TimelineACLsManager { public boolean checkAccess(UserGroupInformation callerUGI, ApplicationAccessType applicationAccessType, TimelineEntity entity) throws YarnException, IOException { if (LOG.isDebugEnabled()) { LOG.debug("Verifying the access of " + (callerUGI == null ? null : callerUGI.getShortUserName()) + " on the timeline entity " + new EntityIdentifier(entity.getEntityId(), entity.getEntityType())); } if (!adminAclsManager.areACLsEnabled()) { return true; } AccessControlListExt aclExt = aclExts.get(entity.getDomainId()); if (aclExt == null) { aclExt = loadDomainFromTimelineStore(entity.getDomainId()); } if (aclExt == null) { throw new YarnException("Domain information of the timeline entity " + new EntityIdentifier(entity.getEntityId(), entity.getEntityType()) + " doesn't exist."); } String owner = aclExt.owner; AccessControlList domainACL = aclExt.acls.get(applicationAccessType); if (domainACL == null) { if (LOG.isDebugEnabled()) { LOG.debug("ACL not found for access-type " + applicationAccessType + " for domain " + entity.getDomainId() + " owned by " + owner + ". Using default [" + YarnConfiguration.DEFAULT_YARN_APP_ACL + "]"); } domainACL = new AccessControlList(YarnConfiguration.DEFAULT_YARN_APP_ACL); } if (callerUGI != null && (adminAclsManager.isAdmin(callerUGI) || callerUGI.getShortUserName().equals(owner) || domainACL.isUserAllowed(callerUGI))) { return true; } return false; } @SuppressWarnings("unchecked")  TimelineACLsManager(Configuration conf); void setTimelineStore(TimelineStore store); void replaceIfExist(TimelineDomain domain); boolean checkAccess(UserGroupInformation callerUGI,
      ApplicationAccessType applicationAccessType,
      TimelineEntity entity); boolean checkAccess(UserGroupInformation callerUGI,
      TimelineDomain domain); @Private @VisibleForTesting AdminACLsManager setAdminACLsManager(AdminACLsManager adminAclsManager);  }
@Test public void testYarnACLsNotEnabledForDomain() throws Exception { Configuration conf = new YarnConfiguration(); conf.setBoolean(YarnConfiguration.YARN_ACL_ENABLE, false); TimelineACLsManager timelineACLsManager = new TimelineACLsManager(conf); TimelineDomain domain = new TimelineDomain(); domain.setOwner("owner"); Assert.assertTrue( "Always true when ACLs are not enabled", timelineACLsManager.checkAccess( UserGroupInformation.createRemoteUser("user"), domain)); }
@Test public void testYarnACLsEnabledForDomain() throws Exception { Configuration conf = new YarnConfiguration(); conf.setBoolean(YarnConfiguration.YARN_ACL_ENABLE, true); conf.set(YarnConfiguration.YARN_ADMIN_ACL, "admin"); TimelineACLsManager timelineACLsManager = new TimelineACLsManager(conf); TimelineDomain domain = new TimelineDomain(); domain.setOwner("owner"); Assert.assertTrue( "Owner should be allowed to access", timelineACLsManager.checkAccess( UserGroupInformation.createRemoteUser("owner"), domain)); Assert.assertFalse( "Other shouldn't be allowed to access", timelineACLsManager.checkAccess( UserGroupInformation.createRemoteUser("other"), domain)); Assert.assertTrue( "Admin should be allowed to access", timelineACLsManager.checkAccess( UserGroupInformation.createRemoteUser("admin"), domain)); }
@Test public void testCorruptedOwnerInfoForDomain() throws Exception { Configuration conf = new YarnConfiguration(); conf.setBoolean(YarnConfiguration.YARN_ACL_ENABLE, true); conf.set(YarnConfiguration.YARN_ADMIN_ACL, "owner"); TimelineACLsManager timelineACLsManager = new TimelineACLsManager(conf); TimelineDomain domain = new TimelineDomain(); try { timelineACLsManager.checkAccess( UserGroupInformation.createRemoteUser("owner"), domain); Assert.fail("Exception is expected"); } catch (YarnException e) { Assert.assertTrue("It's not the exact expected exception", e.getMessage() .contains("is corrupted.")); } }