KMSACLs implements Runnable, KeyACLs { @VisibleForTesting void setKeyACLs(Configuration conf) { Map<String, HashMap<KeyOpType, AccessControlList>> tempKeyAcls = new HashMap<String, HashMap<KeyOpType,AccessControlList>>(); Map<String, String> allKeyACLS = conf.getValByRegex(KMSConfiguration.KEY_ACL_PREFIX_REGEX); for (Map.Entry<String, String> keyAcl : allKeyACLS.entrySet()) { String k = keyAcl.getKey(); int keyNameStarts = KMSConfiguration.KEY_ACL_PREFIX.length(); int keyNameEnds = k.lastIndexOf("."); if (keyNameStarts >= keyNameEnds) { LOG.warn("Invalid key name '{}'", k); } else { String aclStr = keyAcl.getValue(); String keyName = k.substring(keyNameStarts, keyNameEnds); String keyOp = k.substring(keyNameEnds + 1); KeyOpType aclType = null; try { aclType = KeyOpType.valueOf(keyOp); } catch (IllegalArgumentException e) { LOG.warn("Invalid key Operation '{}'", keyOp); } if (aclType != null) { HashMap<KeyOpType,AccessControlList> aclMap = tempKeyAcls.get(keyName); if (aclMap == null) { aclMap = new HashMap<KeyOpType, AccessControlList>(); tempKeyAcls.put(keyName, aclMap); } aclMap.put(aclType, new AccessControlList(aclStr)); LOG.info("KEY_NAME '{}' KEY_OP '{}' ACL '{}'", keyName, aclType, aclStr); } } } keyAcls = tempKeyAcls; final Map<KeyOpType, AccessControlList> tempDefaults = new HashMap<>(); final Map<KeyOpType, AccessControlList> tempWhitelists = new HashMap<>(); for (KeyOpType keyOp : KeyOpType.values()) { parseAclsWithPrefix(conf, KMSConfiguration.DEFAULT_KEY_ACL_PREFIX, keyOp, tempDefaults); parseAclsWithPrefix(conf, KMSConfiguration.WHITELIST_KEY_ACL_PREFIX, keyOp, tempWhitelists); } defaultKeyAcls = tempDefaults; whitelistKeyAcls = tempWhitelists; } KMSACLs(Configuration conf);  KMSACLs(); @Override void run(); synchronized void startReloader(); synchronized void stopReloader(); boolean hasAccess(Type type, UserGroupInformation ugi); void assertAccess(KMSACLs.Type aclType,
      UserGroupInformation ugi, KMSOp operation, String key); @Override boolean hasAccessToKey(String keyName, UserGroupInformation ugi,
      KeyOpType opType); @Override boolean isACLPresent(String keyName, KeyOpType opType); static final String ACL_DEFAULT; static final int RELOADER_SLEEP_MILLIS; }
@Test public void testKeyAclReload() { Configuration conf = new Configuration(false); conf.set(DEFAULT_KEY_ACL_PREFIX + "READ", "read1"); conf.set(DEFAULT_KEY_ACL_PREFIX + "MANAGEMENT", ""); conf.set(DEFAULT_KEY_ACL_PREFIX + "GENERATE_EEK", "*"); conf.set(DEFAULT_KEY_ACL_PREFIX + "DECRYPT_EEK", "decrypt1"); conf.set(KEY_ACL + "testuser1.ALL", "testkey1"); conf.set(WHITELIST_KEY_ACL_PREFIX + "READ", "admin_read1"); conf.set(WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT", ""); conf.set(WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK", "*"); conf.set(WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK", "admin_decrypt1"); final KMSACLs acls = new KMSACLs(conf); conf.set(DEFAULT_KEY_ACL_PREFIX + "READ", "read2"); conf.set(DEFAULT_KEY_ACL_PREFIX + "MANAGEMENT", "mgmt1,mgmt2"); conf.set(DEFAULT_KEY_ACL_PREFIX + "GENERATE_EEK", ""); conf.set(DEFAULT_KEY_ACL_PREFIX + "DECRYPT_EEK", "decrypt2"); conf.set(KEY_ACL + "testkey1.ALL", "testkey1,testkey2"); conf.set(WHITELIST_KEY_ACL_PREFIX + "READ", "admin_read2"); conf.set(WHITELIST_KEY_ACL_PREFIX + "MANAGEMENT", "admin_mgmt,admin_mgmt1"); conf.set(WHITELIST_KEY_ACL_PREFIX + "GENERATE_EEK", ""); conf.set(WHITELIST_KEY_ACL_PREFIX + "DECRYPT_EEK", "admin_decrypt2"); acls.setKeyACLs(conf); assertDefaultKeyAcl(acls, KeyOpType.READ, "read2"); assertDefaultKeyAcl(acls, KeyOpType.MANAGEMENT, "mgmt1", "mgmt2"); assertDefaultKeyAcl(acls, KeyOpType.GENERATE_EEK); assertDefaultKeyAcl(acls, KeyOpType.DECRYPT_EEK, "decrypt2"); assertKeyAcl("testuser1", acls, KeyOpType.ALL, "testkey1"); assertWhitelistKeyAcl(acls, KeyOpType.READ, "admin_read2"); assertWhitelistKeyAcl(acls, KeyOpType.MANAGEMENT, "admin_mgmt", "admin_mgmt1"); assertWhitelistKeyAcl(acls, KeyOpType.GENERATE_EEK); assertWhitelistKeyAcl(acls, KeyOpType.DECRYPT_EEK, "admin_decrypt2"); acls.setKeyACLs(conf); assertDefaultKeyAcl(acls, KeyOpType.READ, "read2"); assertDefaultKeyAcl(acls, KeyOpType.MANAGEMENT, "mgmt1", "mgmt2"); assertDefaultKeyAcl(acls, KeyOpType.GENERATE_EEK); assertDefaultKeyAcl(acls, KeyOpType.DECRYPT_EEK, "decrypt2"); assertKeyAcl("testuser1", acls, KeyOpType.ALL, "testkey1"); assertWhitelistKeyAcl(acls, KeyOpType.READ, "admin_read2"); assertWhitelistKeyAcl(acls, KeyOpType.MANAGEMENT, "admin_mgmt", "admin_mgmt1"); assertWhitelistKeyAcl(acls, KeyOpType.GENERATE_EEK); assertWhitelistKeyAcl(acls, KeyOpType.DECRYPT_EEK, "admin_decrypt2"); conf.set(DEFAULT_KEY_ACL_PREFIX + "DECRYPT_EEK", "*"); acls.setKeyACLs(conf); AccessControlList acl = acls.defaultKeyAcls.get(KeyOpType.DECRYPT_EEK); Assert.assertTrue(acl.isAllAllowed()); Assert.assertTrue(acl.getUsers().isEmpty()); assertDefaultKeyAcl(acls, KeyOpType.READ, "read2"); assertDefaultKeyAcl(acls, KeyOpType.MANAGEMENT, "mgmt1", "mgmt2"); assertDefaultKeyAcl(acls, KeyOpType.GENERATE_EEK); assertKeyAcl("testuser1", acls, KeyOpType.ALL, "testkey1"); assertWhitelistKeyAcl(acls, KeyOpType.READ, "admin_read2"); assertWhitelistKeyAcl(acls, KeyOpType.MANAGEMENT, "admin_mgmt", "admin_mgmt1"); assertWhitelistKeyAcl(acls, KeyOpType.GENERATE_EEK); assertWhitelistKeyAcl(acls, KeyOpType.DECRYPT_EEK, "admin_decrypt2"); conf = new Configuration(); conf.set(DEFAULT_KEY_ACL_PREFIX + "DECRYPT_EEK", "new"); acls.setKeyACLs(conf); assertDefaultKeyAcl(acls, KeyOpType.DECRYPT_EEK, "new"); Assert.assertTrue(acls.keyAcls.isEmpty()); Assert.assertTrue(acls.whitelistKeyAcls.isEmpty()); Assert.assertEquals("Got unexpected sized acls:" + acls.defaultKeyAcls, 1, acls.defaultKeyAcls.size()); }