KeyAuthorizationKeyProvider extends KeyProviderCryptoExtension { @Override public KeyVersion createKey(String name, Options options) throws NoSuchAlgorithmException, IOException { writeLock.lock(); try { authorizeCreateKey(name, options, getUser()); return provider.createKey(name, options); } finally { writeLock.unlock(); } } KeyAuthorizationKeyProvider(KeyProviderCryptoExtension keyProvider,
      KeyACLs acls); @Override KeyVersion createKey(String name, Options options); @Override KeyVersion createKey(String name, byte[] material, Options options); @Override KeyVersion rollNewVersion(String name); @Override void deleteKey(String name); @Override KeyVersion rollNewVersion(String name, byte[] material); @Override void invalidateCache(String name); @Override void warmUpEncryptedKeys(String... names); @Override EncryptedKeyVersion generateEncryptedKey(String encryptionKeyName); @Override KeyVersion decryptEncryptedKey(EncryptedKeyVersion encryptedKeyVersion); @Override EncryptedKeyVersion reencryptEncryptedKey(EncryptedKeyVersion ekv); @Override void reencryptEncryptedKeys(List<EncryptedKeyVersion> ekvs); @Override KeyVersion getKeyVersion(String versionName); @Override List<String> getKeys(); @Override List<KeyVersion> getKeyVersions(String name); @Override Metadata getMetadata(String name); @Override Metadata[] getKeysMetadata(String... names); @Override KeyVersion getCurrentKey(String name); @Override void flush(); @Override boolean isTransient(); @Override String toString(); static final String KEY_ACL; }
@Test public void testCreateKey() throws Exception { final Configuration conf = new Configuration(); KeyProvider kp = new UserProvider.Factory().createProvider(new URI("user: KeyACLs mock = mock(KeyACLs.class); when(mock.isACLPresent("foo", KeyOpType.MANAGEMENT)).thenReturn(true); UserGroupInformation u1 = UserGroupInformation.createRemoteUser("u1"); when(mock.hasAccessToKey("foo", u1, KeyOpType.MANAGEMENT)).thenReturn(true); final KeyProviderCryptoExtension kpExt = new KeyAuthorizationKeyProvider( KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp), mock); u1.doAs( new PrivilegedExceptionAction<Void>() { @Override public Void run() throws Exception { try { kpExt.createKey("foo", SecureRandom.getSeed(16), newOptions(conf)); } catch (IOException ioe) { Assert.fail("User should be Authorized !!"); } try { kpExt.createKey("bar", SecureRandom.getSeed(16), newOptions(conf)); Assert.fail("User should NOT be Authorized !!"); } catch (IOException ioe) { } return null; } } ); UserGroupInformation.createRemoteUser("badGuy").doAs( new PrivilegedExceptionAction<Void>() { @Override public Void run() throws Exception { try { kpExt.createKey("foo", SecureRandom.getSeed(16), newOptions(conf)); Assert.fail("User should NOT be Authorized !!"); } catch (IOException ioe) { } return null; } } ); }