RangerSecurityZoneValidator extends RangerValidator { public void validate(RangerSecurityZone securityZone, Action action) throws Exception { if (LOG.isDebugEnabled()) { LOG.debug(String.format("==> RangerPolicyValidator.validate(%s, %s)", securityZone, action)); } List<ValidationFailureDetails> failures = new ArrayList<>(); boolean valid = isValid(securityZone, action, failures); String message; try { if (!valid) { message = serializeFailures(failures); throw new Exception(message); } } finally { if (LOG.isDebugEnabled()) { LOG.debug(String.format("<== RangerPolicyValidator.validate(%s, %s)", securityZone, action)); } } } RangerSecurityZoneValidator(ServiceStore store, SecurityZoneStore securityZoneStore); void validate(RangerSecurityZone securityZone, Action action);  }
@Test public void testValidateSecurityZoneForCreate() throws Exception{ SearchFilter filter = getSerachFilter(); List<RangerSecurityZone> rangerSecurityZoneList = new ArrayList<RangerSecurityZone>(); RangerService rangerSvc = getRangerService(); RangerServiceDef rangerSvcDef = rangerServiceDef(); RangerSecurityZone suppliedSecurityZone = getRangerSecurityZone(); rangerSecurityZoneList.add(suppliedSecurityZone); Mockito.when(_store.getSecurityZone("MyZone")).thenReturn(null); Mockito.when(_store.getServiceByName("hdfsSvc")).thenReturn(rangerSvc); Mockito.when(_store.getServiceDefByName("1")).thenReturn(rangerSvcDef); Mockito.when(_securityZoneStore.getSecurityZones(filter)).thenReturn(rangerSecurityZoneList); rangerSecurityZoneValidator.validate(suppliedSecurityZone, RangerValidator.Action.CREATE); Mockito.verify(_store).getSecurityZone("MyZone"); }
@Test public void testValidateSecurityZoneForUpdate() throws Exception{ SearchFilter filter = getSerachFilter(); List<RangerSecurityZone> rangerSecurityZoneList = new ArrayList<RangerSecurityZone>(); RangerService rangerSvc = getRangerService(); RangerServiceDef rangerSvcDef = rangerServiceDef(); RangerSecurityZone suppliedSecurityZone = getRangerSecurityZone(); rangerSecurityZoneList.add(suppliedSecurityZone); Mockito.when(_store.getSecurityZone(1L)).thenReturn(suppliedSecurityZone); Mockito.when(_store.getServiceByName("hdfsSvc")).thenReturn(rangerSvc); Mockito.when(_store.getServiceDefByName("1")).thenReturn(rangerSvcDef); Mockito.when(_securityZoneStore.getSecurityZones(filter)).thenReturn(rangerSecurityZoneList); rangerSecurityZoneValidator.validate(suppliedSecurityZone, RangerValidator.Action.UPDATE); Mockito.verify(_store, Mockito.atLeastOnce()).getSecurityZone(1L); }
@Test public void testValidateSecurityZoneForDeleteThrowsError() throws Exception{ RangerSecurityZone suppliedSecurityZone = getRangerSecurityZone(); try{ rangerSecurityZoneValidator.validate(suppliedSecurityZone, RangerValidator.Action.DELETE); }catch(IllegalArgumentException ex){ Assert.assertEquals(ex.getMessage(), "isValid(RangerPolicy, ...) is only supported for create/update"); } }
@Test public void testValidateSecurityZoneWithoutNameForCreate() throws Exception{ RangerSecurityZone suppliedSecurityZone = new RangerSecurityZone(); suppliedSecurityZone.setName(null); try{ rangerSecurityZoneValidator.validate(suppliedSecurityZone, RangerValidator.Action.CREATE); }catch(Exception ex){ Assert.assertEquals(ex.getMessage(), "(0) Validation failure: error code[3035], reason[Internal error: missing field[name]], field[name], subfield[null], type[missing] "); } }
@Test public void testValidateSecurityZoneForCreateWithExistingNameThrowsError() throws Exception{ RangerSecurityZone suppliedSecurityZone = getRangerSecurityZone(); RangerSecurityZone existingSecurityZone = getRangerSecurityZone(); Mockito.when(_store.getSecurityZone("MyZone")).thenReturn(existingSecurityZone); try{ rangerSecurityZoneValidator.validate(suppliedSecurityZone, RangerValidator.Action.CREATE); }catch(Exception ex){ Assert.assertEquals(ex.getMessage(), "(0) Validation failure: error code[3036], reason[Another security zone already exists for this name: zone-id=[1]]], field[name], subfield[null], type[] "); } }
@Test public void testValidateSecurityZoneNotExistForUpdateThrowsError() throws Exception { RangerSecurityZone suppliedSecurityZone = getRangerSecurityZone(); Mockito.when(_store.getSecurityZone(1L)).thenReturn(null); try { rangerSecurityZoneValidator.validate(suppliedSecurityZone,RangerValidator.Action.UPDATE); } catch (Exception ex) { Assert.assertEquals(ex.getMessage(),"(0) Validation failure: error code[3037], reason[No security zone found for [1]], field[id], subfield[null], type[] "); } }
@Test public void testValidateSecurityZoneWitoutServicesAdminUserAdminUserGroupAuditUserAuditUserGroupForCreateThrowsError() throws Exception{ RangerSecurityZone suppliedSecurityZone = getRangerSecurityZone(); suppliedSecurityZone.setAdminUserGroups(null); suppliedSecurityZone.setAdminUsers(null); suppliedSecurityZone.setAuditUserGroups(null); suppliedSecurityZone.setAuditUsers(null); suppliedSecurityZone.setServices(null); Mockito.when(_store.getSecurityZone("MyZone")).thenReturn(null); try { rangerSecurityZoneValidator.validate(suppliedSecurityZone, RangerValidator.Action.CREATE); } catch (Exception ex) { Assert.assertEquals( ex.getMessage(), "(0) Validation failure: error code[3044], reason[No services specified for security-zone:[MyZone]], field[services], subfield[null], type[missing] (1) Validation failure: error code[3038], reason[both users and user-groups collections for the security zone were null/empty], field[security zone admin users/user-groups], subfield[null], type[missing] (2) Validation failure: error code[3038], reason[both users and user-groups collections for the security zone were null/empty], field[security zone audit users/user-groups], subfield[null], type[missing] "); } }
@Test public void testValidateSecurityZoneWitoutResourcesForCreateThrowsError() throws Exception{ RangerSecurityZoneService rangerSecurityZoneService = new RangerSecurityZoneService(); RangerService rangerSvc = getRangerService(); RangerServiceDef rangerSvcDef = rangerServiceDef(); Mockito.when(_store.getServiceDefByName("1")).thenReturn(rangerSvcDef); Map<String, RangerSecurityZone.RangerSecurityZoneService> map = new HashMap<String, RangerSecurityZone.RangerSecurityZoneService>(); map.put("hdfsSvc", rangerSecurityZoneService); RangerSecurityZone suppliedSecurityZone = getRangerSecurityZone(); suppliedSecurityZone.setServices(map); Mockito.when(_store.getSecurityZone("MyZone")).thenReturn(null); Mockito.when(_store.getServiceByName("hdfsSvc")).thenReturn(rangerSvc); try { rangerSecurityZoneValidator.validate(suppliedSecurityZone, RangerValidator.Action.CREATE); } catch (Exception ex) { Assert.assertEquals( ex.getMessage(), "(0) Validation failure: error code[3039], reason[No resources specified for service [hdfsSvc]], field[security zone resources], subfield[null], type[missing] "); } }
@Test public void testValidateSecurityZoneWitoutRangerServiceForCreateThrowsError() throws Exception{ RangerSecurityZone suppliedSecurityZone = getRangerSecurityZone(); Mockito.when(_store.getSecurityZone("MyZone")).thenReturn(null); Mockito.when(_store.getServiceByName("hdfsSvc")).thenReturn(null); try { rangerSecurityZoneValidator.validate(suppliedSecurityZone, RangerValidator.Action.CREATE); } catch (Exception ex) { Assert.assertEquals( ex.getMessage(), "(0) Validation failure: error code[3040], reason[Invalid service [hdfsSvc]], field[security zone resource service-name], subfield[null], type[] "); } }
@Test public void testValidateSecurityZoneWitoutRangerServiceDefForCreateThrowsError() throws Exception{ RangerService rangerSvc = getRangerService(); RangerSecurityZone suppliedSecurityZone = getRangerSecurityZone(); Mockito.when(_store.getSecurityZone("MyZone")).thenReturn(null); Mockito.when(_store.getServiceByName("hdfsSvc")).thenReturn(rangerSvc); Mockito.when(_store.getServiceDefByName("1")).thenReturn(null); try { rangerSecurityZoneValidator.validate(suppliedSecurityZone, RangerValidator.Action.CREATE); } catch (Exception ex) { Assert.assertEquals( ex.getMessage(), "(0) Validation failure: error code[3041], reason[Invalid service-type [1]], field[security zone resource service-type], subfield[null], type[] "); } }
@Test public void testValidateSecurityZoneWitoutRangerServiceDefResourceForCreateThrowsError() throws Exception{ RangerService rangerSvc = getRangerService(); RangerServiceDef rangerSvcDef = rangerServiceDef(); rangerSvcDef.setResources(null); RangerSecurityZone suppliedSecurityZone = getRangerSecurityZone(); Mockito.when(_store.getSecurityZone("MyZone")).thenReturn(null); Mockito.when(_store.getServiceByName("hdfsSvc")).thenReturn(rangerSvc); Mockito.when(_store.getServiceDefByName("1")).thenReturn(rangerSvcDef); try { rangerSecurityZoneValidator.validate(suppliedSecurityZone, RangerValidator.Action.CREATE); } catch (Exception ex) { Assert.assertEquals( ex.getMessage(), "(0) Validation failure: error code[3042], reason[Invalid resource hierarchy specified for service:[hdfsSvc], resource-hierarchy:[[hdfs]]], field[security zone resource hierarchy], subfield[null], type[] "); } }
@Test public void testValidateWhileFetchingSecurityZoneForCreateThrowsError() throws Exception{ SearchFilter filter = getSerachFilter(); RangerService rangerSvc = getRangerService(); RangerServiceDef rangerSvcDef = rangerServiceDef(); RangerSecurityZone suppliedSecurityZone = getRangerSecurityZone(); Mockito.when(_store.getSecurityZone("MyZone")).thenReturn(null); Mockito.when(_store.getServiceByName("hdfsSvc")).thenReturn(rangerSvc); Mockito.when(_store.getServiceDefByName("1")).thenReturn(rangerSvcDef); Mockito.when(_securityZoneStore.getSecurityZones(filter)).thenThrow(new NullPointerException()); try { rangerSecurityZoneValidator.validate(suppliedSecurityZone, RangerValidator.Action.CREATE); } catch (Exception ex) { Assert.assertEquals( ex.getMessage(), "(0) Validation failure: error code[3045], reason[Internal Error:[null]], field[null], subfield[null], type[] "); } }