This is an automated email from the ASF dual-hosted git repository.
adoroszlai pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ozone.git
The following commit(s) were added to refs/heads/master by this push:
new cb4d088e223 Revert "HDDS-15467. Do not fall back to the OM starter
user in OMClientRequest" (#10756)
cb4d088e223 is described below
commit cb4d088e223292c6a9ee4687656f8cc1080f985f
Author: KUAN-HAO HUANG <[email protected]>
AuthorDate: Tue Jul 14 19:03:57 2026 +0800
Revert "HDDS-15467. Do not fall back to the OM starter user in
OMClientRequest" (#10756)
---
.../hadoop/ozone/om/request/OMClientRequest.java | 39 ++++++--
.../om/request/key/OMAllocateBlockRequest.java | 4 +-
.../ozone/om/request/key/OMKeyDeleteRequest.java | 2 +-
.../ozone/om/request/key/OMKeyRenameRequest.java | 2 +-
.../TestOMClientRequestUserInfoFallback.java | 106 ---------------------
5 files changed, 35 insertions(+), 118 deletions(-)
diff --git
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/OMClientRequest.java
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/OMClientRequest.java
index 9ffdef1784b..884c5fa310b 100644
---
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/OMClientRequest.java
+++
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/OMClientRequest.java
@@ -115,7 +115,7 @@ public OMRequest preExecute(OzoneManager ozoneManager)
.setVersion(ozoneManager.getVersionManager().getMetadataLayoutVersion())
.build();
omRequest = getOmRequest().toBuilder()
- .setUserInfo(getUserInfo())
+ .setUserInfo(getUserIfNotExists(ozoneManager))
.setLayoutVersion(layoutVersion).build();
return omRequest;
}
@@ -193,18 +193,41 @@ public OzoneManagerProtocolProtos.UserInfo getUserInfo()
throws IOException {
&& grpcContextClientIpAddress != null) {
userInfo.setHostName(grpcContextClientHostname);
userInfo.setRemoteAddress(grpcContextClientIpAddress);
- } else if (omRequest.hasUserInfo()
- && omRequest.getUserInfo().hasRemoteAddress()) {
- // For non-RPC internal service requests (e.g. the Trash emptier) that
- // populate their own UserInfo, preserve the supplied host/address since
- // there is no RPC or gRPC client context to derive it from.
- userInfo.setHostName(omRequest.getUserInfo().getHostName());
- userInfo.setRemoteAddress(omRequest.getUserInfo().getRemoteAddress());
}
return userInfo.build();
}
+ /**
+ * For non-rpc internal calls Server.getRemoteUser()
+ * and Server.getRemoteIp() will be null.
+ * Passing getCurrentUser() and Ip of the Om node that started it.
+ * @return User Info.
+ */
+ public OzoneManagerProtocolProtos.UserInfo getUserIfNotExists(
+ OzoneManager ozoneManager) throws IOException {
+ OzoneManagerProtocolProtos.UserInfo userInfo = getUserInfo();
+ if (!userInfo.hasRemoteAddress() || !userInfo.hasUserName()) {
+ OzoneManagerProtocolProtos.UserInfo.Builder newuserInfo =
+ OzoneManagerProtocolProtos.UserInfo.newBuilder();
+ UserGroupInformation user;
+ InetAddress remoteAddress;
+ try {
+ user = UserGroupInformation.getCurrentUser();
+ remoteAddress = ozoneManager.getOmRpcServerAddr()
+ .getAddress();
+ } catch (Exception e) {
+ LOG.debug("Couldn't get om Rpc server address", e);
+ return getUserInfo();
+ }
+ newuserInfo.setUserName(user.getUserName());
+ newuserInfo.setHostName(remoteAddress.getHostName());
+ newuserInfo.setRemoteAddress(remoteAddress.getHostAddress());
+ return newuserInfo.build();
+ }
+ return getUserInfo();
+ }
+
/**
* Check Acls of ozone object.
* @param ozoneManager
diff --git
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/key/OMAllocateBlockRequest.java
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/key/OMAllocateBlockRequest.java
index f85cc8b777e..0e11f1d7677 100644
---
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/key/OMAllocateBlockRequest.java
+++
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/key/OMAllocateBlockRequest.java
@@ -102,7 +102,7 @@ public OMRequest preExecute(OzoneManager ozoneManager)
throws IOException {
// BlockOutputStreamEntryPool, so we are fine for now. But if one some
// one uses direct omclient we might be in trouble.
- UserInfo userInfo = getOmRequest().getUserInfo();
+ UserInfo userInfo = getUserIfNotExists(ozoneManager);
ReplicationConfig repConfig =
ReplicationConfig.fromProto(keyArgs.getType(),
keyArgs.getFactor(), keyArgs.getEcReplicationConfig());
// To allocate atleast one block passing requested size and scmBlockSize
@@ -133,7 +133,7 @@ public OMRequest preExecute(OzoneManager ozoneManager)
throws IOException {
newAllocatedBlockRequest.setKeyLocation(
omKeyLocationInfoList.get(0).getProtobuf(getOmRequest().getVersion()));
- return getOmRequest().toBuilder()
+ return getOmRequest().toBuilder().setUserInfo(userInfo)
.setAllocateBlockRequest(newAllocatedBlockRequest).build();
}
diff --git
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/key/OMKeyDeleteRequest.java
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/key/OMKeyDeleteRequest.java
index 820c4d17197..26287ca66d2 100644
---
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/key/OMKeyDeleteRequest.java
+++
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/key/OMKeyDeleteRequest.java
@@ -92,7 +92,7 @@ public OMRequest preExecute(OzoneManager ozoneManager) throws
IOException {
return getOmRequest().toBuilder()
.setDeleteKeyRequest(deleteKeyRequest.toBuilder()
.setKeyArgs(resolvedArgs))
- .build();
+ .setUserInfo(getUserIfNotExists(ozoneManager)).build();
}
protected KeyArgs resolveBucketAndCheckAcls(OzoneManager ozoneManager,
diff --git
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/key/OMKeyRenameRequest.java
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/key/OMKeyRenameRequest.java
index 2c2e54d3a7b..850f111a913 100644
---
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/key/OMKeyRenameRequest.java
+++
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/key/OMKeyRenameRequest.java
@@ -95,7 +95,7 @@ public OMRequest preExecute(OzoneManager ozoneManager) throws
IOException {
return getOmRequest().toBuilder()
.setRenameKeyRequest(renameKeyRequest.toBuilder().setToKeyName(dstKey)
.setKeyArgs(resolvedArgs))
- .build();
+ .setUserInfo(getUserIfNotExists(ozoneManager)).build();
}
diff --git
a/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/TestOMClientRequestUserInfoFallback.java
b/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/TestOMClientRequestUserInfoFallback.java
deleted file mode 100644
index 202ada1b016..00000000000
---
a/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/TestOMClientRequestUserInfoFallback.java
+++ /dev/null
@@ -1,106 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.hadoop.ozone.om.request;
-
-import static
org.apache.hadoop.ozone.om.request.OMRequestTestUtils.newBucketInfoBuilder;
-import static
org.apache.hadoop.ozone.om.request.OMRequestTestUtils.newCreateBucketRequest;
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.mockito.Mockito.mockStatic;
-
-import java.util.UUID;
-import org.apache.hadoop.hdds.protocol.proto.HddsProtos.StorageTypeProto;
-import org.apache.hadoop.ipc_.Server;
-import org.apache.hadoop.ozone.om.request.bucket.OMBucketCreateRequest;
-import
org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos.BucketInfo;
-import
org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos.OMRequest;
-import
org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos.UserInfo;
-import
org.apache.hadoop.security.authentication.client.AuthenticationException;
-import org.junit.jupiter.api.Test;
-import org.mockito.MockedStatic;
-
-/**
- * Tests that {@link OMClientRequest} does not silently fall back to the OM
- * starter/login user when a request carries no user information (HDDS-15467).
- */
-public class TestOMClientRequestUserInfoFallback {
-
- private OMRequest newBucketRequest(UserInfo userInfo) {
- BucketInfo.Builder bucketInfo = newBucketInfoBuilder(
- UUID.randomUUID().toString(), UUID.randomUUID().toString())
- .setIsVersionEnabled(true)
- .setStorageType(StorageTypeProto.DISK);
- OMRequest.Builder builder = newCreateBucketRequest(bucketInfo);
- if (userInfo != null) {
- builder.setUserInfo(userInfo);
- }
- return builder.build();
- }
-
- /**
- * With no RPC/gRPC context and no UserInfo on the request, getUserInfo()
must
- * not manufacture an identity from the OM starter user; createUGI() then
- * fails closed instead of silently escalating.
- */
- @Test
- public void noFallbackToServerUserWhenUserInfoMissing() throws Exception {
- try (MockedStatic<Server> mockedRpcServer = mockStatic(Server.class)) {
- mockedRpcServer.when(Server::getRemoteUser).thenReturn(null);
- mockedRpcServer.when(Server::getRemoteIp).thenReturn(null);
-
- OMRequest omRequest = newBucketRequest(null);
- OMClientRequest request = new OMBucketCreateRequest(omRequest);
-
- UserInfo userInfo = request.getUserInfo();
- assertFalse(userInfo.hasUserName());
- assertFalse(userInfo.hasRemoteAddress());
-
- OMClientRequest withUserInfo = new OMBucketCreateRequest(
- omRequest.toBuilder().setUserInfo(userInfo).build());
- assertThrows(AuthenticationException.class, withUserInfo::createUGI);
- }
- }
-
- /**
- * An internal service (e.g. the Trash emptier) populates its own UserInfo.
- * With no RPC/gRPC context, getUserInfo() must preserve that identity rather
- * than replacing it with the OM starter user.
- */
- @Test
- public void internalServiceUserInfoIsPreserved() throws Exception {
- try (MockedStatic<Server> mockedRpcServer = mockStatic(Server.class)) {
- mockedRpcServer.when(Server::getRemoteUser).thenReturn(null);
- mockedRpcServer.when(Server::getRemoteIp).thenReturn(null);
-
- UserInfo serviceUserInfo = UserInfo.newBuilder()
- .setUserName("trash-service-user")
- .setHostName("om-host")
- .setRemoteAddress("10.0.0.9")
- .build();
-
- OMClientRequest request =
- new OMBucketCreateRequest(newBucketRequest(serviceUserInfo));
-
- UserInfo result = request.getUserInfo();
- assertEquals("trash-service-user", result.getUserName());
- assertEquals("10.0.0.9", result.getRemoteAddress());
- assertEquals("om-host", result.getHostName());
- }
- }
-}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
