View Javadoc

1   /*
2    *
3    * Licensed to the Apache Software Foundation (ASF) under one
4    * or more contributor license agreements.  See the NOTICE file
5    * distributed with this work for additional information
6    * regarding copyright ownership.  The ASF licenses this file
7    * to you under the Apache License, Version 2.0 (the
8    * "License"); you may not use this file except in compliance
9    * with the License.  You may obtain a copy of the License at
10   *
11   *     http://www.apache.org/licenses/LICENSE-2.0
12   *
13   * Unless required by applicable law or agreed to in writing, software
14   * distributed under the License is distributed on an "AS IS" BASIS,
15   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16   * See the License for the specific language governing permissions and
17   * limitations under the License.
18   */
19  
20  package org.apache.hadoop.hbase.security;
21  
22  import org.apache.commons.logging.Log;
23  import org.apache.commons.logging.LogFactory;
24  import org.apache.hadoop.conf.Configuration;
25  import org.apache.hadoop.hbase.AuthUtil;
26  import org.apache.hadoop.hbase.classification.InterfaceAudience;
27  
28  import java.io.IOException;
29  import java.util.ArrayList;
30  import java.util.List;
31  
32  /**
33   * Keeps lists of superusers and super groups loaded from HBase configuration,
34   * checks if certain user is regarded as superuser.
35   */
36  @InterfaceAudience.Private
37  public final class Superusers {
38    private static final Log LOG = LogFactory.getLog(Superusers.class);
39  
40    /** Configuration key for superusers */
41    public static final String SUPERUSER_CONF_KEY = "hbase.superuser"; // Not getting a name
42  
43    private static List<String> superUsers;
44    private static List<String> superGroups;
45    private static User systemUser;
46  
47    private Superusers(){}
48  
49    /**
50     * Should be called only once to pre-load list of super users and super
51     * groups from Configuration. This operation is idempotent.
52     * @param conf configuration to load users from
53     * @throws IOException if unable to initialize lists of superusers or super groups
54     * @throws IllegalStateException if current user is null
55     */
56    public static void initialize(Configuration conf) throws IOException {
57      superUsers = new ArrayList<>();
58      superGroups = new ArrayList<>();
59      systemUser = User.getCurrent();
60  
61      if (systemUser == null) {
62        throw new IllegalStateException("Unable to obtain the current user, "
63          + "authorization checks for internal operations will not work correctly!");
64      }
65  
66      if (LOG.isTraceEnabled()) {
67        LOG.trace("Current user name is " + systemUser.getShortName());
68      }
69      String currentUser = systemUser.getShortName();
70      String[] superUserList = conf.getStrings(SUPERUSER_CONF_KEY, new String[0]);
71      for (String name : superUserList) {
72        if (AuthUtil.isGroupPrincipal(name)) {
73          superGroups.add(AuthUtil.getGroupName(name));
74        } else {
75          superUsers.add(name);
76        }
77      }
78      superUsers.add(currentUser);
79    }
80  
81    /**
82     * @return true if current user is a super user (whether as user running process,
83     * declared as individual superuser or member of supergroup), false otherwise.
84     * @param user to check
85     * @throws IllegalStateException if lists of superusers/super groups
86     *   haven't been initialized properly
87     */
88    public static boolean isSuperUser(User user) {
89      if (superUsers == null) {
90        throw new IllegalStateException("Super users/super groups lists"
91          + " haven't been initialized properly.");
92      }
93      if (superUsers.contains(user.getShortName())) {
94        return true;
95      }
96  
97      for (String group : user.getGroupNames()) {
98        if (superGroups.contains(group)) {
99          return true;
100       }
101     }
102     return false;
103   }
104 
105   /**
106    * @return true if current user is a super user (whether as user running process,
107    * or declared as superuser in configuration), false otherwise.
108    * @param user to check
109    * @throws IllegalStateException if lists of superusers/super groups
110    *   haven't been initialized properly
111    * @deprecated this method is for backward compatibility, use {@link #isSuperUser(User)} instead
112    */
113   @Deprecated
114   public static boolean isSuperUser(String user) {
115     if (superUsers == null) {
116       throw new IllegalStateException("Super users/super groups lists"
117         + " haven't been initialized properly.");
118     }
119     if (superUsers.contains(user)) {
120       return true;
121     } else {
122       return false;
123     }
124   }
125 
126   public static User getSystemUser() {
127     return systemUser;
128   }
129 }