ProxyUserValidation { public static void validateImpersonator(String impersonator, String impersonated) { String mappedImpersonated = AbstractUserMapper.getInstance().map(impersonated); EmailValidation.validateEmail(mappedImpersonated); MDC.put(LoggingUtils.MDC_AUTH_MODE_PROXY_IMPERSONATED_USER_KEY, impersonated); List<? extends Config> proxyConfigs = AppSettings.getInstance().getConfigList(AppSettings.PROXY_USERS); for (Config proxyConfig : proxyConfigs) { String proxy = proxyConfig.getString(CONFIG_PROXY); if (impersonator.equals(proxy)) { if (isWhitelistedByUsername(proxyConfig, mappedImpersonated)) { return; } else if (isWhitelistedByGroupMembership(proxyConfig, mappedImpersonated)) { return; } } } throw Status.PERMISSION_DENIED .withDescription("Impersonation disallowed for `" + impersonator + "`") .asRuntimeException(); }  static void validateImpersonator(String impersonator, String impersonated); static Directory getDirectoryService();  }
@Test public void testValidateImpersonatorInvalid() { String[] users = {ALICE, BOB, CHARLIE}; for (String user : users) { try { ProxyUserValidation.validateImpersonator(SPARK, user); fail(); } catch (StatusRuntimeException e) { assertEquals(Status.PERMISSION_DENIED.getCode(), e.getStatus().getCode()); assertEquals("Impersonation disallowed for `spark/testhost@EXAMPLE.COM`", e.getStatus().getDescription()); } } }
@Test public void testValidateImpersonatorByUserWhitelist() { ProxyUserValidation.validateImpersonator(PRESTO, ALICE); ProxyUserValidation.validateImpersonator(PRESTO, BOB); ProxyUserValidation.validateImpersonator(PRESTO, CHARLIE); ProxyUserValidation.validateImpersonator(STORM, ALICE); ProxyUserValidation.validateImpersonator(STORM, BOB); try { ProxyUserValidation.validateImpersonator(STORM, CHARLIE); fail(); } catch (StatusRuntimeException e) { assertEquals(Status.PERMISSION_DENIED.getCode(), e.getStatus().getCode()); assertEquals("Impersonation disallowed for `storm/testhost@EXAMPLE.COM`", e.getStatus().getDescription()); } }
@Test public void testValidateImpersonatorByGroupWhitelist() { ProxyUserValidation.validateImpersonator(OOZIE, ALICE); ProxyUserValidation.validateImpersonator(OOZIE, BOB); ProxyUserValidation.validateImpersonator(OOZIE, CHARLIE); ProxyUserValidation.validateImpersonator(HIVE, ALICE); String[] someUsers = {BOB, CHARLIE}; for (String user : someUsers) { try { ProxyUserValidation.validateImpersonator(HIVE, user); fail(); } catch (StatusRuntimeException e) { assertEquals(Status.PERMISSION_DENIED.getCode(), e.getStatus().getCode()); assertEquals("Impersonation disallowed for `hive/testhost@EXAMPLE.COM`", e.getStatus().getDescription()); } } String[] allUsers = {ALICE, BOB, CHARLIE}; for (String user : allUsers) { try { ProxyUserValidation.validateImpersonator(SOLR, user); fail(); } catch (StatusRuntimeException e) { assertEquals(Status.PERMISSION_DENIED.getCode(), e.getStatus().getCode()); assertEquals("Impersonation disallowed for `solr/testhost@EXAMPLE.COM`", e.getStatus().getDescription()); } } }