org.apache.sqoop.security.SecurityError Java Examples

The following examples show how to use org.apache.sqoop.security.SecurityError. You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example #1
Source File: AuthorizationRequestHandler.java    From sqoop-on-spark with Apache License 2.0 6 votes vote down vote up 
private JsonBean dropRole(RequestContext ctx) {
  AuthorizationHandler handler = AuthorizationManager.getAuthorizationHandler();
  AuditLoggerManager manager = AuditLoggerManager.getInstance();

  String[] urlElements = ctx.getUrlElements();

  //wrong URL
  if (urlElements.length < 2 ||
          !urlElements[urlElements.length - 2].equals(Action.ROLES.name)) {
    throw new SqoopException(SecurityError.AUTH_0012, "Can't get role name");
  }

  String role_name = ctx.getLastURLElement();
  MRole role = new MRole(role_name);
  manager.logAuditEvent(ctx.getUserName(),
          ctx.getRequest().getRemoteAddr(), "delete", "role", role.toString());
  handler.dropRole(role);
  return JsonBean.EMPTY_BEAN;
}
Example #2
Source File: SentryAuthorizationValidator.java    From incubator-sentry with Apache License 2.0 6 votes vote down vote up 
@Override
public void checkPrivileges(MPrincipal principal, List<MPrivilege> privileges) throws SqoopException {
  if (privileges == null || privileges.isEmpty()) {
    return;
  }
  PrincipalDesc principalDesc = new PrincipalDesc(principal.getName(), principal.getType());
  if (principalDesc.getType() != PrincipalType.USER) {
    throw new SqoopException(SecurityError.AUTH_0014,SentrySqoopError.AUTHORIZE_CHECK_NOT_SUPPORT_FOR_PRINCIPAL);
  }
  for (MPrivilege privilege : privileges) {
    if (LOG.isDebugEnabled()) {
      LOG.debug("Going to authorize check on privilege : " + privilege +
          " for principal: " + principal);
    }
    if (!binding.authorize(new Subject(principalDesc.getName()), privilege)) {
      throw new SqoopException(SecurityError.AUTH_0014, "User " + principalDesc.getName() +
          " does not have privileges for : " + privilege.toString());
    }
  }
}
Example #3
Source File: SentryAccessController.java    From incubator-sentry with Apache License 2.0 6 votes vote down vote up 
@Override
public void grantPrivileges(List<MPrincipal> principals, List<MPrivilege> privileges)
    throws SqoopException {
  for (MPrincipal principal : principals) {
    PrincipalDesc principalDesc = PrincipalDesc.fromStr(principal.getName(), principal.getType());
    if (principalDesc.getType() != PrincipalType.ROLE) {
      throw new SqoopException(SecurityError.AUTH_0014,
          SentrySqoopError.GRANT_REVOKE_PRIVILEGE_NOT_SUPPORT_FOR_PRINCIPAL
              + principalDesc.getType().name());
    }

    for (MPrivilege privilege : privileges) {
      if (LOG.isDebugEnabled()) {
        LOG.debug("Going to grant privilege : " + privilege +
            " to principal: " + principal);
      }
      binding.grantPrivilege(getSubject(), principal.getName(), privilege);
    }
  }
}
Example #4
Source File: SentryAccessController.java    From incubator-sentry with Apache License 2.0 6 votes vote down vote up 
@Override
public void grantRole(List<MPrincipal> principals, List<MRole> roles)
    throws SqoopException {
  for (MPrincipal principal : principals) {
    PrincipalDesc principalDesc = PrincipalDesc.fromStr(principal.getName(), principal.getType());
    if (principalDesc.getType() != PrincipalType.GROUP) {
      throw new SqoopException(SecurityError.AUTH_0014,
          SentrySqoopError.GRANT_REVOKE_ROLE_NOT_SUPPORT_FOR_PRINCIPAL
              + principalDesc.getType().name());
    }
    for (MRole role : roles) {
      if (LOG.isDebugEnabled()) {
        LOG.debug("Going to grant role : " + role.getName() +
            " to principal: " + principal);
      }
      binding.grantGroupToRole(getSubject(), principal.getName(), role);
    }
  }
}
Example #5
Source File: SentryAccessController.java    From incubator-sentry with Apache License 2.0 6 votes vote down vote up 
@Override
public void revokePrivileges(List<MPrincipal> principals, List<MPrivilege> privileges)
    throws SqoopException {
  for (MPrincipal principal : principals) {
    PrincipalDesc principalDesc = PrincipalDesc.fromStr(principal.getName(), principal.getType());
    if (principalDesc.getType() != PrincipalType.ROLE) {
      throw new SqoopException(SecurityError.AUTH_0014,
          SentrySqoopError.GRANT_REVOKE_PRIVILEGE_NOT_SUPPORT_FOR_PRINCIPAL
              + principalDesc.getType().name());
    }

    for (MPrivilege privilege : privileges) {
      if (LOG.isDebugEnabled()) {
        LOG.debug("Going to revoke privilege : " + privilege +
            " from principal: " + principal);
      }
      binding.revokePrivilege(getSubject(), principal.getName(), privilege);
    }
  }
}
Example #6
Source File: SentryAccessController.java    From incubator-sentry with Apache License 2.0 6 votes vote down vote up 
@Override
public void revokeRole(List<MPrincipal> principals, List<MRole> roles)
    throws SqoopException {
  for (MPrincipal principal : principals) {
    PrincipalDesc principalDesc = PrincipalDesc.fromStr(principal.getName(), principal.getType());
    if (principalDesc.getType() != PrincipalType.GROUP) {
      throw new SqoopException(SecurityError.AUTH_0014,
          SentrySqoopError.GRANT_REVOKE_ROLE_NOT_SUPPORT_FOR_PRINCIPAL
              + principalDesc.getType().name());
    }
    for (MRole role : roles) {
      if (LOG.isDebugEnabled()) {
        LOG.debug("Going to revoke role : " + role.getName() +
            " from principal: " + principal);
      }
      binding.revokeGroupfromRole(getSubject(), principal.getName(), role);
    }
  }
}
Example #7
Source File: KerberosAuthenticationHandler.java    From sqoop-on-spark with Apache License 2.0 5 votes vote down vote up 
public void secureLogin() {
  MapContext mapContext = SqoopConfiguration.getInstance().getContext();
  String keytab = mapContext.getString(
          SecurityConstants.AUTHENTICATION_KERBEROS_KEYTAB).trim();
  if (keytab.length() == 0) {
    throw new SqoopException(SecurityError.AUTH_0001,
            SecurityConstants.AUTHENTICATION_KERBEROS_KEYTAB);
  }
  keytabFile = keytab;

  String principal = mapContext.getString(
          SecurityConstants.AUTHENTICATION_KERBEROS_PRINCIPAL).trim();
  if (principal.length() == 0) {
    throw new SqoopException(SecurityError.AUTH_0002,
            SecurityConstants.AUTHENTICATION_KERBEROS_PRINCIPAL);
  }
  keytabPrincipal = principal;

  Configuration conf = new Configuration();
  conf.set(get_hadoop_security_authentication(),
          SecurityConstants.TYPE.KERBEROS.name());
  UserGroupInformation.setConfiguration(conf);
  try {
    String hostPrincipal = SecurityUtil.getServerPrincipal(principal, "0.0.0.0");
    UserGroupInformation.loginUserFromKeytab(hostPrincipal, keytab);
  } catch (IOException ex) {
    throw new SqoopException(SecurityError.AUTH_0003, ex);
  }
  LOG.info("Using Kerberos authentication, principal ["
          + principal + "] keytab [" + keytab + "]");
}
Example #8
Source File: DefaultAuthenticationProvider.java    From sqoop-on-spark with Apache License 2.0 5 votes vote down vote up 
private UserGroupInformation getRemoteUGI() {
  UserGroupInformation ugi = null;
  try {
    ugi = HttpUserGroupInformation.get();
  } catch (Exception e) {
    throw new SqoopException(SecurityError.AUTH_0011,
            "Unable to get remote authentication from http request", e);
  }

  if (ugi == null) {
    throw new SqoopException(SecurityError.AUTH_0011,
            "Unable to get remote authentication from http request");
  }
  return ugi;
}
Example #9
Source File: AuthorizationRequestHandler.java    From sqoop-on-spark with Apache License 2.0 5 votes vote down vote up 
private JsonBean getPrincipal(RequestContext ctx) {
  AuthorizationHandler handler = AuthorizationManager.getAuthorizationHandler();
  AuditLoggerManager manager = AuditLoggerManager.getInstance();
  String role_name = ctx.getParameterValue(ROLE_NAME_QUERY_PARAM);

  if (role_name != null) {
    // get principal by role
    MRole role = new MRole(role_name);
    manager.logAuditEvent(ctx.getUserName(),
            ctx.getRequest().getRemoteAddr(), "get", "principals by role", role.toString());
    return new PrincipalsBean(handler.getPrincipalsByRole(role));
  } else {
    throw new SqoopException(SecurityError.AUTH_0012, "Can't get role name");
  }
}
Example #10
Source File: RangerSqoopAuthorizer.java    From ranger with Apache License 2.0 5 votes vote down vote up 
@Override
public void checkPrivileges(MPrincipal principal, List<MPrivilege> privileges) throws SqoopException {
	if (LOG.isDebugEnabled()) {
		LOG.debug("==> RangerSqoopAuthorizer.checkPrivileges( principal=" + principal + ", privileges="
				+ privileges + ")");
	}

	if (CollectionUtils.isEmpty(privileges)) {
		if (LOG.isDebugEnabled()) {
			LOG.debug("<== RangerSqoopAuthorizer.checkPrivileges() return because privileges is empty.");
		}
		return;
	}

	RangerSqoopPlugin plugin = sqoopPlugin;

	if (plugin != null) {
		for (MPrivilege privilege : privileges) {
			RangerSqoopAccessRequest request = new RangerSqoopAccessRequest(principal, privilege, clientIPAddress);

			RangerAccessResult result = plugin.isAccessAllowed(request);
			if (result != null && !result.getIsAllowed()) {
				throw new SqoopException(SecurityError.AUTH_0014, "principal=" + principal
						+ " does not have privileges for : " + privilege);
			}
		}
	}

	if (LOG.isDebugEnabled()) {
		LOG.debug("<== RangerSqoopAuthorizer.checkPrivileges() success without exception.");
	}
}
Example #11
Source File: SentryAccessController.java    From incubator-sentry with Apache License 2.0 5 votes vote down vote up 
@Override
public List<MPrincipal> getPrincipalsByRole(MRole role) throws SqoopException {
  /**
   * Sentry does not implement this function yet
   */
  throw new SqoopException(SecurityError.AUTH_0014, SentrySqoopError.NOT_IMPLEMENT_YET);
}
Example #12
Source File: SentryAccessController.java    From incubator-sentry with Apache License 2.0 5 votes vote down vote up 
@Override
public List<MPrivilege> getPrivilegesByPrincipal(MPrincipal principal,
    MResource resource) throws SqoopException {
  /**
   * Sentry Only supports get privilege by role
   */
  PrincipalDesc principalDesc = PrincipalDesc.fromStr(principal.getName(), principal.getType());
  if (principalDesc.getType() != PrincipalType.ROLE) {
    throw new SqoopException(SecurityError.AUTH_0014,
        SentrySqoopError.SHOW_PRIVILEGE_NOT_SUPPORTED_FOR_PRINCIPAL
            + principalDesc.getType().name());
  }
  return binding.listPrivilegeByRole(getSubject(), principalDesc.getName(), resource);
}
Example #13
Source File: SentryAccessController.java    From incubator-sentry with Apache License 2.0 5 votes vote down vote up 
@Override
public List<MRole> getRolesByPrincipal(MPrincipal principal) throws SqoopException {
  /**
   * Sentry Only supports get privilege by role
   */
  PrincipalDesc principalDesc = PrincipalDesc.fromStr(principal.getName(), principal.getType());
  if (principalDesc.getType() != PrincipalType.GROUP) {
    throw new SqoopException(SecurityError.AUTH_0014,
        SentrySqoopError.SHOW_GRANT_NOT_SUPPORTED_FOR_PRINCIPAL
            + principalDesc.getType().name());
  }
  return binding.listRolesByGroup(getSubject(), principalDesc.getName());
}
Example #14
Source File: SqoopAuthenticationFilter.java    From sqoop-on-spark with Apache License 2.0 4 votes vote down vote up 
@Override
protected Properties getConfiguration(String configPrefix,
                                      FilterConfig filterConfig) throws ServletException {
  Properties properties = new Properties();
  MapContext mapContext = SqoopConfiguration.getInstance().getContext();
  String type = mapContext.getString(
      SecurityConstants.AUTHENTICATION_TYPE,
      SecurityConstants.TYPE.SIMPLE.name()).trim();

  if (type.equalsIgnoreCase(SecurityConstants.TYPE.KERBEROS.name())) {
    properties.setProperty(AUTH_TYPE, KerberosDelegationTokenAuthenticationHandler.class.getName());

    String keytab = mapContext.getString(
            SecurityConstants.AUTHENTICATION_KERBEROS_HTTP_KEYTAB).trim();
    if (keytab.length() == 0) {
      throw new SqoopException(SecurityError.AUTH_0005,
              SecurityConstants.AUTHENTICATION_KERBEROS_HTTP_KEYTAB);
    }

    String principal = mapContext.getString(
            SecurityConstants.AUTHENTICATION_KERBEROS_HTTP_PRINCIPAL).trim();
    if (principal.length() == 0) {
      throw new SqoopException(SecurityError.AUTH_0006,
              SecurityConstants.AUTHENTICATION_KERBEROS_HTTP_PRINCIPAL);
    }

    String hostPrincipal = "";
    try {
      hostPrincipal = SecurityUtil.getServerPrincipal(principal, "0.0.0.0");
    } catch (IOException e) {
      throw new SqoopException(SecurityError.AUTH_0006,
              SecurityConstants.AUTHENTICATION_KERBEROS_HTTP_PRINCIPAL);
    }

    properties.setProperty(KerberosAuthenticationHandler.PRINCIPAL, hostPrincipal);
    properties.setProperty(KerberosAuthenticationHandler.KEYTAB, keytab);
  } else if (type.equalsIgnoreCase(SecurityConstants.TYPE.SIMPLE.name())) {
    properties.setProperty(AUTH_TYPE, PseudoDelegationTokenAuthenticationHandler.class.getName());
    properties.setProperty(PseudoAuthenticationHandler.ANONYMOUS_ALLOWED,
        mapContext.getString(SecurityConstants.AUTHENTICATION_ANONYMOUS, "true").trim());
  } else {
    throw new SqoopException(SecurityError.AUTH_0004, type);
  }

  properties.setProperty(DelegationTokenAuthenticationHandler.TOKEN_KIND,
          SecurityConstants.TOKEN_KIND);

  return properties;
}
Example #15
Source File: TestOwnerPrivilege.java    From incubator-sentry with Apache License 2.0 4 votes vote down vote up 
@Test
public void testJobOwner() throws Exception {
  // USER3 at firstly has no privilege on any Sqoop resource
  SqoopClient client = sqoopServerRunner.getSqoopClient(USER3);
  assertTrue(client.getConnectors().size() == 0);
  /**
   * ADMIN_USER grant read action privilege on connector all to role ROLE3
   * ADMIN_USER grant role ROLE3 to group GROUP3
   */
  client = sqoopServerRunner.getSqoopClient(ADMIN_USER);
  MRole role3 = new MRole(ROLE3);
  MPrincipal group3 = new MPrincipal(GROUP3, MPrincipal.TYPE.GROUP);
  MResource  allConnector = new MResource(SqoopActionConstant.ALL, MResource.TYPE.CONNECTOR);
  MPrivilege readPriv = new MPrivilege(allConnector,SqoopActionConstant.READ, false);
  client.createRole(role3);
  client.grantRole(Lists.newArrayList(role3), Lists.newArrayList(group3));
  client.grantPrivilege(Lists.newArrayList(new MPrincipal(ROLE3, MPrincipal.TYPE.ROLE)),
      Lists.newArrayList(readPriv));

  // check USER3 has the read privilege on all connector
  client = sqoopServerRunner.getSqoopClient(USER3);
  assertTrue(client.getConnectors().size() > 0);

  // USER3 create two links: hdfs link and rdbm link
  MLink rdbmsLink = client.createLink("generic-jdbc-connector");
  sqoopServerRunner.fillRdbmsLinkConfig(rdbmsLink);
  sqoopServerRunner.saveLink(client, rdbmsLink);

  MLink hdfsLink = client.createLink("hdfs-connector");
  sqoopServerRunner.fillHdfsLink(hdfsLink);
  sqoopServerRunner.saveLink(client, hdfsLink);

  // USER3 is the owner of hdfs and link, so he can show and update hdfs link
  assertTrue(client.getLinks().size() == 2);
  hdfsLink.setName("HDFS_update2");
  client.updateLink(hdfsLink);
  rdbmsLink.setName("RDBM_update");
  client.updateLink(rdbmsLink);

  // USER_3 create a job: transfer date from HDFS to RDBM
  MJob job1 = client.createJob(hdfsLink.getPersistenceId(), rdbmsLink.getPersistenceId());
  // set HDFS "FROM" config for the job, since the connector test case base class only has utilities for HDFS!
  sqoopServerRunner.fillHdfsFromConfig(job1);

  // set the RDBM "TO" config here
  sqoopServerRunner.fillRdbmsToConfig(job1);

  // create job
  sqoopServerRunner.saveJob(client, job1);

  /**
   *  USER3 is the owner of job1 , so he can show and delete job1.
   *  USER4 has no privilege on job1
   */
  client = sqoopServerRunner.getSqoopClient(USER4);
  assertTrue(client.getJobs().size() == 0);
  try {
    client.deleteJob(job1.getPersistenceId());
    fail("expected Authorization exception happend");
  } catch (Exception e) {
    assertCausedMessage(e, SecurityError.AUTH_0014.getMessage());
  }
  client = sqoopServerRunner.getSqoopClient(USER3);
  assertEquals(client.getJob(job1.getPersistenceId()), job1);
  client.deleteJob(job1.getPersistenceId());

  // delete the HDFS and RDBM links
  client.deleteLink(hdfsLink.getPersistenceId());
  client.deleteLink(rdbmsLink.getPersistenceId());
}