This is an automated email from the ASF dual-hosted git repository. rzo1 pushed a commit to branch fix/nimbus-createstate-authorization in repository https://gitbox.apache.org/repos/asf/storm.git
commit 3371d2b65c63d574bde33c2bc2cc345c4abfaa06 Author: Richard Zowalla <[email protected]> AuthorDate: Sat Aug 22 20:03:13 2026 +0200 Authorize createStateInZookeeper requests like the other blob operations --- .../auth/authorizer/SimpleACLAuthorizer.java | 1 + .../auth/authorizer/SimpleACLAuthorizerTest.java | 5 +++++ .../org/apache/storm/daemon/nimbus/Nimbus.java | 1 + .../org/apache/storm/daemon/nimbus/NimbusTest.java | 22 ++++++++++++++++++++++ 4 files changed, 29 insertions(+) diff --git a/storm-client/src/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizer.java b/storm-client/src/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizer.java index 1e088752f..6cff51f57 100644 --- a/storm-client/src/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizer.java +++ b/storm-client/src/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizer.java @@ -38,6 +38,7 @@ public class SimpleACLAuthorizer implements IAuthorizer { protected Set<String> userCommands = new HashSet<>(Arrays.asList( "submitTopology", "fileUpload", + "createStateInZookeeper", "getNimbusConf", "getClusterInfo", "getLeader", diff --git a/storm-client/test/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizerTest.java b/storm-client/test/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizerTest.java index 15f4b9bbe..6b61af313 100644 --- a/storm-client/test/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizerTest.java +++ b/storm-client/test/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizerTest.java @@ -63,6 +63,11 @@ public class SimpleACLAuthorizerTest { assertTrue(authorizer.permit(new ReqContext(userA), "fileUpload", new HashMap<>())); assertTrue(authorizer.permit(new ReqContext(userB), "fileUpload", new HashMap<>())); + assertTrue(authorizer.permit(new ReqContext(adminUser), "createStateInZookeeper", new HashMap<>())); + assertFalse(authorizer.permit(new ReqContext(supervisorUser), "createStateInZookeeper", new HashMap<>())); + assertTrue(authorizer.permit(new ReqContext(userA), "createStateInZookeeper", new HashMap<>())); + assertTrue(authorizer.permit(new ReqContext(userB), "createStateInZookeeper", new HashMap<>())); + assertTrue(authorizer.permit(new ReqContext(adminUser), "getNimbusConf", new HashMap<>())); assertFalse(authorizer.permit(new ReqContext(supervisorUser), "getNimbusConf", new HashMap<>())); assertTrue(authorizer.permit(new ReqContext(userA), "getNimbusConf", new HashMap<>())); diff --git a/storm-server/src/main/java/org/apache/storm/daemon/nimbus/Nimbus.java b/storm-server/src/main/java/org/apache/storm/daemon/nimbus/Nimbus.java index ecf7dd2a2..58806053b 100644 --- a/storm-server/src/main/java/org/apache/storm/daemon/nimbus/Nimbus.java +++ b/storm-server/src/main/java/org/apache/storm/daemon/nimbus/Nimbus.java @@ -4137,6 +4137,7 @@ public class Nimbus implements Iface, Shutdownable, DaemonCommon { @Override public void createStateInZookeeper(String key) throws TException { try { + checkAuthorization(null, null, "createStateInZookeeper"); IStormClusterState state = stormClusterState; BlobStore store = blobStore; NimbusInfo ni = nimbusHostPortInfo; diff --git a/storm-server/src/test/java/org/apache/storm/daemon/nimbus/NimbusTest.java b/storm-server/src/test/java/org/apache/storm/daemon/nimbus/NimbusTest.java index 2380d49a8..6544fce39 100644 --- a/storm-server/src/test/java/org/apache/storm/daemon/nimbus/NimbusTest.java +++ b/storm-server/src/test/java/org/apache/storm/daemon/nimbus/NimbusTest.java @@ -45,6 +45,7 @@ import org.apache.storm.scheduler.resource.strategies.priority.DefaultScheduling import org.apache.storm.scheduler.resource.strategies.scheduling.DefaultResourceAwareStrategy; import org.apache.storm.scheduler.resource.strategies.scheduling.GenericResourceAwareStrategyOld; import org.apache.storm.scheduler.resource.strategies.scheduling.RoundRobinResourceAwareStrategy; +import org.apache.storm.security.auth.IAuthorizer; import org.apache.storm.security.auth.IGroupMappingServiceProvider; import org.apache.storm.testing.TestWordSpout; import org.apache.storm.thrift.TException; @@ -176,6 +177,27 @@ class NimbusTest { verify(stormClusterState).setupBlob(eq(BLOB_FILE_KEY), eq(nimbusInfo), any()); } + @Test + void testCreateStateInZookeeperIsNotAllowedWhenTheAuthorizerDeniesIt() throws Exception { + IAuthorizer authorizer = mock(IAuthorizer.class); + when(authorizer.permit(any(), eq("createStateInZookeeper"), any())).thenReturn(false); + nimbus.setAuthorizationHandler(authorizer); + + assertThrows(AuthorizationException.class, () -> nimbus.createStateInZookeeper(BLOB_FILE_KEY)); + verify(stormClusterState, never()).setupBlob(eq(BLOB_FILE_KEY), eq(nimbusInfo), any()); + } + + @Test + void testCreateStateInZookeeperIsAllowedWhenTheAuthorizerPermitsIt() throws Exception { + IAuthorizer authorizer = mock(IAuthorizer.class); + when(authorizer.permit(any(), eq("createStateInZookeeper"), any())).thenReturn(true); + nimbus.setAuthorizationHandler(authorizer); + + nimbus.createStateInZookeeper(BLOB_FILE_KEY); + + verify(stormClusterState).setupBlob(eq(BLOB_FILE_KEY), eq(nimbusInfo), any()); + } + @Test void testCreateStateInZookeeperWithoutLocalFsBlobStoreInstanceShouldNotCreate() throws Exception { BlobStore blobStore = mock(BlobStore.class);
