Skip to content

Commit 7c1d201

Browse files
adoroszlaiadoroszlai
authored
HDDS-12451. Create factory for MultiTenantAccessController (#7996)
1 parent c2a934c commit 7c1d201

6 files changed

Lines changed: 148 additions & 79 deletions

File tree

‎hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/OMMultiTenantManagerImpl.java‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -55,12 +55,10 @@
5555
import org.apache.hadoop.ozone.om.multitenant.BucketNameSpace;
5656
import org.apache.hadoop.ozone.om.multitenant.CachedTenantState;
5757
import org.apache.hadoop.ozone.om.multitenant.CachedTenantState.CachedAccessIdInfo;
58-
import org.apache.hadoop.ozone.om.multitenant.InMemoryMultiTenantAccessController;
5958
import org.apache.hadoop.ozone.om.multitenant.MultiTenantAccessController;
6059
import org.apache.hadoop.ozone.om.multitenant.MultiTenantAccessController.Policy;
6160
import org.apache.hadoop.ozone.om.multitenant.MultiTenantAccessController.Role;
6261
import org.apache.hadoop.ozone.om.multitenant.OzoneTenant;
63-
import org.apache.hadoop.ozone.om.multitenant.RangerClientMultiTenantAccessController;
6462
import org.apache.hadoop.ozone.om.multitenant.Tenant;
6563
import org.apache.hadoop.ozone.om.service.OMRangerBGSyncService;
6664
import org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos.UserAccessIdInfo;
@@ -112,14 +110,7 @@ public OMMultiTenantManagerImpl(OzoneManager ozoneManager,
112110

113111
loadTenantCacheFromDB();
114112

115-
boolean devSkipRanger = conf.getBoolean(
116-
OZONE_OM_TENANT_DEV_SKIP_RANGER, false);
117-
118-
if (devSkipRanger) {
119-
this.accessController = new InMemoryMultiTenantAccessController();
120-
} else {
121-
this.accessController = new RangerClientMultiTenantAccessController(conf);
122-
}
113+
accessController = MultiTenantAccessController.create(conf);
123114

124115
cacheOp = new CacheOp(tenantCache, tenantCacheLock);
125116
authorizerOp = new AuthorizerOp(accessController,

‎hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/multitenant/MultiTenantAccessController.java‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@
1717

1818
package org.apache.hadoop.ozone.om.multitenant;
1919

20+
import static org.apache.hadoop.ozone.om.OMMultiTenantManagerImpl.OZONE_OM_TENANT_DEV_SKIP_RANGER;
21+
2022
import java.io.IOException;
2123
import java.util.ArrayList;
2224
import java.util.Collection;
@@ -28,7 +30,9 @@
2830
import java.util.Objects;
2931
import java.util.Optional;
3032
import java.util.Set;
33+
import org.apache.hadoop.hdds.conf.ConfigurationSource;
3134
import org.apache.hadoop.ozone.security.acl.IAccessAuthorizer;
35+
import org.apache.ratis.util.ReflectionUtils;
3236

3337
/**
3438
* Defines the operations needed for multi-tenant access control.
@@ -504,4 +508,18 @@ public Policy build() {
504508
}
505509
}
506510
}
511+
512+
/** Create {@code MultiTenantAccessController} implementation. */
513+
static MultiTenantAccessController create(ConfigurationSource conf) {
514+
if (conf.getBoolean(OZONE_OM_TENANT_DEV_SKIP_RANGER, false)) {
515+
return new InMemoryMultiTenantAccessController();
516+
}
517+
518+
final String className = "org.apache.hadoop.ozone.om.multitenant.RangerClientMultiTenantAccessController";
519+
return ReflectionUtils.newInstance(
520+
ReflectionUtils.getClass(className, MultiTenantAccessController.class),
521+
new Class<?>[] {ConfigurationSource.class},
522+
conf
523+
);
524+
}
507525
}

‎hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/multitenant/RangerClientMultiTenantAccessController.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@
3535
import java.util.List;
3636
import java.util.Map;
3737
import java.util.stream.Collectors;
38-
import org.apache.hadoop.hdds.conf.OzoneConfiguration;
38+
import org.apache.hadoop.hdds.conf.ConfigurationSource;
3939
import org.apache.hadoop.ozone.OmUtils;
4040
import org.apache.hadoop.ozone.OzoneConsts;
4141
import org.apache.hadoop.ozone.security.acl.IAccessAuthorizer;
@@ -70,7 +70,7 @@ public class RangerClientMultiTenantAccessController implements
7070
// execUser for Ranger
7171
private final String shortName;
7272

73-
public RangerClientMultiTenantAccessController(OzoneConfiguration conf)
73+
public RangerClientMultiTenantAccessController(ConfigurationSource conf)
7474
throws IOException {
7575

7676
aclToString = MultiTenantAccessController.getRangerAclStrings();

hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/multitenant/TestMultiTenantAccessController.java renamed to hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/multitenant/MultiTenantAccessControllerTests.java

Lines changed: 6 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,9 @@
1717

1818
package org.apache.hadoop.ozone.om.multitenant;
1919

20-
import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_KEYTAB_FILE_KEY;
21-
import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_PRINCIPAL_KEY;
22-
import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_RANGER_HTTPS_ADDRESS_KEY;
23-
import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_RANGER_SERVICE;
2420
import static org.apache.hadoop.ozone.om.OMMultiTenantManager.OZONE_TENANT_RANGER_ROLE_DESCRIPTION;
2521
import static org.assertj.core.api.Assertions.assertThat;
22+
import static org.assertj.core.api.Assumptions.assumeThatCode;
2623
import static org.junit.jupiter.api.Assertions.assertEquals;
2724
import static org.junit.jupiter.api.Assertions.assertFalse;
2825
import static org.junit.jupiter.api.Assertions.assertThrows;
@@ -36,26 +33,22 @@
3633
import java.util.Map;
3734
import java.util.UUID;
3835
import java.util.stream.Collectors;
39-
import org.apache.hadoop.hdds.conf.OzoneConfiguration;
4036
import org.apache.hadoop.ozone.om.multitenant.MultiTenantAccessController.Acl;
4137
import org.apache.hadoop.ozone.om.multitenant.MultiTenantAccessController.Policy;
4238
import org.apache.hadoop.ozone.om.multitenant.MultiTenantAccessController.Role;
4339
import org.apache.hadoop.ozone.security.acl.IAccessAuthorizer.ACLType;
44-
import org.apache.hadoop.security.authentication.util.KerberosName;
45-
import org.apache.ozone.test.GenericTestUtils;
46-
import org.apache.ranger.RangerClient;
4740
import org.junit.jupiter.api.BeforeEach;
4841
import org.junit.jupiter.api.Test;
49-
import org.slf4j.LoggerFactory;
50-
import org.slf4j.event.Level;
5142

5243
/**
5344
* To test MultiTenantAccessController with Ranger Client.
5445
*/
55-
public class TestMultiTenantAccessController {
46+
public abstract class MultiTenantAccessControllerTests {
5647
private MultiTenantAccessController controller;
5748
private List<String> users;
5849

50+
protected abstract MultiTenantAccessController createSubject();
51+
5952
@BeforeEach
6053
public void setupUsers() {
6154
// If testing against a real cluster, users must already be added to Ranger.
@@ -64,64 +57,10 @@ public void setupUsers() {
6457
users.add("hdfs");
6558
}
6659

67-
/**
68-
* Use this setup to test against a simulated Ranger instance.
69-
*/
7060
@BeforeEach
7161
public void setupUnitTest() {
72-
controller = new InMemoryMultiTenantAccessController();
73-
}
74-
75-
/**
76-
* Use this setup to test against a live Ranger instance.
77-
*/
78-
// @BeforeEach
79-
public void setupClusterTest() throws Exception {
80-
81-
// Set up truststore
82-
System.setProperty("javax.net.ssl.trustStore",
83-
"/path/to/cm-auto-global_truststore.jks");
84-
85-
// Specify Kerberos client config (krb5.conf) path
86-
System.setProperty("java.security.krb5.conf", "/etc/krb5.conf");
87-
88-
// Enable Kerberos debugging
89-
System.setProperty("sun.security.krb5.debug", "true");
90-
91-
// DEFAULT rule uses the default realm configured in krb5.conf
92-
KerberosName.setRules("DEFAULT");
93-
94-
final OzoneConfiguration conf = new OzoneConfiguration();
95-
96-
// These config keys must be properly set when the test is run:
97-
//
98-
// OZONE_RANGER_HTTPS_ADDRESS_KEY
99-
// OZONE_RANGER_SERVICE
100-
// OZONE_OM_KERBEROS_PRINCIPAL_KEY
101-
// OZONE_OM_KERBEROS_KEYTAB_FILE_KEY
102-
103-
// Same as OM ranger-ozone-security.xml ranger.plugin.ozone.policy.rest.url
104-
conf.set(OZONE_RANGER_HTTPS_ADDRESS_KEY,
105-
"https://RANGER_HOST:6182/");
106-
107-
// Same as OM ranger-ozone-security.xml ranger.plugin.ozone.service.name
108-
conf.set(OZONE_RANGER_SERVICE, "cm_ozone");
109-
110-
conf.set(OZONE_OM_KERBEROS_PRINCIPAL_KEY,
111-
"om/instance@REALM");
112-
113-
conf.set(OZONE_OM_KERBEROS_KEYTAB_FILE_KEY,
114-
"/path/to/ozone.keytab");
115-
116-
// TODO: Test with clear text username and password as well.
117-
// conf.set(OZONE_OM_RANGER_HTTPS_ADMIN_API_USER, "rangeruser");
118-
// conf.set(OZONE_OM_RANGER_HTTPS_ADMIN_API_PASSWD, "passwd");
119-
120-
// (Optional) Enable RangerClient debug log
121-
GenericTestUtils.setLogLevel(
122-
LoggerFactory.getLogger(RangerClient.class), Level.DEBUG);
123-
124-
controller = new RangerClientMultiTenantAccessController(conf);
62+
controller = createSubject();
63+
assumeThatCode(() -> controller.getRangerServicePolicyVersion()).doesNotThrowAnyException();
12564
}
12665

12766
@Test

‎hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/multitenant/TestInMemoryMultiTenantAccessController.java‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to You under the Apache License, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
package org.apache.hadoop.ozone.om.multitenant;
19+
20+
import static org.apache.hadoop.ozone.om.OMMultiTenantManagerImpl.OZONE_OM_TENANT_DEV_SKIP_RANGER;
21+
import static org.junit.jupiter.api.Assertions.assertInstanceOf;
22+
23+
import org.apache.hadoop.hdds.conf.InMemoryConfiguration;
24+
import org.apache.hadoop.hdds.conf.MutableConfigurationSource;
25+
26+
class TestInMemoryMultiTenantAccessController extends MultiTenantAccessControllerTests {
27+
28+
@Override
29+
protected MultiTenantAccessController createSubject() {
30+
MutableConfigurationSource conf = new InMemoryConfiguration();
31+
conf.setBoolean(OZONE_OM_TENANT_DEV_SKIP_RANGER, true);
32+
return assertInstanceOf(InMemoryMultiTenantAccessController.class, MultiTenantAccessController.create(conf));
33+
}
34+
35+
}

‎hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/multitenant/TestRangerClientMultiTenantAccessController.java‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to You under the Apache License, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
package org.apache.hadoop.ozone.om.multitenant;
19+
20+
import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_KEYTAB_FILE_KEY;
21+
import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_PRINCIPAL_KEY;
22+
import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_RANGER_HTTPS_ADDRESS_KEY;
23+
import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_RANGER_SERVICE;
24+
import static org.junit.jupiter.api.Assertions.assertInstanceOf;
25+
26+
import org.apache.hadoop.hdds.conf.InMemoryConfiguration;
27+
import org.apache.hadoop.hdds.conf.MutableConfigurationSource;
28+
import org.apache.hadoop.security.authentication.util.KerberosName;
29+
import org.apache.ozone.test.GenericTestUtils;
30+
import org.apache.ozone.test.tag.Unhealthy;
31+
import org.apache.ranger.RangerClient;
32+
import org.slf4j.LoggerFactory;
33+
import org.slf4j.event.Level;
34+
35+
@Unhealthy("Requires a Ranger endpoint")
36+
class TestRangerClientMultiTenantAccessController extends MultiTenantAccessControllerTests {
37+
38+
@Override
39+
protected MultiTenantAccessController createSubject() {
40+
MutableConfigurationSource conf = new InMemoryConfiguration();
41+
42+
// Set up truststore
43+
System.setProperty("javax.net.ssl.trustStore",
44+
"/path/to/cm-auto-global_truststore.jks");
45+
46+
// Specify Kerberos client config (krb5.conf) path
47+
System.setProperty("java.security.krb5.conf", "/etc/krb5.conf");
48+
49+
// Enable Kerberos debugging
50+
System.setProperty("sun.security.krb5.debug", "true");
51+
52+
// DEFAULT rule uses the default realm configured in krb5.conf
53+
KerberosName.setRules("DEFAULT");
54+
55+
// These config keys must be properly set when the test is run:
56+
//
57+
// OZONE_RANGER_HTTPS_ADDRESS_KEY
58+
// OZONE_RANGER_SERVICE
59+
// OZONE_OM_KERBEROS_PRINCIPAL_KEY
60+
// OZONE_OM_KERBEROS_KEYTAB_FILE_KEY
61+
62+
// Same as OM ranger-ozone-security.xml ranger.plugin.ozone.policy.rest.url
63+
conf.set(OZONE_RANGER_HTTPS_ADDRESS_KEY,
64+
"https://localhost:6182/");
65+
66+
// Same as OM ranger-ozone-security.xml ranger.plugin.ozone.service.name
67+
conf.set(OZONE_RANGER_SERVICE, "cm_ozone");
68+
69+
conf.set(OZONE_OM_KERBEROS_PRINCIPAL_KEY,
70+
"om/_HOST@EXAMPLE.COM");
71+
72+
conf.set(OZONE_OM_KERBEROS_KEYTAB_FILE_KEY,
73+
"/path/to/ozone.keytab");
74+
75+
// TODO: Test with clear text username and password as well.
76+
// conf.set(OZONE_OM_RANGER_HTTPS_ADMIN_API_USER, "rangeruser");
77+
// conf.set(OZONE_OM_RANGER_HTTPS_ADMIN_API_PASSWD, "passwd");
78+
79+
// (Optional) Enable RangerClient debug log
80+
GenericTestUtils.setLogLevel(
81+
LoggerFactory.getLogger(RangerClient.class), Level.DEBUG);
82+
83+
return assertInstanceOf(RangerClientMultiTenantAccessController.class, MultiTenantAccessController.create(conf));
84+
}
85+
86+
}

0 commit comments

Comments
 (0)