Hello Zoltan Chovan, Alexey Serbin,
I'd like you to do a code review. Please visit
http://gerrit.cloudera.org:8080/24832
to review the following change.
Change subject: [tests] Add proxy user end-to-end test coverage
......................................................................
[tests] Add proxy user end-to-end test coverage
Thread the create-principal control request through the Java test
infrastructure (MiniKuduCluster.createUserPrincipal(), forwarded by
KuduTestHarness) so that Java tests can create arbitrary user principals
in the mini KDC before kinit.
Add TestProxyUser, a secure, cluster-backed test covering the Java
client side of proxy user support:
- testProxyUserActsAsTarget: a client authenticated via GSSAPI as
'proxy-service' connects with effectiveUser('proxy-target'). The
created table's owner must be the proxied target user, proving the
SASL authorization identity propagates through the JDK's GSSAPI SASL
client, passes server-side proxy authorization, and drives authz
attribution. Reads and writes are also exercised.
- testProxyUserDeniedTarget: an effective user that is not in the proxy
user ACL must be rejected (fail closed). The authoritative rejection
happens server-side during negotiation and is asserted in C++ by
SecurityITest.ProxyUser; from the client it surfaces as a connection
failure.
- testSameUserNeedsNoProxyRules: acting as the authenticated user does
not require proxy user rules.
The cluster runs with --rpc-authentication=required. Note that the
effective (proxied) users must be listed in --user-acl, since servers
authorize RPCs against the effective user.
Change-Id: I182cecc5c63e7b921c9c3a77ca3c121931632587
---
A java/kudu-client/src/test/java/org/apache/kudu/client/TestProxyUser.java
M java/kudu-test-utils/src/main/java/org/apache/kudu/test/KuduTestHarness.java
M
java/kudu-test-utils/src/main/java/org/apache/kudu/test/cluster/MiniKuduCluster.java
3 files changed, 164 insertions(+), 0 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/32/24832/1
--
To view, visit http://gerrit.cloudera.org:8080/24832
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: I182cecc5c63e7b921c9c3a77ca3c121931632587
Gerrit-Change-Number: 24832
Gerrit-PatchSet: 1
Gerrit-Owner: mintao <[email protected]>
Gerrit-Reviewer: Alexey Serbin <[email protected]>
Gerrit-Reviewer: Zoltan Chovan <[email protected]>
