Java Groups.refresh方法代码示例

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
@Test
public void testCachePreventsImplRequest() throws Exception {
  // Disable negative cache.
  conf.setLong(
    CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_NEGATIVE_CACHE_SECS, 0);
  Groups groups = new Groups(conf);
  groups.cacheGroupsAdd(Arrays.asList(myGroups));
  groups.refresh();
  FakeGroupMapping.clearBlackList();

  assertEquals(0, FakeGroupMapping.getRequestCount());

  // First call hits the wire
  assertTrue(groups.getGroups("me").size() == 2);
  assertEquals(1, FakeGroupMapping.getRequestCount());

  // Second count hits cache
  assertTrue(groups.getGroups("me").size() == 2);
  assertEquals(1, FakeGroupMapping.getRequestCount());
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
@Test
public void testCacheEntriesExpire() throws Exception {
  conf.setLong(
    CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_CACHE_SECS, 1);
  FakeTimer timer = new FakeTimer();
  final Groups groups = new Groups(conf, timer);
  groups.cacheGroupsAdd(Arrays.asList(myGroups));
  groups.refresh();
  FakeGroupMapping.clearBlackList();

  // We make an entry
  groups.getGroups("me");
  int startingRequestCount = FakeGroupMapping.getRequestCount();

  timer.advance(20 * 1000);

  // Cache entry has expired so it results in a new fetch
  groups.getGroups("me");
  assertEquals(startingRequestCount + 1, FakeGroupMapping.getRequestCount());
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
@Test
public void testExceptionCallingLoadWithoutBackgroundRefreshReturnsOldValue()
    throws Exception {
  conf.setLong(
      CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_CACHE_SECS, 1);
  conf.setBoolean(
      CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_CACHE_BACKGROUND_RELOAD,
      false);
  FakeTimer timer = new FakeTimer();
  final Groups groups = new Groups(conf, timer);
  groups.cacheGroupsAdd(Arrays.asList(myGroups));
  groups.refresh();
  FakeGroupMapping.clearBlackList();

  // First populate the cash
  assertEquals(groups.getGroups("me").size(), 2);

  // Advance the timer so a refresh is required
  timer.advance(2 * 1000);

  // This call should throw an exception
  FakeGroupMapping.setThrowException(true);
  assertEquals(groups.getGroups("me").size(), 2);
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
@Test
public void testGroupsCaching() throws Exception {
  // Disable negative cache.
  conf.setLong(
      CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_NEGATIVE_CACHE_SECS, 0);
  Groups groups = new Groups(conf);
  groups.cacheGroupsAdd(Arrays.asList(myGroups));
  groups.refresh();
  FakeGroupMapping.clearBlackList();
  FakeGroupMapping.addToBlackList("user1");

  // regular entry
  assertTrue(groups.getGroups("me").size() == 2);

  // this must be cached. blacklisting should have no effect.
  FakeGroupMapping.addToBlackList("me");
  assertTrue(groups.getGroups("me").size() == 2);

  // ask for a negative entry
  try {
    LOG.error("We are not supposed to get here." + groups.getGroups("user1").toString());
    fail();
  } catch (IOException ioe) {
    if(!ioe.getMessage().startsWith("No groups found")) {
      LOG.error("Got unexpected exception: " + ioe.getMessage());
      fail();
    }
  }

  // this shouldn't be cached. remove from the black list and retry.
  FakeGroupMapping.clearBlackList();
  assertTrue(groups.getGroups("user1").size() == 2);
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
@Test
public void testGroupLookupForStaticUsers() throws Exception {
  conf.setClass(CommonConfigurationKeys.HADOOP_SECURITY_GROUP_MAPPING,
      FakeunPrivilegedGroupMapping.class, ShellBasedUnixGroupsMapping.class);
  conf.set(CommonConfigurationKeys.HADOOP_USER_GROUP_STATIC_OVERRIDES, "me=;user1=group1;user2=group1,group2");
  Groups groups = new Groups(conf);
  List<String> userGroups = groups.getGroups("me");
  assertTrue("non-empty groups for static user", userGroups.isEmpty());
  assertFalse("group lookup done for static user",
      FakeunPrivilegedGroupMapping.invoked);
  
  List<String> expected = new ArrayList<String>();
  expected.add("group1");

  FakeunPrivilegedGroupMapping.invoked = false;
  userGroups = groups.getGroups("user1");
  assertTrue("groups not correct", expected.equals(userGroups));
  assertFalse("group lookup done for unprivileged user",
      FakeunPrivilegedGroupMapping.invoked);

  expected.add("group2");
  FakeunPrivilegedGroupMapping.invoked = false;
  userGroups = groups.getGroups("user2");
  assertTrue("groups not correct", expected.equals(userGroups));
  assertFalse("group lookup done for unprivileged user",
      FakeunPrivilegedGroupMapping.invoked);

  Configuration newConf = new Configuration();
  newConf.set(CommonConfigurationKeys.HADOOP_USER_GROUP_STATIC_OVERRIDES, "me=;user1=group1;user2=group1,group2;user3=group3");
  groups.refresh(newConf);

  expected.clear();
  expected.add("group3");
  FakeunPrivilegedGroupMapping.invoked = false;
  userGroups = groups.getGroups("user3");
  assertTrue("groups not correct", expected.equals(userGroups));
  assertFalse("group lookup done for unprivileged user",
      FakeunPrivilegedGroupMapping.invoked);
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
@Test
public void TestGroupsCaching() throws Exception {
  Groups groups = new Groups(conf);
  groups.cacheGroupsAdd(Arrays.asList(myGroups));
  groups.refresh();
  FakeGroupMapping.clearBlackList();
  FakeGroupMapping.addToBlackList("user1");

  // regular entry
  assertTrue(groups.getGroups("me").size() == 2);

  // this must be cached. blacklisting should have no effect.
  FakeGroupMapping.addToBlackList("me");
  assertTrue(groups.getGroups("me").size() == 2);

  // ask for a negative entry
  try {
    LOG.error("We are not supposed to get here." + groups.getGroups("user1").toString());
    fail();
  } catch (IOException ioe) {
    if(!ioe.getMessage().startsWith("No groups found")) {
      LOG.error("Got unexpected exception: " + ioe.getMessage());
      fail();
    }
  }

  // this shouldn't be cached. remove from the black list and retry.
  FakeGroupMapping.clearBlackList();
  assertTrue(groups.getGroups("user1").size() == 2);
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
@Test
public void testThreadNotBlockedWhenExpiredEntryExistsWithBackgroundRefresh()
    throws Exception {
  conf.setLong(
      CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_CACHE_SECS, 1);
  conf.setBoolean(
      CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_CACHE_BACKGROUND_RELOAD,
      true);
  FakeTimer timer = new FakeTimer();
  final Groups groups = new Groups(conf, timer);
  groups.cacheGroupsAdd(Arrays.asList(myGroups));
  groups.refresh();
  FakeGroupMapping.clearBlackList();

  // We make an initial request to populate the cache
  groups.getGroups("me");
  // Further lookups will have a delay
  FakeGroupMapping.setGetGroupsDelayMs(100);
  // add another groups
  groups.cacheGroupsAdd(Arrays.asList("grp3"));
  int startingRequestCount = FakeGroupMapping.getRequestCount();

  // Then expire that entry
  timer.advance(4 * 1000);

  // Now get the cache entry - it should return immediately
  // with the old value and the cache will not have completed
  // a request to getGroups yet.
  assertEquals(groups.getGroups("me").size(), 2);
  assertEquals(startingRequestCount, FakeGroupMapping.getRequestCount());

  // Now sleep for over the delay time and the request count should
  // have completed
  Thread.sleep(110);
  assertEquals(startingRequestCount + 1, FakeGroupMapping.getRequestCount());
  // Another call to get groups should give 3 groups instead of 2
  assertEquals(groups.getGroups("me").size(), 3);
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
@Test
public void testThreadBlockedWhenExpiredEntryExistsWithoutBackgroundRefresh()
    throws Exception {
  conf.setLong(
      CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_CACHE_SECS, 1);
  conf.setBoolean(
      CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_CACHE_BACKGROUND_RELOAD,
      false);
  FakeTimer timer = new FakeTimer();
  final Groups groups = new Groups(conf, timer);
  groups.cacheGroupsAdd(Arrays.asList(myGroups));
  groups.refresh();
  FakeGroupMapping.clearBlackList();

  // We make an initial request to populate the cache
  groups.getGroups("me");
  // Further lookups will have a delay
  FakeGroupMapping.setGetGroupsDelayMs(100);
  // add another group
  groups.cacheGroupsAdd(Arrays.asList("grp3"));
  int startingRequestCount = FakeGroupMapping.getRequestCount();

  // Then expire that entry
  timer.advance(4 * 1000);

  // Now get the cache entry - it should block and return the new
  // 3 group value
  assertEquals(groups.getGroups("me").size(), 3);
  assertEquals(startingRequestCount + 1, FakeGroupMapping.getRequestCount());
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
@Test
public void TestGroupsCachingDefault() throws Exception {
  Groups groups = new Groups(conf);
  groups.cacheGroupsAdd(Arrays.asList(myGroups));
  groups.refresh();
  FakeGroupMapping.clearBlackList();
  FakeGroupMapping.addToBlackList("user1");

  // regular entry
  assertTrue(groups.getGroups("me").size() == 2);

  // this must be cached. blacklisting should have no effect.
  FakeGroupMapping.addToBlackList("me");
  assertTrue(groups.getGroups("me").size() == 2);

  // ask for a negative entry
  try {
    LOG.error("We are not supposed to get here." + groups.getGroups("user1").toString());
    fail();
  } catch (IOException ioe) {
    if(!ioe.getMessage().startsWith("No groups found")) {
      LOG.error("Got unexpected exception: " + ioe.getMessage());
      fail();
    }
  }

  // this shouldn't be cached. remove from the black list and retry.
  FakeGroupMapping.clearBlackList();
  assertTrue(groups.getGroups("user1").size() == 2);
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
@Test
public void testGroupsCaching() throws Exception {
  Groups groups = new Groups(conf);
  groups.cacheGroupsAdd(Arrays.asList(myGroups));
  groups.refresh();
  FakeGroupMapping.clearBlackList();
  FakeGroupMapping.addToBlackList("user1");

  // regular entry
  assertTrue(groups.getGroups("me").size() == 2);

  // this must be cached. blacklisting should have no effect.
  FakeGroupMapping.addToBlackList("me");
  assertTrue(groups.getGroups("me").size() == 2);

  // ask for a negative entry
  try {
    LOG.error("We are not supposed to get here." + groups.getGroups("user1").toString());
    fail();
  } catch (IOException ioe) {
    if(!ioe.getMessage().startsWith("No groups found")) {
      LOG.error("Got unexpected exception: " + ioe.getMessage());
      fail();
    }
  }

  // this shouldn't be cached. remove from the black list and retry.
  FakeGroupMapping.clearBlackList();
  assertTrue(groups.getGroups("user1").size() == 2);
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
/**
 * Test the netgroups (groups in ACL rules that start with @)
 *
 * This is a  manual test because it requires:
 *   - host setup
 *   - native code compiled
 *   - specify the group mapping class
 *
 * Host setup:
 *
 * /etc/nsswitch.conf should have a line like this:
 * netgroup: files
 *
 * /etc/netgroup should be (the whole file):
 * lasVegas (,elvis,)
 * memphis (,elvis,) (,jerryLeeLewis,)
 *
 * To run this test:
 *
 * export JAVA_HOME='path/to/java'
 * ant \
 *   -Dtestcase=TestAccessControlList \
 *   -Dtest.output=yes \
 *   -DTestAccessControlListGroupMapping=$className \
 *   compile-native test
 *
 * where $className is one of the classes that provide group
 * mapping services, i.e. classes that implement
 * GroupMappingServiceProvider interface, at this time:
 *   - org.apache.hadoop.security.JniBasedUnixGroupsNetgroupMapping
 *   - org.apache.hadoop.security.ShellBasedUnixGroupsNetgroupMapping
 *
 */
@Test
public void testNetgroups() throws Exception {

  if(!NativeCodeLoader.isNativeCodeLoaded()) {
    LOG.info("Not testing netgroups, " +
      "this test only runs when native code is compiled");
    return;
  }

  String groupMappingClassName =
    System.getProperty("TestAccessControlListGroupMapping");

  if(groupMappingClassName == null) {
    LOG.info("Not testing netgroups, no group mapping class specified, " +
      "use -DTestAccessControlListGroupMapping=$className to specify " +
      "group mapping class (must implement GroupMappingServiceProvider " +
      "interface and support netgroups)");
    return;
  }

  LOG.info("Testing netgroups using: " + groupMappingClassName);

  Configuration conf = new Configuration();
  conf.set(CommonConfigurationKeysPublic.HADOOP_SECURITY_GROUP_MAPPING,
    groupMappingClassName);

  Groups groups = Groups.getUserToGroupsMappingService(conf);

  AccessControlList acl;

  // create these ACLs to populate groups cache
  acl = new AccessControlList("ja my"); // plain
  acl = new AccessControlList("sinatra ratpack,@lasVegas"); // netgroup
  acl = new AccessControlList(" somegroup,@someNetgroup"); // no user

  // this ACL will be used for testing ACLs
  acl = new AccessControlList("carlPerkins ratpack,@lasVegas");
  acl.addGroup("@memphis");

  // validate the netgroups before and after rehresh to make
  // sure refresh works correctly
  validateNetgroups(groups, acl);
  groups.refresh();
  validateNetgroups(groups, acl);

}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
@Test
public void testExceptionOnBackgroundRefreshHandled() throws Exception {
  conf.setLong(
      CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_CACHE_SECS, 1);
  conf.setBoolean(
      CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_CACHE_BACKGROUND_RELOAD,
      true);
  FakeTimer timer = new FakeTimer();
  final Groups groups = new Groups(conf, timer);
  groups.cacheGroupsAdd(Arrays.asList(myGroups));
  groups.refresh();
  FakeGroupMapping.clearBlackList();

  // We make an initial request to populate the cache
  groups.getGroups("me");

  // add another group
  groups.cacheGroupsAdd(Arrays.asList("grp3"));
  int startingRequestCount = FakeGroupMapping.getRequestCount();
  // Arrange for an exception to occur only on the
  // second call
  FakeGroupMapping.setThrowException(true);

  // Then expire that entry
  timer.advance(4 * 1000);

  // Now get the cache entry - it should return immediately
  // with the old value and the cache will not have completed
  // a request to getGroups yet.
  assertEquals(groups.getGroups("me").size(), 2);
  assertEquals(startingRequestCount, FakeGroupMapping.getRequestCount());

  // Now sleep for a short time and re-check the request count. It should have
  // increased, but the exception means the cache will not have updated
  Thread.sleep(50);
  FakeGroupMapping.setThrowException(false);
  assertEquals(startingRequestCount + 1, FakeGroupMapping.getRequestCount());
  assertEquals(groups.getGroups("me").size(), 2);

  // Now sleep another short time - the 3rd call to getGroups above
  // will have kicked off another refresh that updates the cache
  Thread.sleep(50);
  assertEquals(startingRequestCount + 2, FakeGroupMapping.getRequestCount());
  assertEquals(groups.getGroups("me").size(), 3);
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
@Test
public void testEntriesExpireIfBackgroundRefreshFails() throws Exception {
  conf.setLong(
      CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_CACHE_SECS, 1);
  conf.setBoolean(
      CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_CACHE_BACKGROUND_RELOAD,
      true);
  FakeTimer timer = new FakeTimer();
  final Groups groups = new Groups(conf, timer);
  groups.cacheGroupsAdd(Arrays.asList(myGroups));
  groups.refresh();
  FakeGroupMapping.clearBlackList();

  // We make an initial request to populate the cache
  groups.getGroups("me");

  // Now make all calls to the FakeGroupMapper throw exceptions
  FakeGroupMapping.setThrowException(true);

  // The cache entry expires for refresh after 1 second
  // It expires for eviction after 1 * 10 seconds after it was last written
  // So if we call getGroups repeatedly over 9 seconds, 9 refreshes should
  // be triggered which will fail to update the key, but the keys old value
  // will be retrievable until it is evicted after about 10 seconds.
  for(int i=0; i<9; i++) {
    assertEquals(groups.getGroups("me").size(), 2);
    timer.advance(1 * 1000);
  }
  // Wait until the 11th second. The call to getGroups should throw
  // an exception as the key will have been evicted and FakeGroupMapping
  // will throw IO Exception when it is asked for new groups. In this case
  // load must be called synchronously as there is no key present
  timer.advance(2 * 1000);
  try {
    groups.getGroups("me");
    fail("Should have thrown an exception here");
  } catch (Exception e) {
    // pass
  }

  // Finally check groups are retrieve again after FakeGroupMapping
  // stops throw exceptions
  FakeGroupMapping.setThrowException(false);
  assertEquals(groups.getGroups("me").size(), 2);
}
 

import org.apache.hadoop.security.Groups; //导入方法依赖的package包/类
/**
 * test the netgroups (groups in ACL rules that start with @),
 */
public void testNetgroups() throws Exception {
  // set the config for Groups (test mapping class)
  // we rely on hardcoded groups and netgroups in
  // ShellBasedUnixGroupsMappingTestWrapper
  Configuration conf = new Configuration();
  conf.set("hadoop.security.group.mapping",
    "org.apache.hadoop.security.ShellBasedUnixGroupsNetgroupMappingTestWrapper");

  Groups groups = Groups.getUserToGroupsMappingService(conf);

  AccessControlList acl;

  // create these ACLs to populate groups cache
  acl = new AccessControlList("ja my"); // plain
  acl = new AccessControlList("sinatra ratpack,@lasVegas"); // netgroup
  acl = new AccessControlList(" somegroups,@somenetgroup"); // no user

  // check that the netgroups are working
  List<String> elvisGroups = groups.getGroups("elvis");
  assertTrue(elvisGroups.contains("@lasVegas"));

  // refresh cache - not testing this directly but if the results are ok
  // after the refresh that means it worked fine (very likely)
  groups.refresh();

  // create an ACL with netgroups (@xxx)
  acl = new AccessControlList("ja ratpack,@lasVegas");
  // elvis is in @lasVegas
  UserGroupInformation elvis = 
    UserGroupInformation.createRemoteUser("elvis");
  // ja's groups are not in ACL
  UserGroupInformation ja = 
    UserGroupInformation.createRemoteUser("ja");
  // unwanted and unwanted's grops are not in ACL
  UserGroupInformation unwanted = 
    UserGroupInformation.createRemoteUser("unwanted");

  // test the ACLs!
  assertUserAllowed(elvis, acl);
  assertUserAllowed(ja, acl);
  assertUserNotAllowed(unwanted, acl);
}