This is an automated email from the ASF dual-hosted git repository.
ChenSammi pushed a commit to branch HDDS-8342
in repository https://gitbox.apache.org/repos/asf/ozone.git
The following commit(s) were added to refs/heads/HDDS-8342 by this push:
new aa6377721c2 HDDS-15853. Fix Ranger ACL validation for lifecycle
requests (#10753)
aa6377721c2 is described below
commit aa6377721c21eb1e485cdd57e07aeefe151aa488
Author: Priyesh Karatha <[email protected]>
AuthorDate: Wed Jul 15 13:48:14 2026 +0530
HDDS-15853. Fix Ranger ACL validation for lifecycle requests (#10753)
---
.../OMLifecycleConfigurationDeleteRequest.java | 21 +++-
.../OMLifecycleConfigurationSetRequest.java | 21 +++-
.../OMLifecycleSetServiceStatusRequest.java | 67 +++++++------
.../TestOMLifecycleConfigurationDeleteRequest.java | 106 +++++++++++++++++++++
.../TestOMLifecycleConfigurationSetRequest.java | 106 +++++++++++++++++++++
5 files changed, 281 insertions(+), 40 deletions(-)
diff --git
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/lifecycle/OMLifecycleConfigurationDeleteRequest.java
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/lifecycle/OMLifecycleConfigurationDeleteRequest.java
index 56cbf6d9603..3d4100e06fc 100644
---
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/lifecycle/OMLifecycleConfigurationDeleteRequest.java
+++
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/lifecycle/OMLifecycleConfigurationDeleteRequest.java
@@ -49,6 +49,7 @@
import org.apache.hadoop.ozone.request.validation.RequestProcessingPhase;
import org.apache.hadoop.ozone.security.acl.IAccessAuthorizer;
import org.apache.hadoop.ozone.security.acl.OzoneObj;
+import org.apache.hadoop.security.UserGroupInformation;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -77,9 +78,7 @@ public OMRequest preExecute(OzoneManager ozoneManager) throws
IOException {
Pair.of(volumeName, bucketName), this);
if (ozoneManager.getAclsEnabled()) {
- checkAcls(ozoneManager, OzoneObj.ResourceType.BUCKET,
OzoneObj.StoreType.OZONE,
- IAccessAuthorizer.ACLType.ALL, resolvedBucket.realVolume(),
- resolvedBucket.realBucket(), null);
+ checkAclPermission(ozoneManager, resolvedBucket.realVolume(),
resolvedBucket.realBucket());
}
// Update the request with resolved volume and bucket names
@@ -175,6 +174,22 @@ public OMClientResponse
validateAndUpdateCache(OzoneManager ozoneManager, Execut
}
}
+ private void checkAclPermission(OzoneManager ozoneManager, String
volumeName, String bucketName)
+ throws IOException {
+ if (ozoneManager.getAccessAuthorizer().isNative()) {
+ UserGroupInformation ugi = createUGIForApi();
+ String bucketOwner = ozoneManager.getBucketOwner(volumeName, bucketName,
+ IAccessAuthorizer.ACLType.READ, OzoneObj.ResourceType.BUCKET);
+ if (!ozoneManager.isAdmin(ugi) && !ozoneManager.isOwner(ugi,
bucketOwner)) {
+ throw new OMException("Lifecycle configuration can only be deleted by
cluster Admin or bucket Owner",
+ OMException.ResultCodes.PERMISSION_DENIED);
+ }
+ } else {
+ checkAcls(ozoneManager, OzoneObj.ResourceType.BUCKET,
OzoneObj.StoreType.OZONE,
+ IAccessAuthorizer.ACLType.WRITE, volumeName, bucketName, null);
+ }
+ }
+
@RequestFeatureValidator(
conditions = ValidationCondition.CLUSTER_NEEDS_FINALIZATION,
processingPhase = RequestProcessingPhase.PRE_PROCESS,
diff --git
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/lifecycle/OMLifecycleConfigurationSetRequest.java
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/lifecycle/OMLifecycleConfigurationSetRequest.java
index 86edbaad180..53380943788 100644
---
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/lifecycle/OMLifecycleConfigurationSetRequest.java
+++
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/lifecycle/OMLifecycleConfigurationSetRequest.java
@@ -54,6 +54,7 @@
import org.apache.hadoop.ozone.request.validation.RequestProcessingPhase;
import org.apache.hadoop.ozone.security.acl.IAccessAuthorizer;
import org.apache.hadoop.ozone.security.acl.OzoneObj;
+import org.apache.hadoop.security.UserGroupInformation;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -86,9 +87,7 @@ public OMRequest preExecute(OzoneManager ozoneManager) throws
IOException {
Pair.of(volumeName, bucketName), this);
if (ozoneManager.getAclsEnabled()) {
- checkAcls(ozoneManager, OzoneObj.ResourceType.BUCKET,
OzoneObj.StoreType.OZONE,
- IAccessAuthorizer.ACLType.ALL, resolvedBucket.realVolume(),
- resolvedBucket.realBucket(), null);
+ checkAclPermission(ozoneManager, resolvedBucket.realVolume(),
resolvedBucket.realBucket());
}
if (resolvedBucket.bucketLayout().toProto() !=
request.getLifecycleConfiguration().getBucketLayout()) {
@@ -204,6 +203,22 @@ public OMClientResponse
validateAndUpdateCache(OzoneManager ozoneManager, Execut
}
}
+ private void checkAclPermission(OzoneManager ozoneManager, String
volumeName, String bucketName)
+ throws IOException {
+ if (ozoneManager.getAccessAuthorizer().isNative()) {
+ UserGroupInformation ugi = createUGIForApi();
+ String bucketOwner = ozoneManager.getBucketOwner(volumeName, bucketName,
+ IAccessAuthorizer.ACLType.READ, OzoneObj.ResourceType.BUCKET);
+ if (!ozoneManager.isAdmin(ugi) && !ozoneManager.isOwner(ugi,
bucketOwner)) {
+ throw new OMException("Lifecycle configuration can only be set by
cluster Admin or bucket Owner",
+ OMException.ResultCodes.PERMISSION_DENIED);
+ }
+ } else {
+ checkAcls(ozoneManager, OzoneObj.ResourceType.BUCKET,
OzoneObj.StoreType.OZONE,
+ IAccessAuthorizer.ACLType.WRITE, volumeName, bucketName, null);
+ }
+ }
+
@RequestFeatureValidator(
conditions = ValidationCondition.CLUSTER_NEEDS_FINALIZATION,
processingPhase = RequestProcessingPhase.PRE_PROCESS,
diff --git
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/lifecycle/OMLifecycleSetServiceStatusRequest.java
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/lifecycle/OMLifecycleSetServiceStatusRequest.java
index 99ab7813d5d..f07e7798b5d 100644
---
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/lifecycle/OMLifecycleSetServiceStatusRequest.java
+++
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/lifecycle/OMLifecycleSetServiceStatusRequest.java
@@ -55,54 +55,53 @@ public OMLifecycleSetServiceStatusRequest(OMRequest
omRequest) {
super(omRequest);
}
+ @Override
+ public OMRequest preExecute(OzoneManager ozoneManager) throws IOException {
+ OMRequest request = super.preExecute(ozoneManager);
+
+ if (ozoneManager.getAclsEnabled()) {
+ boolean suspend =
request.getSetLifecycleServiceStatusRequest().getSuspend();
+ UserGroupInformation ugi = createUGIForApi();
+ if (!ozoneManager.isAdmin(ugi)) {
+ throw new OMException("Access denied for user " + ugi + ". "
+ + "Superuser privilege is required to " + (suspend ? "suspend" :
"resume") + " Lifecycle Service.",
+ OMException.ResultCodes.ACCESS_DENIED);
+ }
+ }
+
+ return request;
+ }
+
@Override
public OMClientResponse validateAndUpdateCache(OzoneManager ozoneManager,
ExecutionContext context) {
OMResponse.Builder omResponse =
OmResponseUtil.getOMResponseBuilder(getOmRequest());
AuditLogger auditLogger = ozoneManager.getAuditLogger();
UserInfo userInfo = getOmRequest().getUserInfo();
HashMap<String, String> auditMap = new HashMap<>();
- IOException exception = null;
- OMClientResponse omClientResponse;
boolean suspend =
getOmRequest().getSetLifecycleServiceStatusRequest().getSuspend();
auditMap.put("suspend", String.valueOf(suspend));
- try {
- if (ozoneManager.getAclsEnabled()) {
- UserGroupInformation ugi = createUGIForApi();
- if (!ozoneManager.isAdmin(ugi)) {
- throw new OMException("Access denied for user " + ugi + ". "
- + "Superuser privilege is required to " + (suspend ? "suspend" :
"resume") + " Lifecycle Service.",
- OMException.ResultCodes.ACCESS_DENIED);
- }
- }
-
- KeyLifecycleService keyLifecycleService =
ozoneManager.getKeyManager().getKeyLifecycleService();
- if (keyLifecycleService != null) {
- if (suspend) {
- keyLifecycleService.suspend();
- LOG.info("KeyLifecycleService has been suspended by user: {}",
- userInfo != null ? userInfo.getUserName() : "unknown");
- } else {
- keyLifecycleService.resume();
- LOG.info("KeyLifecycleService resume called by user: {}",
- userInfo != null ? userInfo.getUserName() : "unknown");
- }
+ KeyLifecycleService keyLifecycleService =
ozoneManager.getKeyManager().getKeyLifecycleService();
+ if (keyLifecycleService != null) {
+ if (suspend) {
+ keyLifecycleService.suspend();
+ LOG.info("KeyLifecycleService has been suspended by user: {}",
+ userInfo != null ? userInfo.getUserName() : "unknown");
} else {
- LOG.warn("KeyLifecycleService is not available");
+ keyLifecycleService.resume();
+ LOG.info("KeyLifecycleService resume called by user: {}",
+ userInfo != null ? userInfo.getUserName() : "unknown");
}
-
- omResponse.setSetLifecycleServiceStatusResponse(
- SetLifecycleServiceStatusResponse.newBuilder().build());
- omClientResponse = new
OMLifecycleSetServiceStatusResponse(omResponse.build());
- } catch (IOException ex) {
- exception = ex;
- LOG.error("Failed to " + (suspend ? "suspend" : "resume") + "
KeyLifecycleService", ex);
- omClientResponse = new OMLifecycleSetServiceStatusResponse(
- createErrorOMResponse(omResponse, ex));
+ } else {
+ LOG.warn("KeyLifecycleService is not available");
}
+ omResponse.setSetLifecycleServiceStatusResponse(
+ SetLifecycleServiceStatusResponse.newBuilder().build());
+ OMClientResponse omClientResponse = new
OMLifecycleSetServiceStatusResponse(omResponse.build());
+
markForAudit(auditLogger,
buildAuditMessage(OMAction.SET_LIFECYCLE_SERVICE_STATUS,
- auditMap, exception, userInfo));
+ auditMap, null, userInfo));
return omClientResponse;
}
diff --git
a/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/lifecycle/TestOMLifecycleConfigurationDeleteRequest.java
b/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/lifecycle/TestOMLifecycleConfigurationDeleteRequest.java
index 858bba1fc8e..ed7a9e146a0 100644
---
a/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/lifecycle/TestOMLifecycleConfigurationDeleteRequest.java
+++
b/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/lifecycle/TestOMLifecycleConfigurationDeleteRequest.java
@@ -24,7 +24,13 @@
import static org.junit.jupiter.api.Assertions.assertNull;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.anyString;
+import static org.mockito.Mockito.doNothing;
+import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.isNull;
import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;
import java.io.IOException;
@@ -41,7 +47,10 @@
import org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos;
import
org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos.OMRequest;
import
org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos.OMResponse;
+import org.apache.hadoop.ozone.security.acl.IAccessAuthorizer;
+import org.apache.hadoop.ozone.security.acl.OzoneObj;
import org.apache.hadoop.ozone.upgrade.LayoutVersionManager;
+import org.apache.hadoop.security.UserGroupInformation;
import org.junit.jupiter.api.Test;
/**
@@ -175,6 +184,103 @@ public void
testDisallowDeleteLifecycleConfigurationBeforeFinalization() throws
ex.getResult());
}
+ @Test
+ public void testPreExecuteNonNativeAuthorizerChecksWriteAcl() throws
Exception {
+ String volumeName = UUID.randomUUID().toString();
+ String bucketName = UUID.randomUUID().toString();
+
+ when(ozoneManager.getAclsEnabled()).thenReturn(true);
+ IAccessAuthorizer authorizer = mock(IAccessAuthorizer.class);
+ when(authorizer.isNative()).thenReturn(false);
+ when(ozoneManager.getAccessAuthorizer()).thenReturn(authorizer);
+
+ OMRequest omRequest =
+ createDeleteLifecycleConfigurationRequest(volumeName, bucketName);
+ OMLifecycleConfigurationDeleteRequest request =
+ spy(new OMLifecycleConfigurationDeleteRequest(omRequest));
+ // Stub the ACL check so the branch can be asserted without a real
authorizer.
+ doNothing().when(request).checkAcls(eq(ozoneManager),
eq(OzoneObj.ResourceType.BUCKET),
+ eq(OzoneObj.StoreType.OZONE), eq(IAccessAuthorizer.ACLType.WRITE),
+ eq(volumeName), eq(bucketName), isNull());
+
+ request.preExecute(ozoneManager);
+
+ verify(request).checkAcls(eq(ozoneManager),
eq(OzoneObj.ResourceType.BUCKET),
+ eq(OzoneObj.StoreType.OZONE), eq(IAccessAuthorizer.ACLType.WRITE),
+ eq(volumeName), eq(bucketName), isNull());
+ }
+
+ @Test
+ public void testPreExecuteNativeAuthorizerDeniesNonAdminNonOwner() throws
Exception {
+ String volumeName = UUID.randomUUID().toString();
+ String bucketName = UUID.randomUUID().toString();
+
+ when(ozoneManager.getAclsEnabled()).thenReturn(true);
+ IAccessAuthorizer authorizer = mock(IAccessAuthorizer.class);
+ when(authorizer.isNative()).thenReturn(true);
+ when(ozoneManager.getAccessAuthorizer()).thenReturn(authorizer);
+ when(ozoneManager.getBucketOwner(eq(volumeName), eq(bucketName),
+ any(IAccessAuthorizer.ACLType.class),
any(OzoneObj.ResourceType.class)))
+ .thenReturn("bucketOwner");
+
when(ozoneManager.isAdmin(any(UserGroupInformation.class))).thenReturn(false);
+ when(ozoneManager.isOwner(any(UserGroupInformation.class),
anyString())).thenReturn(false);
+
+ OMRequest omRequest =
+ createDeleteLifecycleConfigurationRequest(volumeName, bucketName);
+ OMLifecycleConfigurationDeleteRequest request =
+ new OMLifecycleConfigurationDeleteRequest(omRequest);
+ request.setUGI(UserGroupInformation.createRemoteUser("regularUser"));
+
+ OMException ex = assertThrows(OMException.class,
+ () -> request.preExecute(ozoneManager));
+ assertEquals(OMException.ResultCodes.PERMISSION_DENIED, ex.getResult());
+ }
+
+ @Test
+ public void testPreExecuteNativeAuthorizerAllowsAdmin() throws Exception {
+ String volumeName = UUID.randomUUID().toString();
+ String bucketName = UUID.randomUUID().toString();
+
+ when(ozoneManager.getAclsEnabled()).thenReturn(true);
+ IAccessAuthorizer authorizer = mock(IAccessAuthorizer.class);
+ when(authorizer.isNative()).thenReturn(true);
+ when(ozoneManager.getAccessAuthorizer()).thenReturn(authorizer);
+
when(ozoneManager.isAdmin(any(UserGroupInformation.class))).thenReturn(true);
+
+ OMRequest omRequest =
+ createDeleteLifecycleConfigurationRequest(volumeName, bucketName);
+ OMLifecycleConfigurationDeleteRequest request =
+ new OMLifecycleConfigurationDeleteRequest(omRequest);
+ request.setUGI(UserGroupInformation.createRemoteUser("adminUser"));
+
+ assertNotNull(request.preExecute(ozoneManager));
+ }
+
+ @Test
+ public void testPreExecuteNativeAuthorizerAllowsOwner() throws Exception {
+ String volumeName = UUID.randomUUID().toString();
+ String bucketName = UUID.randomUUID().toString();
+
+ when(ozoneManager.getAclsEnabled()).thenReturn(true);
+ IAccessAuthorizer authorizer = mock(IAccessAuthorizer.class);
+ when(authorizer.isNative()).thenReturn(true);
+ when(ozoneManager.getAccessAuthorizer()).thenReturn(authorizer);
+ when(ozoneManager.getBucketOwner(eq(volumeName), eq(bucketName),
+ any(IAccessAuthorizer.ACLType.class),
any(OzoneObj.ResourceType.class)))
+ .thenReturn("bucketOwner");
+
when(ozoneManager.isAdmin(any(UserGroupInformation.class))).thenReturn(false);
+ when(ozoneManager.isOwner(any(UserGroupInformation.class),
eq("bucketOwner")))
+ .thenReturn(true);
+
+ OMRequest omRequest =
+ createDeleteLifecycleConfigurationRequest(volumeName, bucketName);
+ OMLifecycleConfigurationDeleteRequest request =
+ new OMLifecycleConfigurationDeleteRequest(omRequest);
+ request.setUGI(UserGroupInformation.createRemoteUser("ownerUser"));
+
+ assertNotNull(request.preExecute(ozoneManager));
+ }
+
@Test
public void testAllowDeleteLifecycleConfigurationAfterFinalization() throws
Exception {
String volumeName = UUID.randomUUID().toString();
diff --git
a/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/lifecycle/TestOMLifecycleConfigurationSetRequest.java
b/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/lifecycle/TestOMLifecycleConfigurationSetRequest.java
index e79f7b5716e..721a012f5a7 100644
---
a/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/lifecycle/TestOMLifecycleConfigurationSetRequest.java
+++
b/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/lifecycle/TestOMLifecycleConfigurationSetRequest.java
@@ -24,7 +24,13 @@
import static org.junit.jupiter.api.Assertions.assertNull;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.anyString;
+import static org.mockito.Mockito.doNothing;
+import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.isNull;
import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;
import java.util.UUID;
@@ -44,7 +50,10 @@
import
org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos.OMRequest;
import
org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos.OMResponse;
import org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos.Type;
+import org.apache.hadoop.ozone.security.acl.IAccessAuthorizer;
+import org.apache.hadoop.ozone.security.acl.OzoneObj;
import org.apache.hadoop.ozone.upgrade.LayoutVersionManager;
+import org.apache.hadoop.security.UserGroupInformation;
import org.junit.jupiter.api.Test;
/**
@@ -246,6 +255,103 @@ private void verifyRequest(OMRequest modifiedRequest,
assertEquals(original.getRulesList(), updated.getRulesList());
}
+ @Test
+ public void testPreExecuteNonNativeAuthorizerChecksWriteAcl() throws
Exception {
+ String volumeName = UUID.randomUUID().toString();
+ String bucketName = UUID.randomUUID().toString();
+
+ when(ozoneManager.getAclsEnabled()).thenReturn(true);
+ IAccessAuthorizer authorizer = mock(IAccessAuthorizer.class);
+ when(authorizer.isNative()).thenReturn(false);
+ when(ozoneManager.getAccessAuthorizer()).thenReturn(authorizer);
+
+ OMRequest omRequest =
+ setLifecycleConfigurationRequest(volumeName, bucketName, "ownerName");
+ OMLifecycleConfigurationSetRequest request =
+ spy(new OMLifecycleConfigurationSetRequest(omRequest));
+ // Stub the ACL check so the branch can be asserted without a real
authorizer.
+ doNothing().when(request).checkAcls(eq(ozoneManager),
eq(OzoneObj.ResourceType.BUCKET),
+ eq(OzoneObj.StoreType.OZONE), eq(IAccessAuthorizer.ACLType.WRITE),
+ eq(volumeName), eq(bucketName), isNull());
+
+ request.preExecute(ozoneManager);
+
+ verify(request).checkAcls(eq(ozoneManager),
eq(OzoneObj.ResourceType.BUCKET),
+ eq(OzoneObj.StoreType.OZONE), eq(IAccessAuthorizer.ACLType.WRITE),
+ eq(volumeName), eq(bucketName), isNull());
+ }
+
+ @Test
+ public void testPreExecuteNativeAuthorizerDeniesNonAdminNonOwner() throws
Exception {
+ String volumeName = UUID.randomUUID().toString();
+ String bucketName = UUID.randomUUID().toString();
+
+ when(ozoneManager.getAclsEnabled()).thenReturn(true);
+ IAccessAuthorizer authorizer = mock(IAccessAuthorizer.class);
+ when(authorizer.isNative()).thenReturn(true);
+ when(ozoneManager.getAccessAuthorizer()).thenReturn(authorizer);
+ when(ozoneManager.getBucketOwner(eq(volumeName), eq(bucketName),
+ any(IAccessAuthorizer.ACLType.class),
any(OzoneObj.ResourceType.class)))
+ .thenReturn("bucketOwner");
+
when(ozoneManager.isAdmin(any(UserGroupInformation.class))).thenReturn(false);
+ when(ozoneManager.isOwner(any(UserGroupInformation.class),
anyString())).thenReturn(false);
+
+ OMRequest omRequest =
+ setLifecycleConfigurationRequest(volumeName, bucketName, "ownerName");
+ OMLifecycleConfigurationSetRequest request =
+ new OMLifecycleConfigurationSetRequest(omRequest);
+ request.setUGI(UserGroupInformation.createRemoteUser("regularUser"));
+
+ OMException ex = assertThrows(OMException.class,
+ () -> request.preExecute(ozoneManager));
+ assertEquals(OMException.ResultCodes.PERMISSION_DENIED, ex.getResult());
+ }
+
+ @Test
+ public void testPreExecuteNativeAuthorizerAllowsAdmin() throws Exception {
+ String volumeName = UUID.randomUUID().toString();
+ String bucketName = UUID.randomUUID().toString();
+
+ when(ozoneManager.getAclsEnabled()).thenReturn(true);
+ IAccessAuthorizer authorizer = mock(IAccessAuthorizer.class);
+ when(authorizer.isNative()).thenReturn(true);
+ when(ozoneManager.getAccessAuthorizer()).thenReturn(authorizer);
+
when(ozoneManager.isAdmin(any(UserGroupInformation.class))).thenReturn(true);
+
+ OMRequest omRequest =
+ setLifecycleConfigurationRequest(volumeName, bucketName, "ownerName");
+ OMLifecycleConfigurationSetRequest request =
+ new OMLifecycleConfigurationSetRequest(omRequest);
+ request.setUGI(UserGroupInformation.createRemoteUser("adminUser"));
+
+ assertNotNull(request.preExecute(ozoneManager));
+ }
+
+ @Test
+ public void testPreExecuteNativeAuthorizerAllowsOwner() throws Exception {
+ String volumeName = UUID.randomUUID().toString();
+ String bucketName = UUID.randomUUID().toString();
+
+ when(ozoneManager.getAclsEnabled()).thenReturn(true);
+ IAccessAuthorizer authorizer = mock(IAccessAuthorizer.class);
+ when(authorizer.isNative()).thenReturn(true);
+ when(ozoneManager.getAccessAuthorizer()).thenReturn(authorizer);
+ when(ozoneManager.getBucketOwner(eq(volumeName), eq(bucketName),
+ any(IAccessAuthorizer.ACLType.class),
any(OzoneObj.ResourceType.class)))
+ .thenReturn("bucketOwner");
+
when(ozoneManager.isAdmin(any(UserGroupInformation.class))).thenReturn(false);
+ when(ozoneManager.isOwner(any(UserGroupInformation.class),
eq("bucketOwner")))
+ .thenReturn(true);
+
+ OMRequest omRequest =
+ setLifecycleConfigurationRequest(volumeName, bucketName, "ownerName");
+ OMLifecycleConfigurationSetRequest request =
+ new OMLifecycleConfigurationSetRequest(omRequest);
+ request.setUGI(UserGroupInformation.createRemoteUser("ownerUser"));
+
+ assertNotNull(request.preExecute(ozoneManager));
+ }
+
@Test
public void testDisallowSetLifecycleConfigurationBeforeFinalization() throws
Exception {
String volumeName = UUID.randomUUID().toString();
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
