));

  // Now groups of this user has changed but getGroups returns from the
  // cache,so we would see same groups as before
  System.out.println("second attempt, should be same:");
  List<String> g2 = groups.getGroups(user);
  g2.toArray(str_groups);
  System.out.println(Arrays.toString(str_groups));
  for (int i = 0; i < g2.size(); i++) {
    assertEquals("Should be same group ", g1.get(i), g2.get(i));
  }
  // run the command,which clears the cache
  hsAdminClient.run(args);
  System.out
      .println("third attempt(after refresh command), should be different:");
  // Now get groups should return new groups
  List<String> g3 = groups.getGroups(user);
  g3.toArray(str_groups);
  System.out.println(Arrays.toString(str_groups));
  for (int i = 0; i < g3.size(); i++) {
    assertFalse(
        "Should be different group: " + g1.get(i) + " and " + g3.get(i), g1
            .get(i).equals(g3.get(i)));
  }
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
@Test
public void testGroupLookupForStaticUsers() throws Exception {
  conf.setClass(CommonConfigurationKeys.HADOOP_SECURITY_GROUP_MAPPING,
      FakeunPrivilegedGroupMapping.class, ShellBasedUnixGroupsMapping.class);
  conf.set(CommonConfigurationKeys.HADOOP_USER_GROUP_STATIC_OVERRIDES, "me=;user1=group1;user2=group1,group2");
  Groups groups = new Groups(conf);
  List<String> userGroups = groups.getGroups("me");
  assertTrue("non-empty groups for static user", userGroups.isEmpty());
  assertFalse("group lookup done for static user",
      FakeunPrivilegedGroupMapping.invoked);
  
  List<String> expected = new ArrayList<String>();
  expected.add("group1");

  FakeunPrivilegedGroupMapping.invoked = false;
  userGroups = groups.getGroups("user1");
  assertTrue("groups not correct", expected.equals(userGroups));
  assertFalse("group lookup done for unprivileged user",
      FakeunPrivilegedGroupMapping.invoked);

  expected.add("group2");
  FakeunPrivilegedGroupMapping.invoked = false;
  userGroups = groups.getGroups("user2");
  assertTrue("groups not correct", expected.equals(userGroups));
  assertFalse("group lookup done for unprivileged user",
      FakeunPrivilegedGroupMapping.invoked);

  Configuration newConf = new Configuration();
  newConf.set(CommonConfigurationKeys.HADOOP_USER_GROUP_STATIC_OVERRIDES, "me=;user1=group1;user2=group1,group2;user3=group3");
  groups.refresh(newConf);

  expected.clear();
  expected.add("group3");
  FakeunPrivilegedGroupMapping.invoked = false;
  userGroups = groups.getGroups("user3");
  assertTrue("groups not correct", expected.equals(userGroups));
  assertFalse("group lookup done for unprivileged user",
      FakeunPrivilegedGroupMapping.invoked);
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
@Override
protected String getPoolForJob(String requestedPool,
    String user, Groups groups) throws IOException {
  if (user == null) {
    return Pool.DEFAULT_POOL_NAME;
  }
  List<String> groupList = groups.getGroups(user);

  if (groupList.size() > 0) {
    return groupList.get(0);
  } else {
    return Pool.DEFAULT_POOL_NAME;
  }
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
@Test
public void testThreadNotBlockedWhenExpiredEntryExistsWithBackgroundRefresh()
    throws Exception {
  conf.setLong(
      CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_CACHE_SECS, 1);
  conf.setBoolean(
      CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_CACHE_BACKGROUND_RELOAD,
      true);
  FakeTimer timer = new FakeTimer();
  final Groups groups = new Groups(conf, timer);
  groups.cacheGroupsAdd(Arrays.asList(myGroups));
  groups.refresh();
  FakeGroupMapping.clearBlackList();

  // We make an initial request to populate the cache
  groups.getGroups("me");
  // Further lookups will have a delay
  FakeGroupMapping.setGetGroupsDelayMs(100);
  // add another groups
  groups.cacheGroupsAdd(Arrays.asList("grp3"));
  int startingRequestCount = FakeGroupMapping.getRequestCount();

  // Then expire that entry
  timer.advance(4 * 1000);

  // Now get the cache entry - it should return immediately
  // with the old value and the cache will not have completed
  // a request to getGroups yet.
  assertEquals(groups.getGroups("me").size(), 2);
  assertEquals(startingRequestCount, FakeGroupMapping.getRequestCount());

  // Now sleep for over the delay time and the request count should
  // have completed
  Thread.sleep(110);
  assertEquals(startingRequestCount + 1, FakeGroupMapping.getRequestCount());
  // Another call to get groups should give 3 groups instead of 2
  assertEquals(groups.getGroups("me").size(), 3);
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
@Test
public void testThreadBlockedWhenExpiredEntryExistsWithoutBackgroundRefresh()
    throws Exception {
  conf.setLong(
      CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_CACHE_SECS, 1);
  conf.setBoolean(
      CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_CACHE_BACKGROUND_RELOAD,
      false);
  FakeTimer timer = new FakeTimer();
  final Groups groups = new Groups(conf, timer);
  groups.cacheGroupsAdd(Arrays.asList(myGroups));
  groups.refresh();
  FakeGroupMapping.clearBlackList();

  // We make an initial request to populate the cache
  groups.getGroups("me");
  // Further lookups will have a delay
  FakeGroupMapping.setGetGroupsDelayMs(100);
  // add another group
  groups.cacheGroupsAdd(Arrays.asList("grp3"));
  int startingRequestCount = FakeGroupMapping.getRequestCount();

  // Then expire that entry
  timer.advance(4 * 1000);

  // Now get the cache entry - it should block and return the new
  // 3 group value
  assertEquals(groups.getGroups("me").size(), 3);
  assertEquals(startingRequestCount + 1, FakeGroupMapping.getRequestCount());
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
@Override
protected String getQueueForApp(String requestedQueue,
    String user, Groups groups, 
    Collection<String> configuredQueues) throws IOException {
  List<String> groupNames = groups.getGroups(user);
  for (int i = 1; i < groupNames.size(); i++) {
    if (configuredQueues.contains("root." + groupNames.get(i))) {
      return "root." + groupNames.get(i);
    }
  }
  
  return "";
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
@Test
public void testExceptionOnBackgroundRefreshHandled() throws Exception {
  conf.setLong(
      CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_CACHE_SECS, 1);
  conf.setBoolean(
      CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_CACHE_BACKGROUND_RELOAD,
      true);
  FakeTimer timer = new FakeTimer();
  final Groups groups = new Groups(conf, timer);
  groups.cacheGroupsAdd(Arrays.asList(myGroups));
  groups.refresh();
  FakeGroupMapping.clearBlackList();

  // We make an initial request to populate the cache
  groups.getGroups("me");

  // add another group
  groups.cacheGroupsAdd(Arrays.asList("grp3"));
  int startingRequestCount = FakeGroupMapping.getRequestCount();
  // Arrange for an exception to occur only on the
  // second call
  FakeGroupMapping.setThrowException(true);

  // Then expire that entry
  timer.advance(4 * 1000);

  // Now get the cache entry - it should return immediately
  // with the old value and the cache will not have completed
  // a request to getGroups yet.
  assertEquals(groups.getGroups("me").size(), 2);
  assertEquals(startingRequestCount, FakeGroupMapping.getRequestCount());

  // Now sleep for a short time and re-check the request count. It should have
  // increased, but the exception means the cache will not have updated
  Thread.sleep(50);
  FakeGroupMapping.setThrowException(false);
  assertEquals(startingRequestCount + 1, FakeGroupMapping.getRequestCount());
  assertEquals(groups.getGroups("me").size(), 2);

  // Now sleep another short time - the 3rd call to getGroups above
  // will have kicked off another refresh that updates the cache
  Thread.sleep(50);
  assertEquals(startingRequestCount + 2, FakeGroupMapping.getRequestCount());
  assertEquals(groups.getGroups("me").size(), 3);
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
@Test
public void testEntriesExpireIfBackgroundRefreshFails() throws Exception {
  conf.setLong(
      CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_CACHE_SECS, 1);
  conf.setBoolean(
      CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_CACHE_BACKGROUND_RELOAD,
      true);
  FakeTimer timer = new FakeTimer();
  final Groups groups = new Groups(conf, timer);
  groups.cacheGroupsAdd(Arrays.asList(myGroups));
  groups.refresh();
  FakeGroupMapping.clearBlackList();

  // We make an initial request to populate the cache
  groups.getGroups("me");

  // Now make all calls to the FakeGroupMapper throw exceptions
  FakeGroupMapping.setThrowException(true);

  // The cache entry expires for refresh after 1 second
  // It expires for eviction after 1 * 10 seconds after it was last written
  // So if we call getGroups repeatedly over 9 seconds, 9 refreshes should
  // be triggered which will fail to update the key, but the keys old value
  // will be retrievable until it is evicted after about 10 seconds.
  for(int i=0; i<9; i++) {
    assertEquals(groups.getGroups("me").size(), 2);
    timer.advance(1 * 1000);
  }
  // Wait until the 11th second. The call to getGroups should throw
  // an exception as the key will have been evicted and FakeGroupMapping
  // will throw IO Exception when it is asked for new groups. In this case
  // load must be called synchronously as there is no key present
  timer.advance(2 * 1000);
  try {
    groups.getGroups("me");
    fail("Should have thrown an exception here");
  } catch (Exception e) {
    // pass
  }

  // Finally check groups are retrieve again after FakeGroupMapping
  // stops throw exceptions
  FakeGroupMapping.setThrowException(false);
  assertEquals(groups.getGroups("me").size(), 2);
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
/**
 * test the netgroups (groups in ACL rules that start with @),
 */
public void testNetgroups() throws Exception {
  // set the config for Groups (test mapping class)
  // we rely on hardcoded groups and netgroups in
  // ShellBasedUnixGroupsMappingTestWrapper
  Configuration conf = new Configuration();
  conf.set("hadoop.security.group.mapping",
    "org.apache.hadoop.security.ShellBasedUnixGroupsNetgroupMappingTestWrapper");

  Groups groups = Groups.getUserToGroupsMappingService(conf);

  AccessControlList acl;

  // create these ACLs to populate groups cache
  acl = new AccessControlList("ja my"); // plain
  acl = new AccessControlList("sinatra ratpack,@lasVegas"); // netgroup
  acl = new AccessControlList(" somegroups,@somenetgroup"); // no user

  // check that the netgroups are working
  List<String> elvisGroups = groups.getGroups("elvis");
  assertTrue(elvisGroups.contains("@lasVegas"));

  // refresh cache - not testing this directly but if the results are ok
  // after the refresh that means it worked fine (very likely)
  groups.refresh();

  // create an ACL with netgroups (@xxx)
  acl = new AccessControlList("ja ratpack,@lasVegas");
  // elvis is in @lasVegas
  UserGroupInformation elvis = 
    UserGroupInformation.createRemoteUser("elvis");
  // ja's groups are not in ACL
  UserGroupInformation ja = 
    UserGroupInformation.createRemoteUser("ja");
  // unwanted and unwanted's grops are not in ACL
  UserGroupInformation unwanted = 
    UserGroupInformation.createRemoteUser("unwanted");

  // test the ACLs!
  assertUserAllowed(elvis, acl);
  assertUserAllowed(ja, acl);
  assertUserNotAllowed(unwanted, acl);
}