SuperuserKeystoresLoader { public X509SecurityMaterial loadSuperUserMaterial() throws IOException { Path superMaterialDirectory = getMaterialDirectory(); String username = UserGroupInformation.getLoginUser().getUserName(); Path keystore = superMaterialDirectory.resolve(getSuperKeystoreFilename(username)); Path truststore = superMaterialDirectory.resolve(getSuperTruststoreFilename(username)); Path password = superMaterialDirectory.resolve(getSuperMaterialPasswdFilename(username)); return new X509SecurityMaterial(keystore, truststore, password); } SuperuserKeystoresLoader(Configuration configuration); X509SecurityMaterial loadSuperUserMaterial(); @VisibleForTesting String getSuperKeystoreFilename(String username); @VisibleForTesting String getSuperTruststoreFilename(String username); @VisibleForTesting String getSuperMaterialPasswdFilename(String username); static final String SUPER_MATERIAL_DIRECTORY_ENV_VARIABLE; }
@Test public void testLoadEnvironmentVariable() throws Exception { final String materialDirectory = "/tmp/secrets"; MockEnvironmentVariables envVars = new MockEnvironmentVariables(); envVars.setEnv(SuperuserKeystoresLoader.SUPER_MATERIAL_DIRECTORY_ENV_VARIABLE, materialDirectory); EnvironmentVariablesFactory.setInstance(envVars); Configuration conf = new Configuration(false); final SuperuserKeystoresLoader loader = new SuperuserKeystoresLoader(conf); UserGroupInformation ugi = UserGroupInformation.createRemoteUser(IMPERSONATE_USER); ugi.doAs(new PrivilegedExceptionAction<Void>() { @Override public Void run() throws Exception { X509SecurityMaterial material = loader.loadSuperUserMaterial(); assertMaterialEquals(materialDirectory, loader, material); return null; } }); }
@Test public void testLoadConfiguration() throws Exception { final String materialDirectory = "/tmp/secure/bin"; Configuration conf = new Configuration(false); conf.set(CommonConfigurationKeysPublic.HOPS_TLS_SUPER_MATERIAL_DIRECTORY, materialDirectory); final SuperuserKeystoresLoader loader = new SuperuserKeystoresLoader(conf); UserGroupInformation ugi = UserGroupInformation.createRemoteUser(IMPERSONATE_USER); ugi.doAs(new PrivilegedExceptionAction<Void>() { @Override public Void run() throws Exception { X509SecurityMaterial material = loader.loadSuperUserMaterial(); assertMaterialEquals(materialDirectory, loader, material); return null; } }); }
@Test public void testLoadFromHome() throws Exception { final String materialDirectory = Paths.get(System.getProperty("user.home"), SuperuserKeystoresLoader.SUPER_MATERIAL_HOME_SUBDIRECTORY).toString(); Configuration conf = new Configuration(false); final SuperuserKeystoresLoader loader = new SuperuserKeystoresLoader(conf); UserGroupInformation ugi = UserGroupInformation.createRemoteUser(IMPERSONATE_USER); ugi.doAs(new PrivilegedExceptionAction<Void>() { @Override public Void run() throws Exception { X509SecurityMaterial material = loader.loadSuperUserMaterial(); assertMaterialEquals(materialDirectory, loader, material); return null; } }); }
@Test public void testLoadFromHomeWithVariable() throws Exception { final String materialDirectory = "${HOME}/.hops_tls"; final String expectedDirectory = Paths.get(System.getProperty("user.home"), ".hops_tls").toString(); Configuration conf = new Configuration(false); conf.set(CommonConfigurationKeysPublic.HOPS_TLS_SUPER_MATERIAL_DIRECTORY, materialDirectory); final SuperuserKeystoresLoader loader = new SuperuserKeystoresLoader(conf); UserGroupInformation ugi = UserGroupInformation.createRemoteUser(IMPERSONATE_USER); ugi.doAs(new PrivilegedExceptionAction<Object>() { @Override public Object run() throws Exception { X509SecurityMaterial material = loader.loadSuperUserMaterial(); assertMaterialEquals(expectedDirectory, loader, material); return null; } }); }
@Test public void testLoadFromDirectoryWithUserVariable() throws Exception { final String materialDirectory = "/some/directory/${USER}"; final String expectedDirectory = Paths.get("/some/directory", USER).toString(); Configuration conf = new Configuration(false); conf.set(CommonConfigurationKeysPublic.HOPS_TLS_SUPER_MATERIAL_DIRECTORY, materialDirectory); final SuperuserKeystoresLoader loader = new SuperuserKeystoresLoader(conf); UserGroupInformation ugi = UserGroupInformation.createRemoteUser(IMPERSONATE_USER); ugi.doAs(new PrivilegedExceptionAction<Object>() { @Override public Object run() throws Exception { X509SecurityMaterial material = loader.loadSuperUserMaterial(); assertMaterialEquals(expectedDirectory, loader, material); return null; } }); }