|
|
@@ -0,0 +1,301 @@
|
|
|
+/**
|
|
|
+ * Licensed to the Apache Software Foundation (ASF) under one
|
|
|
+ * or more contributor license agreements. See the NOTICE file
|
|
|
+ * distributed with this work for additional information
|
|
|
+ * regarding copyright ownership. The ASF licenses this file
|
|
|
+ * to you under the Apache License, Version 2.0 (the
|
|
|
+ * "License"); you may not use this file except in compliance
|
|
|
+ * with the License. You may obtain a copy of the License at
|
|
|
+ *
|
|
|
+ * http://www.apache.org/licenses/LICENSE-2.0
|
|
|
+ *
|
|
|
+ * Unless required by applicable law or agreed to in writing, software
|
|
|
+ * distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
+ * See the License for the specific language governing permissions and
|
|
|
+ * limitations under the License.
|
|
|
+ */
|
|
|
+
|
|
|
+package org.apache.hadoop.fs.azurebfs;
|
|
|
+
|
|
|
+import java.io.IOException;
|
|
|
+import java.util.List;
|
|
|
+import java.util.UUID;
|
|
|
+
|
|
|
+import com.google.common.collect.Lists;
|
|
|
+import org.apache.hadoop.fs.azurebfs.oauth2.IdentityTransformer;
|
|
|
+import org.apache.hadoop.fs.permission.AclEntry;
|
|
|
+import org.junit.Test;
|
|
|
+
|
|
|
+import org.apache.hadoop.conf.Configuration;
|
|
|
+import org.apache.hadoop.security.UserGroupInformation;
|
|
|
+
|
|
|
+import static org.apache.hadoop.fs.azurebfs.constants.AbfsHttpConstants.SUPER_USER;
|
|
|
+import static org.apache.hadoop.fs.azurebfs.constants.ConfigurationKeys.FS_AZURE_FILE_OWNER_DOMAINNAME;
|
|
|
+import static org.apache.hadoop.fs.azurebfs.constants.ConfigurationKeys.FS_AZURE_FILE_OWNER_ENABLE_SHORTNAME;
|
|
|
+import static org.apache.hadoop.fs.azurebfs.constants.ConfigurationKeys.FS_AZURE_OVERRIDE_OWNER_SP;
|
|
|
+import static org.apache.hadoop.fs.azurebfs.constants.ConfigurationKeys.FS_AZURE_OVERRIDE_OWNER_SP_LIST;
|
|
|
+import static org.apache.hadoop.fs.azurebfs.constants.ConfigurationKeys.FS_AZURE_SKIP_SUPER_USER_REPLACEMENT;
|
|
|
+import static org.apache.hadoop.fs.azurebfs.utils.AclTestHelpers.aclEntry;
|
|
|
+import static org.apache.hadoop.fs.permission.AclEntryScope.ACCESS;
|
|
|
+import static org.apache.hadoop.fs.permission.AclEntryScope.DEFAULT;
|
|
|
+import static org.apache.hadoop.fs.permission.AclEntryType.GROUP;
|
|
|
+import static org.apache.hadoop.fs.permission.AclEntryType.MASK;
|
|
|
+import static org.apache.hadoop.fs.permission.AclEntryType.OTHER;
|
|
|
+import static org.apache.hadoop.fs.permission.AclEntryType.USER;
|
|
|
+import static org.apache.hadoop.fs.permission.FsAction.ALL;
|
|
|
+
|
|
|
+/**
|
|
|
+ * Test IdentityTransformer.
|
|
|
+ */
|
|
|
+//@RunWith(Parameterized.class)
|
|
|
+public class ITestAbfsIdentityTransformer extends AbstractAbfsScaleTest{
|
|
|
+ private final UserGroupInformation userGroupInfo;
|
|
|
+ private final String localUser;
|
|
|
+ private final String localGroup;
|
|
|
+ private static final String DAEMON = "daemon";
|
|
|
+ private static final String ASTERISK = "*";
|
|
|
+ private static final String SHORT_NAME = "abc";
|
|
|
+ private static final String DOMAIN = "domain.com";
|
|
|
+ private static final String FULLY_QUALIFIED_NAME = "abc@domain.com";
|
|
|
+ private static final String SERVICE_PRINCIPAL_ID = UUID.randomUUID().toString();
|
|
|
+
|
|
|
+ public ITestAbfsIdentityTransformer() throws Exception {
|
|
|
+ super();
|
|
|
+ userGroupInfo = UserGroupInformation.getCurrentUser();
|
|
|
+ localUser = userGroupInfo.getShortUserName();
|
|
|
+ localGroup = userGroupInfo.getPrimaryGroupName();
|
|
|
+ }
|
|
|
+
|
|
|
+ @Test
|
|
|
+ public void testDaemonServiceSettingIdentity() throws IOException {
|
|
|
+ Configuration config = this.getRawConfiguration();
|
|
|
+ resetIdentityConfig(config);
|
|
|
+ // Default config
|
|
|
+ IdentityTransformer identityTransformer = getTransformerWithDefaultIdentityConfig(config);
|
|
|
+ assertEquals("Identity should not change for default config",
|
|
|
+ DAEMON, identityTransformer.transformUserOrGroupForSetRequest(DAEMON));
|
|
|
+
|
|
|
+ // Add service principal id
|
|
|
+ config.set(FS_AZURE_OVERRIDE_OWNER_SP, SERVICE_PRINCIPAL_ID);
|
|
|
+
|
|
|
+ // case 1: substitution list doesn't contain daemon
|
|
|
+ config.set(FS_AZURE_OVERRIDE_OWNER_SP_LIST, "a,b,c,d");
|
|
|
+ identityTransformer = getTransformerWithCustomizedIdentityConfig(config);
|
|
|
+ assertEquals("Identity should not change when substitution list doesn't contain daemon",
|
|
|
+ DAEMON, identityTransformer.transformUserOrGroupForSetRequest(DAEMON));
|
|
|
+
|
|
|
+ // case 2: substitution list contains daemon name
|
|
|
+ config.set(FS_AZURE_OVERRIDE_OWNER_SP_LIST, DAEMON + ",a,b,c,d");
|
|
|
+ identityTransformer = getTransformerWithCustomizedIdentityConfig(config);
|
|
|
+ assertEquals("Identity should be replaced to servicePrincipalId",
|
|
|
+ SERVICE_PRINCIPAL_ID, identityTransformer.transformUserOrGroupForSetRequest(DAEMON));
|
|
|
+
|
|
|
+ // case 3: substitution list is *
|
|
|
+ config.set(FS_AZURE_OVERRIDE_OWNER_SP_LIST, ASTERISK);
|
|
|
+ identityTransformer = getTransformerWithCustomizedIdentityConfig(config);
|
|
|
+ assertEquals("Identity should be replaced to servicePrincipalId",
|
|
|
+ SERVICE_PRINCIPAL_ID, identityTransformer.transformUserOrGroupForSetRequest(DAEMON));
|
|
|
+ }
|
|
|
+
|
|
|
+ @Test
|
|
|
+ public void testFullyQualifiedNameSettingIdentity() throws IOException {
|
|
|
+ Configuration config = this.getRawConfiguration();
|
|
|
+ // Default config
|
|
|
+ IdentityTransformer identityTransformer = getTransformerWithDefaultIdentityConfig(config);
|
|
|
+ assertEquals("short name should not be converted to full name by default",
|
|
|
+ SHORT_NAME, identityTransformer.transformUserOrGroupForSetRequest(SHORT_NAME));
|
|
|
+
|
|
|
+ resetIdentityConfig(config);
|
|
|
+
|
|
|
+ // Add config to get fully qualified username
|
|
|
+ config.setBoolean(FS_AZURE_FILE_OWNER_ENABLE_SHORTNAME, true);
|
|
|
+ config.set(FS_AZURE_FILE_OWNER_DOMAINNAME, DOMAIN);
|
|
|
+ identityTransformer = getTransformerWithCustomizedIdentityConfig(config);
|
|
|
+ assertEquals("short name should be converted to full name",
|
|
|
+ FULLY_QUALIFIED_NAME, identityTransformer.transformUserOrGroupForSetRequest(SHORT_NAME));
|
|
|
+ }
|
|
|
+
|
|
|
+ @Test
|
|
|
+ public void testNoOpForSettingOidAsIdentity() throws IOException {
|
|
|
+ Configuration config = this.getRawConfiguration();
|
|
|
+ resetIdentityConfig(config);
|
|
|
+
|
|
|
+ config.setBoolean(FS_AZURE_FILE_OWNER_ENABLE_SHORTNAME, true);
|
|
|
+ config.set(FS_AZURE_FILE_OWNER_DOMAINNAME, DOMAIN);
|
|
|
+ config.set(FS_AZURE_OVERRIDE_OWNER_SP, UUID.randomUUID().toString());
|
|
|
+ config.set(FS_AZURE_OVERRIDE_OWNER_SP_LIST, "a,b,c,d");
|
|
|
+
|
|
|
+ IdentityTransformer identityTransformer = getTransformerWithCustomizedIdentityConfig(config);
|
|
|
+ final String principalId = UUID.randomUUID().toString();
|
|
|
+ assertEquals("Identity should not be changed when owner is already a principal id ",
|
|
|
+ principalId, identityTransformer.transformUserOrGroupForSetRequest(principalId));
|
|
|
+ }
|
|
|
+
|
|
|
+ @Test
|
|
|
+ public void testNoOpWhenSettingSuperUserAsdentity() throws IOException {
|
|
|
+ Configuration config = this.getRawConfiguration();
|
|
|
+ resetIdentityConfig(config);
|
|
|
+
|
|
|
+ config.setBoolean(FS_AZURE_FILE_OWNER_ENABLE_SHORTNAME, true);
|
|
|
+ config.set(FS_AZURE_FILE_OWNER_DOMAINNAME, DOMAIN);
|
|
|
+ // Default config
|
|
|
+ IdentityTransformer identityTransformer = getTransformerWithDefaultIdentityConfig(config);
|
|
|
+ assertEquals("Identity should not be changed because it is not in substitution list",
|
|
|
+ SUPER_USER, identityTransformer.transformUserOrGroupForSetRequest(SUPER_USER));
|
|
|
+ }
|
|
|
+
|
|
|
+ @Test
|
|
|
+ public void testIdentityReplacementForSuperUserGetRequest() throws IOException {
|
|
|
+ Configuration config = this.getRawConfiguration();
|
|
|
+ resetIdentityConfig(config);
|
|
|
+
|
|
|
+ // with default config, identityTransformer should do $superUser replacement
|
|
|
+ IdentityTransformer identityTransformer = getTransformerWithDefaultIdentityConfig(config);
|
|
|
+ assertEquals("$superuser should be replaced with local user by default",
|
|
|
+ localUser, identityTransformer.transformIdentityForGetRequest(SUPER_USER, localUser));
|
|
|
+
|
|
|
+ // Disable $supeuser replacement
|
|
|
+ config.setBoolean(FS_AZURE_SKIP_SUPER_USER_REPLACEMENT, true);
|
|
|
+ identityTransformer = getTransformerWithCustomizedIdentityConfig(config);
|
|
|
+ assertEquals("$superuser should not be replaced",
|
|
|
+ SUPER_USER, identityTransformer.transformIdentityForGetRequest(SUPER_USER, localUser));
|
|
|
+ }
|
|
|
+
|
|
|
+ @Test
|
|
|
+ public void testIdentityReplacementForDaemonServiceGetRequest() throws IOException {
|
|
|
+ Configuration config = this.getRawConfiguration();
|
|
|
+ resetIdentityConfig(config);
|
|
|
+
|
|
|
+ // Default config
|
|
|
+ IdentityTransformer identityTransformer = getTransformerWithDefaultIdentityConfig(config);
|
|
|
+ assertEquals("By default servicePrincipalId should not be converted for GetFileStatus(), listFileStatus(), getAcl()",
|
|
|
+ SERVICE_PRINCIPAL_ID, identityTransformer.transformIdentityForGetRequest(SERVICE_PRINCIPAL_ID, localUser));
|
|
|
+
|
|
|
+ resetIdentityConfig(config);
|
|
|
+ // 1. substitution list doesn't contain currentUser
|
|
|
+ config.set(FS_AZURE_OVERRIDE_OWNER_SP_LIST, "a,b,c,d");
|
|
|
+ identityTransformer = getTransformerWithCustomizedIdentityConfig(config);
|
|
|
+ assertEquals("servicePrincipalId should not be replaced if local daemon user is not in substitution list",
|
|
|
+ SERVICE_PRINCIPAL_ID, identityTransformer.transformIdentityForGetRequest(SERVICE_PRINCIPAL_ID, localUser));
|
|
|
+
|
|
|
+ resetIdentityConfig(config);
|
|
|
+ // 2. substitution list contains currentUser(daemon name) but the service principal id in config doesn't match
|
|
|
+ config.set(FS_AZURE_OVERRIDE_OWNER_SP_LIST, localUser + ",a,b,c,d");
|
|
|
+ config.set(FS_AZURE_OVERRIDE_OWNER_SP, UUID.randomUUID().toString());
|
|
|
+ identityTransformer = getTransformerWithCustomizedIdentityConfig(config);
|
|
|
+ assertEquals("servicePrincipalId should not be replaced if it is not equal to the SPN set in config",
|
|
|
+ SERVICE_PRINCIPAL_ID, identityTransformer.transformIdentityForGetRequest(SERVICE_PRINCIPAL_ID, localUser));
|
|
|
+
|
|
|
+ resetIdentityConfig(config);
|
|
|
+ // 3. substitution list contains currentUser(daemon name) and the service principal id in config matches
|
|
|
+ config.set(FS_AZURE_OVERRIDE_OWNER_SP_LIST, localUser + ",a,b,c,d");
|
|
|
+ config.set(FS_AZURE_OVERRIDE_OWNER_SP, SERVICE_PRINCIPAL_ID);
|
|
|
+ identityTransformer = getTransformerWithCustomizedIdentityConfig(config);
|
|
|
+ assertEquals("servicePrincipalId should be transformed to local use",
|
|
|
+ localUser, identityTransformer.transformIdentityForGetRequest(SERVICE_PRINCIPAL_ID, localUser));
|
|
|
+
|
|
|
+ resetIdentityConfig(config);
|
|
|
+ // 4. substitution is "*" but the service principal id in config doesn't match the input
|
|
|
+ config.set(FS_AZURE_OVERRIDE_OWNER_SP_LIST, ASTERISK);
|
|
|
+ config.set(FS_AZURE_OVERRIDE_OWNER_SP, UUID.randomUUID().toString());
|
|
|
+ identityTransformer = getTransformerWithCustomizedIdentityConfig(config);
|
|
|
+ assertEquals("servicePrincipalId should not be replaced if it is not equal to the SPN set in config",
|
|
|
+ SERVICE_PRINCIPAL_ID, identityTransformer.transformIdentityForGetRequest(SERVICE_PRINCIPAL_ID, localUser));
|
|
|
+
|
|
|
+ resetIdentityConfig(config);
|
|
|
+ // 5. substitution is "*" and the service principal id in config match the input
|
|
|
+ config.set(FS_AZURE_OVERRIDE_OWNER_SP_LIST, ASTERISK);
|
|
|
+ config.set(FS_AZURE_OVERRIDE_OWNER_SP, SERVICE_PRINCIPAL_ID);
|
|
|
+ identityTransformer = getTransformerWithCustomizedIdentityConfig(config);
|
|
|
+ assertEquals("servicePrincipalId should be transformed to local user",
|
|
|
+ localUser, identityTransformer.transformIdentityForGetRequest(SERVICE_PRINCIPAL_ID, localUser));
|
|
|
+ }
|
|
|
+
|
|
|
+ @Test
|
|
|
+ public void testIdentityReplacementForKinitUserGetRequest() throws IOException {
|
|
|
+ Configuration config = this.getRawConfiguration();
|
|
|
+ resetIdentityConfig(config);
|
|
|
+
|
|
|
+ // Default config
|
|
|
+ IdentityTransformer identityTransformer = getTransformerWithDefaultIdentityConfig(config);
|
|
|
+ assertEquals("full name should not be transformed if shortname is not enabled",
|
|
|
+ FULLY_QUALIFIED_NAME, identityTransformer.transformIdentityForGetRequest(FULLY_QUALIFIED_NAME, localUser));
|
|
|
+
|
|
|
+ // add config to get short name
|
|
|
+ config.setBoolean(FS_AZURE_FILE_OWNER_ENABLE_SHORTNAME, true);
|
|
|
+ identityTransformer = getTransformerWithCustomizedIdentityConfig(config);
|
|
|
+ assertEquals("should convert the full name to shortname ",
|
|
|
+ SHORT_NAME, identityTransformer.transformIdentityForGetRequest(FULLY_QUALIFIED_NAME, localUser));
|
|
|
+ }
|
|
|
+
|
|
|
+ @Test
|
|
|
+ public void transformAclEntriesForSetRequest() throws IOException {
|
|
|
+ Configuration config = this.getRawConfiguration();
|
|
|
+ resetIdentityConfig(config);
|
|
|
+
|
|
|
+ List<AclEntry> aclEntriesToBeTransformed = Lists.newArrayList(
|
|
|
+ aclEntry(ACCESS, USER, DAEMON, ALL),
|
|
|
+ aclEntry(ACCESS, USER, FULLY_QUALIFIED_NAME,ALL),
|
|
|
+ aclEntry(DEFAULT, USER, SUPER_USER, ALL),
|
|
|
+ aclEntry(DEFAULT, USER, SERVICE_PRINCIPAL_ID, ALL),
|
|
|
+ aclEntry(DEFAULT, USER, SHORT_NAME, ALL),
|
|
|
+ aclEntry(DEFAULT, GROUP, DAEMON, ALL),
|
|
|
+ aclEntry(DEFAULT, GROUP, SHORT_NAME, ALL), // Notice: for group type ACL entry, if name is shortName,
|
|
|
+ aclEntry(DEFAULT, OTHER, ALL), // It won't be converted to Full Name. This is
|
|
|
+ aclEntry(DEFAULT, MASK, ALL) // to make the behavior consistent with HDI.
|
|
|
+ );
|
|
|
+
|
|
|
+ // Default config should not change the identities
|
|
|
+ IdentityTransformer identityTransformer = getTransformerWithDefaultIdentityConfig(config);
|
|
|
+ checkAclEntriesList(aclEntriesToBeTransformed, identityTransformer.transformAclEntriesForSetRequest(aclEntriesToBeTransformed));
|
|
|
+
|
|
|
+ resetIdentityConfig(config);
|
|
|
+ // With config
|
|
|
+ config.set(FS_AZURE_OVERRIDE_OWNER_SP_LIST, DAEMON + ",a,b,c,d");
|
|
|
+ config.setBoolean(FS_AZURE_FILE_OWNER_ENABLE_SHORTNAME, true);
|
|
|
+ config.set(FS_AZURE_FILE_OWNER_DOMAINNAME, DOMAIN);
|
|
|
+ config.set(FS_AZURE_OVERRIDE_OWNER_SP, SERVICE_PRINCIPAL_ID);
|
|
|
+ identityTransformer = getTransformerWithCustomizedIdentityConfig(config);
|
|
|
+
|
|
|
+ // expected acl entries
|
|
|
+ List<AclEntry> expectedAclEntries = Lists.newArrayList(
|
|
|
+ aclEntry(ACCESS, USER, SERVICE_PRINCIPAL_ID, ALL),
|
|
|
+ aclEntry(ACCESS, USER, FULLY_QUALIFIED_NAME, ALL),
|
|
|
+ aclEntry(DEFAULT, USER, SUPER_USER, ALL),
|
|
|
+ aclEntry(DEFAULT, USER, SERVICE_PRINCIPAL_ID, ALL),
|
|
|
+ aclEntry(DEFAULT, USER, FULLY_QUALIFIED_NAME, ALL),
|
|
|
+ aclEntry(DEFAULT, GROUP, SERVICE_PRINCIPAL_ID, ALL),
|
|
|
+ aclEntry(DEFAULT, GROUP, SHORT_NAME, ALL),
|
|
|
+ aclEntry(DEFAULT, OTHER, ALL),
|
|
|
+ aclEntry(DEFAULT, MASK, ALL)
|
|
|
+ );
|
|
|
+
|
|
|
+ checkAclEntriesList(identityTransformer.transformAclEntriesForSetRequest(aclEntriesToBeTransformed), expectedAclEntries);
|
|
|
+
|
|
|
+ }
|
|
|
+
|
|
|
+ private void resetIdentityConfig(Configuration config) {
|
|
|
+ config.unset(FS_AZURE_FILE_OWNER_ENABLE_SHORTNAME);
|
|
|
+ config.unset(FS_AZURE_FILE_OWNER_DOMAINNAME);
|
|
|
+ config.unset(FS_AZURE_OVERRIDE_OWNER_SP);
|
|
|
+ config.unset(FS_AZURE_OVERRIDE_OWNER_SP_LIST);
|
|
|
+ config.unset(FS_AZURE_SKIP_SUPER_USER_REPLACEMENT);
|
|
|
+ }
|
|
|
+
|
|
|
+ private IdentityTransformer getTransformerWithDefaultIdentityConfig(Configuration config) throws IOException {
|
|
|
+ resetIdentityConfig(config);
|
|
|
+ return new IdentityTransformer(config);
|
|
|
+ }
|
|
|
+
|
|
|
+ private IdentityTransformer getTransformerWithCustomizedIdentityConfig(Configuration config) throws IOException {
|
|
|
+ return new IdentityTransformer(config);
|
|
|
+ }
|
|
|
+
|
|
|
+ private void checkAclEntriesList(List<AclEntry> aclEntries, List<AclEntry> expected) {
|
|
|
+ assertTrue("list size not equals", aclEntries.size() == expected.size());
|
|
|
+ for (int i = 0; i < aclEntries.size(); i++) {
|
|
|
+ assertEquals("Identity doesn't match", expected.get(i).getName(), aclEntries.get(i).getName());
|
|
|
+ }
|
|
|
+ }
|
|
|
+}
|
Da Zhou