Skip to content

HDDS-4020. ACL commands like getacl and setacl should return a response only when Native Authorizer is enabled. #1271

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
bharatviswa504 wants to merge 1 commit into from
Closed

HDDS-4020. ACL commands like getacl and setacl should return a response only when Native Authorizer is enabled. #1271

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions hadoop-ozone/common/src/main/java/org/apache/hadoop/ozone/web/utils/OzoneUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,12 +30,16 @@

import org.apache.hadoop.hdds.annotation.InterfaceAudience;
import org.apache.hadoop.hdds.conf.ConfigurationSource;
import org.apache.hadoop.hdds.conf.OzoneConfiguration;
import org.apache.hadoop.hdds.scm.client.HddsClientUtils;
import org.apache.hadoop.ozone.OzoneConsts;

import com.google.common.base.Preconditions;
import org.apache.ratis.util.TimeDuration;

import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_ACL_AUTHORIZER_CLASS;
import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_ACL_AUTHORIZER_CLASS_DEFAULT;

/**
* Set of Utility functions used in ozone.
*/
Expand Down Expand Up @@ -166,4 +170,22 @@ public static long getTimeDurationInMS(ConfigurationSource conf, String key,
.toLong(TimeUnit.MILLISECONDS);
}

/**
* Return true, when Authorizer class is configured with non-default value.
* @param configuration
* @return boolean
*/
public static boolean checkExternalAuthorizer(
OzoneConfiguration configuration) {
String authorizerClass = configuration.get(OZONE_ACL_AUTHORIZER_CLASS);
if (authorizerClass != null &&
!authorizerClass.equals(OZONE_ACL_AUTHORIZER_CLASS_DEFAULT)) {
System.out.print(String.format("When External Authorizer %s is " +
Copy link
Contributor

@xiaoyuyao xiaoyuyao Jul 29, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we move System.out.print to AclHandler#execute based on the checkExternalAuthorizer return?

Copy link
Contributor

@xiaoyuyao xiaoyuyao Jul 29, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This configuration seem like a server side configuration and should come from authoritative source such as OM discovery.

What if the client does know what is configured on OM but OM is actually using native authorizer? If check based on client, we will not be able to do acl operations.

"configured, Acl commands are not supported via ozone shell.",
authorizerClass));
return true;
}
return false;
}

}
23 changes: 23 additions & 0 deletions hadoop-ozone/common/src/test/java/org/apache/hadoop/ozone/util/TestOzoneUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
package org.apache.hadoop.ozone.util;

import org.apache.hadoop.hdds.conf.OzoneConfiguration;
import org.apache.hadoop.ozone.OzoneConfigKeys;
import org.apache.hadoop.ozone.web.utils.OzoneUtils;
import org.junit.Assert;
import org.junit.Test;

/**
* Class tests OzoneUtils.
*/
public class TestOzoneUtils {

@Test
public void testCheckExternalAuthorizer() {
OzoneConfiguration ozoneConfiguration = new OzoneConfiguration();
Assert.assertFalse(OzoneUtils.checkExternalAuthorizer(ozoneConfiguration));

ozoneConfiguration.set(OzoneConfigKeys.OZONE_ACL_AUTHORIZER_CLASS,
"RangerAuthorizer");
Assert.assertTrue(OzoneUtils.checkExternalAuthorizer(ozoneConfiguration));
}
}
7 changes: 6 additions & 1 deletion hadoop-ozone/tools/src/main/java/org/apache/hadoop/ozone/shell/acl/AclHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,12 +17,14 @@
*/
package org.apache.hadoop.ozone.shell.acl;


import org.apache.hadoop.ozone.client.OzoneClient;
import org.apache.hadoop.ozone.security.acl.OzoneObj;
import org.apache.hadoop.ozone.shell.OzoneAddress;
import org.apache.hadoop.ozone.shell.StoreTypeOption;
import org.apache.hadoop.ozone.shell.Handler;

import org.apache.hadoop.ozone.web.utils.OzoneUtils;
import picocli.CommandLine;

import java.io.IOException;
Expand Down Expand Up @@ -55,7 +57,10 @@ protected abstract void execute(OzoneClient client, OzoneObj obj)
@Override
protected void execute(OzoneClient client, OzoneAddress address)
throws IOException {

boolean externalAuthorizer = OzoneUtils.checkExternalAuthorizer(getConf());
if (externalAuthorizer) {
return;
}
execute(client, address.toOzoneObj(storeType.getValue()));
}

Expand Down