ambari-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From rle...@apache.org
Subject ambari git commit: AMBARI-15543. RBAC based user access to view instances are not honoured (rlevas)
Date Thu, 24 Mar 2016 20:10:47 GMT
Repository: ambari
Updated Branches:
  refs/heads/trunk e308b8a96 -> 9752f7e77


AMBARI-15543. RBAC based user access to view instances are not honoured (rlevas)


Project: http://git-wip-us.apache.org/repos/asf/ambari/repo
Commit: http://git-wip-us.apache.org/repos/asf/ambari/commit/9752f7e7
Tree: http://git-wip-us.apache.org/repos/asf/ambari/tree/9752f7e7
Diff: http://git-wip-us.apache.org/repos/asf/ambari/diff/9752f7e7

Branch: refs/heads/trunk
Commit: 9752f7e772398bf0c7eb86b63984a8f5b2b2f9b7
Parents: e308b8a
Author: Robert Levas <rlevas@hortonworks.com>
Authored: Thu Mar 24 16:11:02 2016 -0400
Committer: Robert Levas <rlevas@hortonworks.com>
Committed: Thu Mar 24 16:11:06 2016 -0400

----------------------------------------------------------------------
 .../authorization/AuthorizationHelper.java      |  3 -
 .../authorization/AuthorizationHelperTest.java  | 93 +++++++++++++++++++-
 2 files changed, 92 insertions(+), 4 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/ambari/blob/9752f7e7/ambari-server/src/main/java/org/apache/ambari/server/security/authorization/AuthorizationHelper.java
----------------------------------------------------------------------
diff --git a/ambari-server/src/main/java/org/apache/ambari/server/security/authorization/AuthorizationHelper.java
b/ambari-server/src/main/java/org/apache/ambari/server/security/authorization/AuthorizationHelper.java
index b136182..0c675b8 100644
--- a/ambari-server/src/main/java/org/apache/ambari/server/security/authorization/AuthorizationHelper.java
+++ b/ambari-server/src/main/java/org/apache/ambari/server/security/authorization/AuthorizationHelper.java
@@ -160,9 +160,6 @@ public class AuthorizationHelper {
         if (ResourceType.AMBARI == privilegeResourceType) {
           // This resource type indicates administrative access
           resourceOK = true;
-        } else if (ResourceType.VIEW == privilegeResourceType) {
-          // For a VIEW USER.
-          resourceOK = true;
         } else if ((resourceType == null) || (resourceType == privilegeResourceType)) {
           resourceOK = (resourceId == null) || resourceId.equals(privilegeResource.getId());
         } else {

http://git-wip-us.apache.org/repos/asf/ambari/blob/9752f7e7/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AuthorizationHelperTest.java
----------------------------------------------------------------------
diff --git a/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AuthorizationHelperTest.java
b/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AuthorizationHelperTest.java
index 62f719d..ada5ff5 100644
--- a/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AuthorizationHelperTest.java
+++ b/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AuthorizationHelperTest.java
@@ -130,6 +130,10 @@ public class AuthorizationHelperTest {
     RoleAuthorizationEntity administratorRoleAuthorizationEntity = new RoleAuthorizationEntity();
     administratorRoleAuthorizationEntity.setAuthorizationId(RoleAuthorization.AMBARI_MANAGE_USERS.getId());
 
+    ResourceTypeEntity ambariResourceTypeEntity = new ResourceTypeEntity();
+    ambariResourceTypeEntity.setId(1);
+    ambariResourceTypeEntity.setName(ResourceType.AMBARI.name());
+
     ResourceTypeEntity clusterResourceTypeEntity = new ResourceTypeEntity();
     clusterResourceTypeEntity.setId(1);
     clusterResourceTypeEntity.setName(ResourceType.CLUSTER.name());
@@ -138,6 +142,10 @@ public class AuthorizationHelperTest {
     cluster2ResourceTypeEntity.setId(2);
     cluster2ResourceTypeEntity.setName(ResourceType.CLUSTER.name());
 
+    ResourceEntity ambariResourceEntity = new ResourceEntity();
+    ambariResourceEntity.setResourceType(ambariResourceTypeEntity);
+    ambariResourceEntity.setId(1L);
+
     ResourceEntity clusterResourceEntity = new ResourceEntity();
     clusterResourceEntity.setResourceType(clusterResourceTypeEntity);
     clusterResourceEntity.setId(1L);
@@ -176,7 +184,7 @@ public class AuthorizationHelperTest {
 
     PrivilegeEntity administratorPrivilegeEntity = new PrivilegeEntity();
     administratorPrivilegeEntity.setPermission(administratorPermissionEntity);
-    administratorPrivilegeEntity.setResource(clusterResourceEntity);
+    administratorPrivilegeEntity.setResource(ambariResourceEntity);
 
     GrantedAuthority readOnlyAuthority = new AmbariGrantedAuthority(readOnlyPrivilegeEntity);
     GrantedAuthority readOnly2Authority = new AmbariGrantedAuthority(readOnly2PrivilegeEntity);
@@ -246,6 +254,89 @@ public class AuthorizationHelperTest {
     assertTrue(AuthorizationHelper.isAuthorized(ResourceType.CLUSTER, 1L, EnumSet.of(RoleAuthorization.AMBARI_MANAGE_USERS)));
   }
 
+  @Test
+  public void testIsAuthorizedForSpecificView() {
+    RoleAuthorizationEntity readOnlyRoleAuthorizationEntity = new RoleAuthorizationEntity();
+    readOnlyRoleAuthorizationEntity.setAuthorizationId(RoleAuthorization.CLUSTER_VIEW_METRICS.getId());
+
+    RoleAuthorizationEntity viewUseRoleAuthorizationEntity = new RoleAuthorizationEntity();
+    viewUseRoleAuthorizationEntity.setAuthorizationId(RoleAuthorization.VIEW_USE.getId());
+
+    RoleAuthorizationEntity administratorRoleAuthorizationEntity = new RoleAuthorizationEntity();
+    administratorRoleAuthorizationEntity.setAuthorizationId(RoleAuthorization.AMBARI_MANAGE_USERS.getId());
+
+    ResourceTypeEntity ambariResourceTypeEntity = new ResourceTypeEntity();
+    ambariResourceTypeEntity.setId(1);
+    ambariResourceTypeEntity.setName(ResourceType.AMBARI.name());
+
+    ResourceTypeEntity clusterResourceTypeEntity = new ResourceTypeEntity();
+    clusterResourceTypeEntity.setId(1);
+    clusterResourceTypeEntity.setName(ResourceType.CLUSTER.name());
+
+    ResourceTypeEntity viewResourceTypeEntity = new ResourceTypeEntity();
+    viewResourceTypeEntity.setId(30);
+    viewResourceTypeEntity.setName(ResourceType.VIEW.name());
+
+    ResourceEntity ambariResourceEntity = new ResourceEntity();
+    ambariResourceEntity.setResourceType(ambariResourceTypeEntity);
+    ambariResourceEntity.setId(1L);
+
+    ResourceEntity clusterResourceEntity = new ResourceEntity();
+    clusterResourceEntity.setResourceType(clusterResourceTypeEntity);
+    clusterResourceEntity.setId(1L);
+
+    ResourceEntity viewResourceEntity = new ResourceEntity();
+    viewResourceEntity.setResourceType(viewResourceTypeEntity);
+    viewResourceEntity.setId(53L);
+
+    PermissionEntity readOnlyPermissionEntity = new PermissionEntity();
+    readOnlyPermissionEntity.setAuthorizations(Collections.singleton(readOnlyRoleAuthorizationEntity));
+
+    PermissionEntity viewUsePermissionEntity = new PermissionEntity();
+    viewUsePermissionEntity.setAuthorizations(Arrays.asList(readOnlyRoleAuthorizationEntity,
+        viewUseRoleAuthorizationEntity));
+
+    PermissionEntity administratorPermissionEntity = new PermissionEntity();
+    administratorPermissionEntity.setAuthorizations(Arrays.asList(readOnlyRoleAuthorizationEntity,
+        viewUseRoleAuthorizationEntity,
+        administratorRoleAuthorizationEntity));
+
+    PrivilegeEntity readOnlyPrivilegeEntity = new PrivilegeEntity();
+    readOnlyPrivilegeEntity.setPermission(readOnlyPermissionEntity);
+    readOnlyPrivilegeEntity.setResource(clusterResourceEntity);
+
+    PrivilegeEntity viewUsePrivilegeEntity = new PrivilegeEntity();
+    viewUsePrivilegeEntity.setPermission(viewUsePermissionEntity);
+    viewUsePrivilegeEntity.setResource(viewResourceEntity);
+
+    PrivilegeEntity administratorPrivilegeEntity = new PrivilegeEntity();
+    administratorPrivilegeEntity.setPermission(administratorPermissionEntity);
+    administratorPrivilegeEntity.setResource(ambariResourceEntity);
+
+    GrantedAuthority readOnlyAuthority = new AmbariGrantedAuthority(readOnlyPrivilegeEntity);
+    GrantedAuthority viewUseAuthority = new AmbariGrantedAuthority(viewUsePrivilegeEntity);
+    GrantedAuthority administratorAuthority = new AmbariGrantedAuthority(administratorPrivilegeEntity);
+
+    Authentication readOnlyUser = new TestAuthentication(Collections.singleton(readOnlyAuthority));
+    Authentication viewUser = new TestAuthentication(Arrays.asList(readOnlyAuthority, viewUseAuthority));
+    Authentication administratorUser = new TestAuthentication(Collections.singleton(administratorAuthority));
+
+    SecurityContext context = SecurityContextHolder.getContext();
+    Set<RoleAuthorization> permissionsViewUse = EnumSet.of(RoleAuthorization.VIEW_USE);
+
+    context.setAuthentication(readOnlyUser);
+    assertFalse(AuthorizationHelper.isAuthorized(ResourceType.VIEW, 53L, permissionsViewUse));
+    assertFalse(AuthorizationHelper.isAuthorized(ResourceType.VIEW, 50L, permissionsViewUse));
+
+    context.setAuthentication(viewUser);
+    assertTrue(AuthorizationHelper.isAuthorized(ResourceType.VIEW, 53L, permissionsViewUse));
+    assertFalse(AuthorizationHelper.isAuthorized(ResourceType.VIEW, 50L, permissionsViewUse));
+
+    context.setAuthentication(administratorUser);
+    assertTrue(AuthorizationHelper.isAuthorized(ResourceType.VIEW, 53L, permissionsViewUse));
+    assertTrue(AuthorizationHelper.isAuthorized(ResourceType.VIEW, 50L, permissionsViewUse));
+  }
+
   private class TestAuthentication implements Authentication {
     private final Collection<? extends GrantedAuthority> grantedAuthorities;
 


Mime
View raw message