Java Code Examples for org.apache.hadoop.security.Groups#refresh()

@Test
public void testCachePreventsImplRequest() throws Exception {
  // Disable negative cache.
  conf.setLong(
    CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_NEGATIVE_CACHE_SECS, 0);
  Groups groups = new Groups(conf);
  groups.cacheGroupsAdd(Arrays.asList(myGroups));
  groups.refresh();
  FakeGroupMapping.clearBlackList();

  assertEquals(0, FakeGroupMapping.getRequestCount());

  // First call hits the wire
  assertTrue(groups.getGroups("me").size() == 2);
  assertEquals(1, FakeGroupMapping.getRequestCount());

  // Second count hits cache
  assertTrue(groups.getGroups("me").size() == 2);
  assertEquals(1, FakeGroupMapping.getRequestCount());
}
 

@Test
public void testCacheEntriesExpire() throws Exception {
  conf.setLong(
    CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_CACHE_SECS, 1);
  FakeTimer timer = new FakeTimer();
  final Groups groups = new Groups(conf, timer);
  groups.cacheGroupsAdd(Arrays.asList(myGroups));
  groups.refresh();
  FakeGroupMapping.clearBlackList();

  // We make an entry
  groups.getGroups("me");
  int startingRequestCount = FakeGroupMapping.getRequestCount();

  timer.advance(20 * 1000);

  // Cache entry has expired so it results in a new fetch
  groups.getGroups("me");
  assertEquals(startingRequestCount + 1, FakeGroupMapping.getRequestCount());
}
 

@Test
public void testCachePreventsImplRequest() throws Exception {
  // Disable negative cache.
  conf.setLong(
    CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_NEGATIVE_CACHE_SECS, 0);
  Groups groups = new Groups(conf);
  groups.cacheGroupsAdd(Arrays.asList(myGroups));
  groups.refresh();
  FakeGroupMapping.clearBlackList();

  assertEquals(0, FakeGroupMapping.getRequestCount());

  // First call hits the wire
  assertTrue(groups.getGroups("me").size() == 2);
  assertEquals(1, FakeGroupMapping.getRequestCount());

  // Second count hits cache
  assertTrue(groups.getGroups("me").size() == 2);
  assertEquals(1, FakeGroupMapping.getRequestCount());
}
 

@Test
public void testCacheEntriesExpire() throws Exception {
  conf.setLong(
    CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_CACHE_SECS, 1);
  FakeTimer timer = new FakeTimer();
  final Groups groups = new Groups(conf, timer);
  groups.cacheGroupsAdd(Arrays.asList(myGroups));
  groups.refresh();
  FakeGroupMapping.clearBlackList();

  // We make an entry
  groups.getGroups("me");
  int startingRequestCount = FakeGroupMapping.getRequestCount();

  timer.advance(20 * 1000);

  // Cache entry has expired so it results in a new fetch
  groups.getGroups("me");
  assertEquals(startingRequestCount + 1, FakeGroupMapping.getRequestCount());
}
 

@Test
public void testGroupsCaching() throws Exception {
  // Disable negative cache.
  conf.setLong(
      CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_NEGATIVE_CACHE_SECS, 0);
  Groups groups = new Groups(conf);
  groups.cacheGroupsAdd(Arrays.asList(myGroups));
  groups.refresh();
  FakeGroupMapping.clearBlackList();
  FakeGroupMapping.addToBlackList("user1");

  // regular entry
  assertTrue(groups.getGroups("me").size() == 2);

  // this must be cached. blacklisting should have no effect.
  FakeGroupMapping.addToBlackList("me");
  assertTrue(groups.getGroups("me").size() == 2);

  // ask for a negative entry
  try {
    LOG.error("We are not supposed to get here." + groups.getGroups("user1").toString());
    fail();
  } catch (IOException ioe) {
    if(!ioe.getMessage().startsWith("No groups found")) {
      LOG.error("Got unexpected exception: " + ioe.getMessage());
      fail();
    }
  }

  // this shouldn't be cached. remove from the black list and retry.
  FakeGroupMapping.clearBlackList();
  assertTrue(groups.getGroups("user1").size() == 2);
}
 

@Test
public void testGroupLookupForStaticUsers() throws Exception {
  conf.setClass(CommonConfigurationKeys.HADOOP_SECURITY_GROUP_MAPPING,
      FakeunPrivilegedGroupMapping.class, ShellBasedUnixGroupsMapping.class);
  conf.set(CommonConfigurationKeys.HADOOP_USER_GROUP_STATIC_OVERRIDES, "me=;user1=group1;user2=group1,group2");
  Groups groups = new Groups(conf);
  List<String> userGroups = groups.getGroups("me");
  assertTrue("non-empty groups for static user", userGroups.isEmpty());
  assertFalse("group lookup done for static user",
      FakeunPrivilegedGroupMapping.invoked);
  
  List<String> expected = new ArrayList<String>();
  expected.add("group1");

  FakeunPrivilegedGroupMapping.invoked = false;
  userGroups = groups.getGroups("user1");
  assertTrue("groups not correct", expected.equals(userGroups));
  assertFalse("group lookup done for unprivileged user",
      FakeunPrivilegedGroupMapping.invoked);

  expected.add("group2");
  FakeunPrivilegedGroupMapping.invoked = false;
  userGroups = groups.getGroups("user2");
  assertTrue("groups not correct", expected.equals(userGroups));
  assertFalse("group lookup done for unprivileged user",
      FakeunPrivilegedGroupMapping.invoked);

  Configuration newConf = new Configuration();
  newConf.set(CommonConfigurationKeys.HADOOP_USER_GROUP_STATIC_OVERRIDES, "me=;user1=group1;user2=group1,group2;user3=group3");
  groups.refresh(newConf);

  expected.clear();
  expected.add("group3");
  FakeunPrivilegedGroupMapping.invoked = false;
  userGroups = groups.getGroups("user3");
  assertTrue("groups not correct", expected.equals(userGroups));
  assertFalse("group lookup done for unprivileged user",
      FakeunPrivilegedGroupMapping.invoked);
}
 

@Test
public void testGroupsCaching() throws Exception {
  // Disable negative cache.
  conf.setLong(
      CommonConfigurationKeys.HADOOP_SECURITY_GROUPS_NEGATIVE_CACHE_SECS, 0);
  Groups groups = new Groups(conf);
  groups.cacheGroupsAdd(Arrays.asList(myGroups));
  groups.refresh();
  FakeGroupMapping.clearBlackList();
  FakeGroupMapping.addToBlackList("user1");

  // regular entry
  assertTrue(groups.getGroups("me").size() == 2);

  // this must be cached. blacklisting should have no effect.
  FakeGroupMapping.addToBlackList("me");
  assertTrue(groups.getGroups("me").size() == 2);

  // ask for a negative entry
  try {
    LOG.error("We are not supposed to get here." + groups.getGroups("user1").toString());
    fail();
  } catch (IOException ioe) {
    if(!ioe.getMessage().startsWith("No groups found")) {
      LOG.error("Got unexpected exception: " + ioe.getMessage());
      fail();
    }
  }

  // this shouldn't be cached. remove from the black list and retry.
  FakeGroupMapping.clearBlackList();
  assertTrue(groups.getGroups("user1").size() == 2);
}
 

/**
 * Test the netgroups (groups in ACL rules that start with @)
 *
 * This is a  manual test because it requires:
 *   - host setup
 *   - native code compiled
 *   - specify the group mapping class
 *
 * Host setup:
 *
 * /etc/nsswitch.conf should have a line like this:
 * netgroup: files
 *
 * /etc/netgroup should be (the whole file):
 * lasVegas (,elvis,)
 * memphis (,elvis,) (,jerryLeeLewis,)
 *
 * To run this test:
 *
 * export JAVA_HOME='path/to/java'
 * ant \
 *   -Dtestcase=TestAccessControlList \
 *   -Dtest.output=yes \
 *   -DTestAccessControlListGroupMapping=$className \
 *   compile-native test
 *
 * where $className is one of the classes that provide group
 * mapping services, i.e. classes that implement
 * GroupMappingServiceProvider interface, at this time:
 *   - org.apache.hadoop.security.JniBasedUnixGroupsNetgroupMapping
 *   - org.apache.hadoop.security.ShellBasedUnixGroupsNetgroupMapping
 *
 */
@Test
public void testNetgroups() throws Exception {

  if(!NativeCodeLoader.isNativeCodeLoaded()) {
    LOG.info("Not testing netgroups, " +
      "this test only runs when native code is compiled");
    return;
  }

  String groupMappingClassName =
    System.getProperty("TestAccessControlListGroupMapping");

  if(groupMappingClassName == null) {
    LOG.info("Not testing netgroups, no group mapping class specified, " +
      "use -DTestAccessControlListGroupMapping=$className to specify " +
      "group mapping class (must implement GroupMappingServiceProvider " +
      "interface and support netgroups)");
    return;
  }

  LOG.info("Testing netgroups using: " + groupMappingClassName);

  Configuration conf = new Configuration();
  conf.set(CommonConfigurationKeysPublic.HADOOP_SECURITY_GROUP_MAPPING,
    groupMappingClassName);

  Groups groups = Groups.getUserToGroupsMappingService(conf);

  AccessControlList acl;

  // create these ACLs to populate groups cache
  acl = new AccessControlList("ja my"); // plain
  acl = new AccessControlList("sinatra ratpack,@lasVegas"); // netgroup
  acl = new AccessControlList(" somegroup,@someNetgroup"); // no user

  // this ACL will be used for testing ACLs
  acl = new AccessControlList("carlPerkins ratpack,@lasVegas");
  acl.addGroup("@memphis");

  // validate the netgroups before and after rehresh to make
  // sure refresh works correctly
  validateNetgroups(groups, acl);
  groups.refresh();
  validateNetgroups(groups, acl);

}
 

/**
 * Test the netgroups (groups in ACL rules that start with @)
 *
 * This is a  manual test because it requires:
 *   - host setup
 *   - native code compiled
 *   - specify the group mapping class
 *
 * Host setup:
 *
 * /etc/nsswitch.conf should have a line like this:
 * netgroup: files
 *
 * /etc/netgroup should be (the whole file):
 * lasVegas (,elvis,)
 * memphis (,elvis,) (,jerryLeeLewis,)
 *
 * To run this test:
 *
 * export JAVA_HOME='path/to/java'
 * ant \
 *   -Dtestcase=TestAccessControlList \
 *   -Dtest.output=yes \
 *   -DTestAccessControlListGroupMapping=$className \
 *   compile-native test
 *
 * where $className is one of the classes that provide group
 * mapping services, i.e. classes that implement
 * GroupMappingServiceProvider interface, at this time:
 *   - org.apache.hadoop.security.JniBasedUnixGroupsNetgroupMapping
 *   - org.apache.hadoop.security.ShellBasedUnixGroupsNetgroupMapping
 *
 */
@Test
public void testNetgroups() throws Exception {

  if(!NativeCodeLoader.isNativeCodeLoaded()) {
    LOG.info("Not testing netgroups, " +
      "this test only runs when native code is compiled");
    return;
  }

  String groupMappingClassName =
    System.getProperty("TestAccessControlListGroupMapping");

  if(groupMappingClassName == null) {
    LOG.info("Not testing netgroups, no group mapping class specified, " +
      "use -DTestAccessControlListGroupMapping=$className to specify " +
      "group mapping class (must implement GroupMappingServiceProvider " +
      "interface and support netgroups)");
    return;
  }

  LOG.info("Testing netgroups using: " + groupMappingClassName);

  Configuration conf = new Configuration();
  conf.set(CommonConfigurationKeysPublic.HADOOP_SECURITY_GROUP_MAPPING,
    groupMappingClassName);

  Groups groups = Groups.getUserToGroupsMappingService(conf);

  AccessControlList acl;

  // create these ACLs to populate groups cache
  acl = new AccessControlList("ja my"); // plain
  acl = new AccessControlList("sinatra ratpack,@lasVegas"); // netgroup
  acl = new AccessControlList(" somegroup,@someNetgroup"); // no user

  // this ACL will be used for testing ACLs
  acl = new AccessControlList("carlPerkins ratpack,@lasVegas");
  acl.addGroup("@memphis");

  // validate the netgroups before and after rehresh to make
  // sure refresh works correctly
  validateNetgroups(groups, acl);
  groups.refresh();
  validateNetgroups(groups, acl);

}