UpgradeCatalog240 extends AbstractUpgradeCatalog { void consolidateUserRoles() { LOG.info("Consolidating User Roles..."); List<UserEntity> users = userDAO.findAll(); if(users != null) { for (UserEntity user : users) { PrincipalEntity principal = user.getPrincipal(); if (principal != null) { Set<PrivilegeEntity> privileges = principal.getPrivileges(); if (privileges != null) { Map<ResourceEntity, Set<PrivilegeEntity>> resourceExplicitPrivileges = new HashMap<ResourceEntity, Set<PrivilegeEntity>>(); PrivilegeEntity ambariAdministratorPrivilege = null; for (PrivilegeEntity privilege : privileges) { ResourceEntity resource = privilege.getResource(); if (resource != null) { ResourceTypeEntity resourceType = resource.getResourceType(); if (resourceType != null) { String type = resourceType.getName(); if (ResourceType.CLUSTER.name().equalsIgnoreCase(type)) { Set<PrivilegeEntity> explicitPrivileges = resourceExplicitPrivileges.get(resource); if (explicitPrivileges == null) { explicitPrivileges = new HashSet<PrivilegeEntity>(); resourceExplicitPrivileges.put(resource, explicitPrivileges); } explicitPrivileges.add(privilege); } else if (ResourceType.AMBARI.name().equalsIgnoreCase(type)) { ambariAdministratorPrivilege = privilege; } } } } if(ambariAdministratorPrivilege != null) { for (Set<PrivilegeEntity> explicitPrivileges : resourceExplicitPrivileges.values()) { explicitPrivileges.add(ambariAdministratorPrivilege); } } for (Map.Entry<ResourceEntity, Set<PrivilegeEntity>> entry : resourceExplicitPrivileges.entrySet()) { Set<PrivilegeEntity> explicitPrivileges = entry.getValue(); if (explicitPrivileges.size() > 1) { LOG.info("{} has {} explicitly assigned roles for the cluster {}, consolidating...", user.getUserName(), explicitPrivileges.size(), getClusterName(entry.getKey())); PrivilegeEntity toKeep = null; PrivilegeEntity toRemove = null; for (PrivilegeEntity privilegeEntity : explicitPrivileges) { if (toKeep == null) { toKeep = privilegeEntity; } else { Integer toKeepLevel = ROLE_ORDER.get(toKeep.getPermission().getPermissionName()); Integer currentLevel = ROLE_ORDER.get(privilegeEntity.getPermission().getPermissionName()); if (toKeepLevel > currentLevel) { toRemove = toKeep; toKeep = privilegeEntity; } else { toRemove = privilegeEntity; } LOG.info("Removing the role {} from the set assigned to {} since {} is more powerful.", toRemove.getPermission().getPermissionName(), user.getUserName(), toKeep.getPermission().getPermissionName()); privilegeDAO.remove(toRemove); } } } } } } } } } @Inject  UpgradeCatalog240(Injector injector); @Override String getTargetVersion(); @Override String getSourceVersion(); static final String DESIRED_VERSION_COLUMN_NAME; static final String BLUEPRINT_SETTING_TABLE; static final String BLUEPRINT_NAME_COL; static final String SETTING_NAME_COL; static final String SETTING_DATA_COL; static final String ID; static final String BLUEPRINT_TABLE; static final String VIEWINSTANCE_TABLE; static final String SHORT_URL_COLUMN; static final String CLUSTER_HANDLE_COLUMN; static final String REQUESTSCHEDULE_TABLE; static final String AUTHENTICATED_USER_ID_COLUMN; static final String TIMELINE_METRICS_SINK_COLLECTION_PERIOD; static final String ONE_DIR_PER_PARITION_PROPERTY; static final String VIEWURL_TABLE; static final String URL_ID_COLUMN; static final String PRECISION_TABLE_TTL_PROPERTY; static final String CLUSTER_SECOND_TABLE_TTL_PROPERTY; static final String CLUSTER_TYPE_COLUMN; static final String REMOTE_AMBARI_CLUSTER_TABLE; static final String REMOTE_AMBARI_CLUSTER_SERVICE_TABLE; static final String CLUSTER_ID; static final String SERVICE_NAME; static final String CLUSTER_NAME; }
@Test public void testConsolidateUserRoles() { final EasyMockSupport ems = new EasyMockSupport(); ResourceTypeEntity resourceTypeAmbari = ems.createMock(ResourceTypeEntity.class); expect(resourceTypeAmbari.getName()).andReturn(ResourceType.AMBARI.name()).anyTimes(); ResourceTypeEntity resourceTypeCluster = ems.createMock(ResourceTypeEntity.class); expect(resourceTypeCluster.getName()).andReturn(ResourceType.CLUSTER.name()).anyTimes(); ResourceEntity resourceAmbari = ems.createMock(ResourceEntity.class); expect(resourceAmbari.getResourceType()).andReturn(resourceTypeAmbari).anyTimes(); ResourceEntity resourceC1 = ems.createMock(ResourceEntity.class); expect(resourceC1.getResourceType()).andReturn(resourceTypeCluster).anyTimes(); expect(resourceC1.getId()).andReturn(1L).anyTimes(); ResourceEntity resourceC2 = ems.createMock(ResourceEntity.class); expect(resourceC2.getResourceType()).andReturn(resourceTypeCluster).anyTimes(); expect(resourceC2.getId()).andReturn(2L).anyTimes(); PermissionEntity permissionAmbariAdministrator = ems.createMock(PermissionEntity.class); expect(permissionAmbariAdministrator.getPermissionName()).andReturn("AMBARI.ADMINISTRATOR").anyTimes(); PermissionEntity permissionClusterUser = ems.createMock(PermissionEntity.class); expect(permissionClusterUser.getPermissionName()).andReturn("CLUSTER.USER").anyTimes(); PermissionEntity permissionClusterOperator = ems.createMock(PermissionEntity.class); expect(permissionClusterOperator.getPermissionName()).andReturn("CLUSTER.OPERATOR").anyTimes(); PrivilegeEntity privilegeAdmin = ems.createMock(PrivilegeEntity.class); expect(privilegeAdmin.getResource()).andReturn(resourceAmbari).anyTimes(); expect(privilegeAdmin.getPermission()).andReturn(permissionAmbariAdministrator).anyTimes(); PrivilegeEntity privilegeClusterUserC1 = ems.createMock(PrivilegeEntity.class); expect(privilegeClusterUserC1.getResource()).andReturn(resourceC1).anyTimes(); expect(privilegeClusterUserC1.getPermission()).andReturn(permissionClusterUser).anyTimes(); PrivilegeEntity privilegeClusterOperatorC1 = ems.createMock(PrivilegeEntity.class); expect(privilegeClusterOperatorC1.getResource()).andReturn(resourceC1).anyTimes(); expect(privilegeClusterOperatorC1.getPermission()).andReturn(permissionClusterOperator).anyTimes(); PrivilegeEntity privilegeClusterUserC2 = ems.createMock(PrivilegeEntity.class); expect(privilegeClusterUserC2.getResource()).andReturn(resourceC2).anyTimes(); expect(privilegeClusterUserC2.getPermission()).andReturn(permissionClusterUser).anyTimes(); PrivilegeEntity privilegeClusterOperatorC2 = ems.createMock(PrivilegeEntity.class); expect(privilegeClusterOperatorC2.getResource()).andReturn(resourceC2).anyTimes(); expect(privilegeClusterOperatorC2.getPermission()).andReturn(permissionClusterOperator).anyTimes(); PrincipalEntity principalAdministratorOnly = ems.createStrictMock(PrincipalEntity.class); expect(principalAdministratorOnly.getPrivileges()) .andReturn(new HashSet<PrivilegeEntity>(Arrays.asList(privilegeAdmin))) .once(); PrincipalEntity principalNonAdminSingleRoleSingleCluster = ems.createStrictMock(PrincipalEntity.class); expect(principalNonAdminSingleRoleSingleCluster.getPrivileges()) .andReturn(new HashSet<PrivilegeEntity>(Arrays.asList(privilegeClusterUserC1))) .once(); PrincipalEntity principalNonAdminMultipleRolesSingleCluster = ems.createStrictMock(PrincipalEntity.class); expect(principalNonAdminMultipleRolesSingleCluster.getPrivileges()) .andReturn(new HashSet<PrivilegeEntity>(Arrays.asList(privilegeClusterUserC1, privilegeClusterOperatorC1))) .once(); PrincipalEntity principalNonAdminMultipleRolesMultipleClusters = ems.createStrictMock(PrincipalEntity.class); expect(principalNonAdminMultipleRolesMultipleClusters.getPrivileges()) .andReturn(new HashSet<PrivilegeEntity>(Arrays.asList(privilegeClusterUserC1, privilegeClusterOperatorC1, privilegeClusterUserC2, privilegeClusterOperatorC2))) .once(); PrincipalEntity principalAdminSingleRoleSingleCluster = ems.createStrictMock(PrincipalEntity.class); expect(principalAdminSingleRoleSingleCluster.getPrivileges()) .andReturn(new HashSet<PrivilegeEntity>(Arrays.asList(privilegeAdmin, privilegeClusterOperatorC1))) .once(); PrincipalEntity principalAdminMultipleRolesSingleCluster = ems.createStrictMock(PrincipalEntity.class); expect(principalAdminMultipleRolesSingleCluster.getPrivileges()) .andReturn(new HashSet<PrivilegeEntity>(Arrays.asList(privilegeAdmin, privilegeClusterUserC1, privilegeClusterOperatorC1))) .once(); PrincipalEntity principalAdminMultipleRolesMultipleClusters = ems.createStrictMock(PrincipalEntity.class); expect(principalAdminMultipleRolesMultipleClusters.getPrivileges()) .andReturn(new HashSet<PrivilegeEntity>(Arrays.asList(privilegeAdmin, privilegeClusterUserC1, privilegeClusterOperatorC1, privilegeClusterUserC2, privilegeClusterOperatorC2))) .once(); UserEntity userAdministratorOnly = ems.createStrictMock(UserEntity.class); expect(userAdministratorOnly.getPrincipal()).andReturn(principalAdministratorOnly).once(); expect(userAdministratorOnly.getUserName()).andReturn("userAdministratorOnly").anyTimes(); UserEntity userNonAdminSingleRoleSingleCluster = ems.createStrictMock(UserEntity.class); expect(userNonAdminSingleRoleSingleCluster.getPrincipal()).andReturn(principalNonAdminSingleRoleSingleCluster).once(); expect(userNonAdminSingleRoleSingleCluster.getUserName()).andReturn("userNonAdminSingleRoleSingleCluster").anyTimes(); UserEntity userNonAdminMultipleRolesSingleCluster = ems.createStrictMock(UserEntity.class); expect(userNonAdminMultipleRolesSingleCluster.getPrincipal()).andReturn(principalNonAdminMultipleRolesSingleCluster).once(); expect(userNonAdminMultipleRolesSingleCluster.getUserName()).andReturn("userNonAdminMultipleRolesSingleCluster").anyTimes(); UserEntity userNonAdminMultipleRolesMultipleClusters = ems.createStrictMock(UserEntity.class); expect(userNonAdminMultipleRolesMultipleClusters.getPrincipal()).andReturn(principalNonAdminMultipleRolesMultipleClusters).once(); expect(userNonAdminMultipleRolesMultipleClusters.getUserName()).andReturn("userNonAdminMultipleRolesMultipleClusters").anyTimes(); UserEntity userAdminSingleRoleSingleCluster = ems.createStrictMock(UserEntity.class); expect(userAdminSingleRoleSingleCluster.getPrincipal()).andReturn(principalAdminSingleRoleSingleCluster).once(); expect(userAdminSingleRoleSingleCluster.getUserName()).andReturn("userAdminSingleRoleSingleCluster").anyTimes(); UserEntity userAdminMultipleRolesSingleCluster = ems.createStrictMock(UserEntity.class); expect(userAdminMultipleRolesSingleCluster.getPrincipal()).andReturn(principalAdminMultipleRolesSingleCluster).once(); expect(userAdminMultipleRolesSingleCluster.getUserName()).andReturn("userAdminMultipleRolesSingleCluster").anyTimes(); UserEntity userAdminMultipleRolesMultipleClusters = ems.createStrictMock(UserEntity.class); expect(userAdminMultipleRolesMultipleClusters.getPrincipal()).andReturn(principalAdminMultipleRolesMultipleClusters).once(); expect(userAdminMultipleRolesMultipleClusters.getUserName()).andReturn("userAdminMultipleRolesMultipleClusters").anyTimes(); final UserDAO userDAO = ems.createStrictMock(UserDAO.class); expect(userDAO.findAll()) .andReturn(Arrays.asList( userAdministratorOnly, userNonAdminSingleRoleSingleCluster, userNonAdminMultipleRolesSingleCluster, userNonAdminMultipleRolesMultipleClusters, userAdminSingleRoleSingleCluster, userAdminMultipleRolesSingleCluster, userAdminMultipleRolesMultipleClusters)) .once(); final PrivilegeDAO privilegeDAO = ems.createMock(PrivilegeDAO.class); privilegeDAO.remove(privilegeClusterUserC1); expectLastCall().once(); privilegeDAO.remove(privilegeClusterUserC1); expectLastCall().once(); privilegeDAO.remove(privilegeClusterUserC2); expectLastCall().once(); privilegeDAO.remove(privilegeClusterOperatorC1); expectLastCall().once(); privilegeDAO.remove(privilegeClusterUserC1); expectLastCall().once(); privilegeDAO.remove(privilegeClusterOperatorC1); expectLastCall().once(); privilegeDAO.remove(privilegeClusterUserC1); expectLastCall().once(); privilegeDAO.remove(privilegeClusterOperatorC1); expectLastCall().once(); privilegeDAO.remove(privilegeClusterUserC2); expectLastCall().once(); privilegeDAO.remove(privilegeClusterOperatorC2); expectLastCall().once(); ClusterEntity clusterC1 = ems.createStrictMock(ClusterEntity.class); expect(clusterC1.getClusterName()).andReturn("c1").anyTimes(); ClusterEntity clusterC2 = ems.createStrictMock(ClusterEntity.class); expect(clusterC2.getClusterName()).andReturn("c2").anyTimes(); final ClusterDAO clusterDAO = ems.createMock(ClusterDAO.class); expect(clusterDAO.findByResourceId(1L)).andReturn(clusterC1).anyTimes(); expect(clusterDAO.findByResourceId(2L)).andReturn(clusterC2).anyTimes(); final Injector injector = Guice.createInjector(new AbstractModule() { @Override protected void configure() { bind(EntityManager.class).toInstance(ems.createNiceMock(EntityManager.class)); bind(UserDAO.class).toInstance(userDAO); bind(PrivilegeDAO.class).toInstance(privilegeDAO); bind(ClusterDAO.class).toInstance(clusterDAO); bind(DBAccessor.class).toInstance(ems.createNiceMock(DBAccessor.class)); bind(OsFamily.class).toInstance(ems.createNiceMock(OsFamily.class)); bind(PasswordEncoder.class).toInstance(createNiceMock(PasswordEncoder.class)); bind(HookContextFactory.class).toInstance(createMock(HookContextFactory.class)); bind(HookService.class).toInstance(createMock(HookService.class)); } }); ems.replayAll(); injector.getInstance(UpgradeCatalog240.class).consolidateUserRoles(); ems.verifyAll(); }