HADOOP-15710. ABFS checkException to map 403 to AccessDeniedException.

hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystem.java

@@ -26,6 +26,7 @@
 import java.net.HttpURLConnection;
 import java.net.URI;
 import java.net.URISyntaxException;
+import java.nio.file.AccessDeniedException;
 import java.util.Hashtable;
 import java.util.List;
 import java.util.ArrayList;
@@ -1125,16 +1126,21 @@ private void checkException(final Path path,
       if (ArrayUtils.contains(allowedErrorCodesList, ere.getErrorCode())) {
         return;
       }
-      int statusCode = ere.getStatusCode();
-
       //AbfsRestOperationException.getMessage() contains full error info including path/uri.
-      if (statusCode == HttpURLConnection.HTTP_NOT_FOUND) {
-        throw (IOException) new FileNotFoundException(ere.getMessage())
+      String message = ere.getMessage();
+
+      switch (ere.getStatusCode()) {
+      case HttpURLConnection.HTTP_NOT_FOUND:
+        throw (IOException) new FileNotFoundException(message)
+            .initCause(exception);
+      case HttpURLConnection.HTTP_CONFLICT:
+        throw (IOException) new FileAlreadyExistsException(message)
             .initCause(exception);
-      } else if (statusCode == HttpURLConnection.HTTP_CONFLICT) {
-        throw (IOException) new FileAlreadyExistsException(ere.getMessage())
+      case HttpURLConnection.HTTP_FORBIDDEN:
+      case HttpURLConnection.HTTP_UNAUTHORIZED:
+        throw (IOException) new AccessDeniedException(message)
             .initCause(exception);
-      } else {
+      default:
         throw ere;
       }
     } else if (exception instanceof SASTokenProviderException) {

hadoop-tools/hadoop-azure/src/test/java/org/apache/hadoop/fs/azurebfs/ITestAbfsRestOperationException.java

@@ -19,17 +19,21 @@
 package org.apache.hadoop.fs.azurebfs;
 
 import java.io.IOException;
+import java.nio.file.AccessDeniedException;
 
 import org.apache.hadoop.conf.Configuration;
 import org.apache.hadoop.fs.azurebfs.oauth2.RetryTestTokenProvider;
 import org.apache.hadoop.fs.FileStatus;
 import org.apache.hadoop.fs.FileSystem;
 import org.apache.hadoop.fs.Path;
+import org.apache.hadoop.fs.contract.ContractTestUtils;
+import org.apache.hadoop.fs.permission.FsPermission;
 
 import org.junit.Assert;
 import org.junit.Test;
 
 import static org.apache.hadoop.test.LambdaTestUtils.intercept;
+import static org.junit.Assume.assumeTrue;
 
 /**
  * Verify the AbfsRestOperationException error message format.
@@ -114,4 +118,19 @@ public void testWithDifferentCustomTokenFetchRetry(int numOfRetries) throws Exce
             + ") done, does not match with fs.azure.custom.token.fetch.retry.count configured (" + numOfRetries
             + ")", RetryTestTokenProvider.reTryCount == numOfRetries);
   }
-}
+
+  @Test
+  public void testPermissionDenied() throws Throwable {
+    final AzureBlobFileSystem fs = getFileSystem();
+    assumeTrue(fs.getIsNamespaceEnabled());
+    Path dir = new Path("testPermissionDenied");
+    Path path = new Path(dir, "file");
+    ContractTestUtils.writeTextFile(fs, path, "some text", true);
+    // no permissions
+    fs.setPermission(path, new FsPermission((short) 00000));
+    fs.setPermission(dir, new FsPermission((short) 00000));
+    intercept(AccessDeniedException.class, () ->
+        fs.delete(path, false));
+    intercept(AccessDeniedException.class, () ->
+        ContractTestUtils.readUTF8(fs, path, -1));
+  }}