RangerKmsAuthorizer implements Runnable, KeyACLs { @Override public void assertAccess(Type aclType, UserGroupInformation ugi, KMSOp operation, String key, String clientIp) throws AccessControlException { if(LOG.isDebugEnabled()) { LOG.debug("==> RangerKmsAuthorizer.assertAccess(" + key + ", " + ugi +", " + aclType + ")"); } key = (key == null)?"":key; if (!hasAccess(aclType, ugi, key, clientIp)) { KMSWebApp.getUnauthorizedCallsMeter().mark(); KMSWebApp.getKMSAudit().unauthorized(ugi, operation, key); throw new AuthorizationException(String.format( (!key.equals("")) ? UNAUTHORIZED_MSG_WITH_KEY : UNAUTHORIZED_MSG_WITHOUT_KEY, ugi.getShortUserName(), operation, key)); } } RangerKmsAuthorizer(Configuration conf);  RangerKmsAuthorizer(); @Override void run(); @Override synchronized void startReloader(); @Override synchronized void stopReloader(); @Override boolean hasAccess(Type type, UserGroupInformation ugi, String clientIp); boolean hasAccess(Type type, UserGroupInformation ugi, String keyName, String clientIp); @Override void assertAccess(Type aclType, UserGroupInformation ugi, KMSOp operation, String key, String clientIp); @Override boolean hasAccessToKey(String keyName, UserGroupInformation ugi, KeyOpType opType); @Override boolean isACLPresent(String keyName, KeyOpType opType); void init(Configuration conf); static final int RELOADER_SLEEP_MILLIS; static final String ACCESS_TYPE_DECRYPT_EEK; static final String ACCESS_TYPE_GENERATE_EEK; static final String ACCESS_TYPE_GET_METADATA; static final String ACCESS_TYPE_GET_KEYS; static final String ACCESS_TYPE_GET; static final String ACCESS_TYPE_SET_KEY_MATERIAL; static final String ACCESS_TYPE_ROLLOVER; static final String ACCESS_TYPE_CREATE; static final String ACCESS_TYPE_DELETE; static final String TYPE; static final String PRINCIPAL; static final String KEYTAB; }
@Test public void testCreateKeys() throws Throwable { if (!UNRESTRICTED_POLICIES_INSTALLED) { return; } final UserGroupInformation ugi = UserGroupInformation.createRemoteUser("bob"); ugi.doAs(new PrivilegedExceptionAction<Void>() { public Void run() throws Exception { KMSWebApp.getACLs().assertAccess(Type.CREATE, ugi, KMSOp.CREATE_KEY, "newkey1", "127.0.0.1"); return null; } }); final UserGroupInformation ugi2 = UserGroupInformation.createRemoteUser("eve"); ugi2.doAs(new PrivilegedExceptionAction<Void>() { public Void run() throws Exception { try { KMSWebApp.getACLs().assertAccess(Type.CREATE, ugi2, KMSOp.CREATE_KEY, "newkey2", "127.0.0.1"); Assert.fail("Failure expected"); } catch (AuthorizationException ex) { LOG.error(ex); } return null; } }); final UserGroupInformation ugi3 = UserGroupInformation.createUserForTesting("alice", new String[]{"IT"}); ugi3.doAs(new PrivilegedExceptionAction<Void>() { public Void run() throws Exception { try { KMSWebApp.getACLs().assertAccess(Type.CREATE, ugi3, KMSOp.CREATE_KEY, "newkey1", "127.0.0.1"); Assert.fail("Failure expected"); } catch (AuthorizationException ex) { LOG.error(ex); } return null; } }); }
@Test public void testDeleteKeys() throws Throwable { if (!UNRESTRICTED_POLICIES_INSTALLED) { return; } final UserGroupInformation ugi = UserGroupInformation.createRemoteUser("bob"); ugi.doAs(new PrivilegedExceptionAction<Void>() { public Void run() throws Exception { KMSWebApp.getACLs().assertAccess(Type.DELETE, ugi, KMSOp.DELETE_KEY, "newkey1", "127.0.0.1"); return null; } }); final UserGroupInformation ugi2 = UserGroupInformation.createRemoteUser("eve"); ugi2.doAs(new PrivilegedExceptionAction<Void>() { public Void run() throws Exception { try { KMSWebApp.getACLs().assertAccess(Type.DELETE, ugi2, KMSOp.DELETE_KEY, "newkey1", "127.0.0.1"); Assert.fail("Failure expected"); } catch (AuthorizationException ex) { LOG.error(ex); } return null; } }); final UserGroupInformation ugi3 = UserGroupInformation.createUserForTesting("alice", new String[]{"IT"}); ugi3.doAs(new PrivilegedExceptionAction<Void>() { public Void run() throws Exception { try { KMSWebApp.getACLs().assertAccess(Type.DELETE, ugi3, KMSOp.DELETE_KEY, "newkey1", "127.0.0.1"); Assert.fail("Failure expected"); } catch (AuthorizationException ex) { LOG.error(ex); } return null; } }); }
@Test public void testRollover() throws Throwable { if (!UNRESTRICTED_POLICIES_INSTALLED) { return; } final UserGroupInformation ugi = UserGroupInformation.createRemoteUser("bob"); ugi.doAs(new PrivilegedExceptionAction<Void>() { public Void run() throws Exception { KMSWebApp.getACLs().assertAccess(Type.ROLLOVER, ugi, KMSOp.ROLL_NEW_VERSION, "newkey1", "127.0.0.1"); return null; } }); final UserGroupInformation ugi2 = UserGroupInformation.createRemoteUser("eve"); ugi2.doAs(new PrivilegedExceptionAction<Void>() { public Void run() throws Exception { try { KMSWebApp.getACLs().assertAccess(Type.ROLLOVER, ugi2, KMSOp.ROLL_NEW_VERSION, "newkey1", "127.0.0.1"); Assert.fail("Failure expected"); } catch (AuthorizationException ex) { LOG.error(ex); } return null; } }); final UserGroupInformation ugi3 = UserGroupInformation.createUserForTesting("alice", new String[]{"IT"}); ugi3.doAs(new PrivilegedExceptionAction<Void>() { public Void run() throws Exception { try { KMSWebApp.getACLs().assertAccess(Type.ROLLOVER, ugi3, KMSOp.ROLL_NEW_VERSION, "newkey1", "127.0.0.1"); Assert.fail("Failure expected"); } catch (AuthorizationException ex) { LOG.error(ex); } return null; } }); }
@Test public void testGetKeys() throws Throwable { if (!UNRESTRICTED_POLICIES_INSTALLED) { return; } final UserGroupInformation ugi = UserGroupInformation.createRemoteUser("bob"); ugi.doAs(new PrivilegedExceptionAction<Void>() { public Void run() throws Exception { KMSWebApp.getACLs().assertAccess(Type.GET_KEYS, ugi, KMSOp.GET_KEYS, "newkey1", "127.0.0.1"); return null; } }); final UserGroupInformation ugi2 = UserGroupInformation.createRemoteUser("eve"); ugi2.doAs(new PrivilegedExceptionAction<Void>() { public Void run() throws Exception { try { KMSWebApp.getACLs().assertAccess(Type.GET_KEYS, ugi2, KMSOp.GET_KEYS, "newkey1", "127.0.0.1"); Assert.fail("Failure expected"); } catch (AuthorizationException ex) { LOG.error(ex); } return null; } }); final UserGroupInformation ugi3 = UserGroupInformation.createUserForTesting("alice", new String[]{"IT"}); ugi3.doAs(new PrivilegedExceptionAction<Void>() { public Void run() throws Exception { KMSWebApp.getACLs().assertAccess(Type.GET_KEYS, ugi3, KMSOp.GET_KEYS, "newkey1", "127.0.0.1"); return null; } }); }
@Test public void testGetMetadata() throws Throwable { if (!UNRESTRICTED_POLICIES_INSTALLED) { return; } final UserGroupInformation ugi = UserGroupInformation.createRemoteUser("bob"); ugi.doAs(new PrivilegedExceptionAction<Void>() { public Void run() throws Exception { KMSWebApp.getACLs().assertAccess(Type.GET_METADATA, ugi, KMSOp.GET_METADATA, "newkey1", "127.0.0.1"); return null; } }); final UserGroupInformation ugi2 = UserGroupInformation.createRemoteUser("eve"); ugi2.doAs(new PrivilegedExceptionAction<Void>() { public Void run() throws Exception { try { KMSWebApp.getACLs().assertAccess(Type.GET_METADATA, ugi2, KMSOp.GET_METADATA, "newkey1", "127.0.0.1"); Assert.fail("Failure expected"); } catch (AuthorizationException ex) { LOG.error(ex); } return null; } }); final UserGroupInformation ugi3 = UserGroupInformation.createUserForTesting("alice", new String[]{"IT"}); ugi3.doAs(new PrivilegedExceptionAction<Void>() { public Void run() throws Exception { KMSWebApp.getACLs().assertAccess(Type.GET_METADATA, ugi3, KMSOp.GET_METADATA, "newkey1", "127.0.0.1"); return null; } }); }
@Test public void testGenerateEEK() throws Throwable { if (!UNRESTRICTED_POLICIES_INSTALLED) { return; } final UserGroupInformation ugi = UserGroupInformation.createRemoteUser("bob"); ugi.doAs(new PrivilegedExceptionAction<Void>() { public Void run() throws Exception { KMSWebApp.getACLs().assertAccess(Type.GENERATE_EEK, ugi, KMSOp.GENERATE_EEK, "newkey1", "127.0.0.1"); return null; } }); final UserGroupInformation ugi2 = UserGroupInformation.createRemoteUser("eve"); ugi2.doAs(new PrivilegedExceptionAction<Void>() { public Void run() throws Exception { try { KMSWebApp.getACLs().assertAccess(Type.GENERATE_EEK, ugi2, KMSOp.GENERATE_EEK, "newkey1", "127.0.0.1"); Assert.fail("Failure expected"); } catch (AuthorizationException ex) { LOG.error(ex); } return null; } }); final UserGroupInformation ugi3 = UserGroupInformation.createUserForTesting("alice", new String[]{"IT"}); ugi3.doAs(new PrivilegedExceptionAction<Void>() { public Void run() throws Exception { try { KMSWebApp.getACLs().assertAccess(Type.GENERATE_EEK, ugi3, KMSOp.GENERATE_EEK, "newkey1", "127.0.0.1"); Assert.fail("Failure expected"); } catch (AuthorizationException ex) { LOG.error(ex); } return null; } }); }
@Test public void testDecryptEEK() throws Throwable { if (!UNRESTRICTED_POLICIES_INSTALLED) { return; } final UserGroupInformation ugi = UserGroupInformation.createRemoteUser("bob"); ugi.doAs(new PrivilegedExceptionAction<Void>() { public Void run() throws Exception { KMSWebApp.getACLs().assertAccess(Type.DECRYPT_EEK, ugi, KMSOp.DECRYPT_EEK, "newkey1", "127.0.0.1"); return null; } }); final UserGroupInformation ugi2 = UserGroupInformation.createRemoteUser("eve"); ugi2.doAs(new PrivilegedExceptionAction<Void>() { public Void run() throws Exception { try { KMSWebApp.getACLs().assertAccess(Type.DECRYPT_EEK, ugi2, KMSOp.DECRYPT_EEK, "newkey1", "127.0.0.1"); Assert.fail("Failure expected"); } catch (AuthorizationException ex) { LOG.error(ex); } return null; } }); final UserGroupInformation ugi3 = UserGroupInformation.createUserForTesting("alice", new String[]{"IT"}); ugi3.doAs(new PrivilegedExceptionAction<Void>() { public Void run() throws Exception { try { KMSWebApp.getACLs().assertAccess(Type.DECRYPT_EEK, ugi3, KMSOp.DECRYPT_EEK, "newkey1", "127.0.0.1"); Assert.fail("Failure expected"); } catch (AuthorizationException ex) { LOG.error(ex); } return null; } }); }