org.apache.hadoop.hbase.security.access

Class TestAccessController

java.lang.Object

org.apache.hadoop.hbase.security.access.SecureTestUtil

org.apache.hadoop.hbase.security.access.TestAccessController

public class TestAccessController
extends SecureTestUtil

Performs authorization checks for common operations, according to different levels of authorized users.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
private class	TestAccessController.BulkLoadAccessTestAction
static class	TestAccessController.BulkLoadHelper
static class	TestAccessController.MyShellBasedUnixGroupsMapping
static class	TestAccessController.PingCoprocessor
static class	TestAccessController.TestTableDDLProcedure

Nested classes/interfaces inherited from class org.apache.hadoop.hbase.security.access.SecureTestUtil

SecureTestUtil.AccessTestAction, SecureTestUtil.MasterSyncObserver

Field Summary

Fields

Modifier and Type	Field and Description
private static org.apache.hadoop.hbase.security.access.AccessController	ACCESS_CONTROLLER
static HBaseClassTestRule	CLASS_RULE
private static org.apache.hadoop.conf.Configuration	conf
private static org.apache.hadoop.hbase.coprocessor.MasterCoprocessorEnvironment	CP_ENV
private static org.apache.hadoop.fs.permission.FsPermission	FS_PERMISSION_ALL
private static String	GROUP_ADMIN
private static String	GROUP_CREATE
private static String	GROUP_READ
private static String	GROUP_WRITE
private static org.slf4j.Logger	LOG
org.junit.rules.TestName	name
private static org.apache.hadoop.hbase.coprocessor.RegionCoprocessorEnvironment	RCP_ENV
private static org.apache.hadoop.hbase.coprocessor.RegionServerCoprocessorEnvironment	RSCP_ENV
private static org.apache.hadoop.hbase.security.User	SUPERUSER
private static org.apache.hadoop.hbase.client.Connection	systemUserConnection The systemUserConnection created here is tied to the system user.
private static byte[]	TEST_FAMILY
private static byte[]	TEST_QUALIFIER
private static byte[]	TEST_ROW
private static org.apache.hadoop.hbase.TableName	TEST_TABLE
private static org.apache.hadoop.hbase.TableName	TEST_TABLE2
private static HBaseTestingUtility	TEST_UTIL
private static org.apache.hadoop.hbase.security.User	USER_ADMIN
private static org.apache.hadoop.hbase.security.User	USER_ADMIN_CF
private static org.apache.hadoop.hbase.security.User	USER_CREATE
private static org.apache.hadoop.hbase.security.User	USER_GROUP_ADMIN
private static org.apache.hadoop.hbase.security.User	USER_GROUP_CREATE
private static org.apache.hadoop.hbase.security.User	USER_GROUP_READ
private static org.apache.hadoop.hbase.security.User	USER_GROUP_WRITE
private static org.apache.hadoop.hbase.security.User	USER_NONE
private static org.apache.hadoop.hbase.security.User	USER_OWNER
private static org.apache.hadoop.hbase.security.User	USER_RO
private static org.apache.hadoop.hbase.security.User	USER_RW

Constructor Summary

Constructors

Constructor and Description
TestAccessController()

Method Summary

Modifier and Type	Method and Description
private static void	cleanUp()
private void	createTestTable(org.apache.hadoop.hbase.TableName tname)
private void	createTestTable(org.apache.hadoop.hbase.TableName tname, byte[] cf)
private void	getNamespacePermissionsAndVerify(String namespaceRegexWithoutPrefix, int expectedAmount, String expectedNamespace) List all user permissions match the given regular expression for namespace and verify each of them.
private PrivilegedAction<List<org.apache.hadoop.hbase.security.access.UserPermission>>	getPrivilegedAction(String regex)
private boolean	hasFoundUserPermission(List<org.apache.hadoop.hbase.security.access.UserPermission> userPermissions, List<org.apache.hadoop.hbase.security.access.UserPermission> perms)
private boolean	hasFoundUserPermission(org.apache.hadoop.hbase.security.access.UserPermission userPermission, List<org.apache.hadoop.hbase.security.access.UserPermission> perms)
static void	setupBeforeClass()
private static void	setUpTableAndUserPermissions()
static void	tearDownAfterClass()
void	testAbortProcedure()
void	testAccessControlClientGlobalGrantRevoke()
void	testAccessControlClientGrantRevoke()
void	testAccessControlClientGrantRevokeOnNamespace()
void	testAccessControlClientMultiGrantRevoke()
void	testAccessControlClientUserPerms()
void	testAccessControllerUserPermsRegexHandling()
void	testAccessControlRevokeOnlyFewPermission()
void	testAddReplicationPeer()
void	testAppend()
void	testAssign()
void	testBalance()
void	testBalanceSwitch()
void	testBulkLoad()
void	testBulkLoadWithoutWritePermission()
void	testCheckPermissions()
void	testCloseRegion()
void	testCompact()
void	testCoprocessorExec()
void	testDisableReplicationPeer()
void	testEnableReplicationPeer()
void	testExecuteProcedures()
void	testFlush()
void	testGetClusterStatus()
void	testGetLocks()
void	testGetNamespacePermission()
void	testGetProcedures()
void	testGetReplicationPeerConfig()
void	testGetUserPermissions()
void	testGlobalAuthorizationForNewRegisteredRS()
void	testGlobalPermissionList()
void	testGrantRevoke()
void	testHasPermission()
void	testIsRpcThrottleEnabled()
void	testListReplicationPeers()
void	testMove()
void	testNamespaceUserGrant()
void	testOpenRegion()
void	testPermissionList()
void	testPostGrantRevoke()
void	testPostGrantRevokeAtQualifierLevel()
void	testPrepareAndCleanBulkLoad()
void	testRead()
void	testReadWrite()
void	testRegionOffline()
void	testRemoteLocks()
void	testRemoveReplicationPeer()
void	testReplicateLogEntries()
void	testRollWALWriterRequest()
void	testSecurityCapabilities()
void	testSetQuota()
void	testSetSplitOrMergeEnabled()
void	testShutdown()
void	testSnapshot()
void	testSnapshotWithOwner()
void	testSplitWithSplitRow()
void	testStopMaster()
void	testStopRegionServer()
void	testSwitchExceedThrottleQuota()
void	testSwitchRpcThrottle()
void	testTableCreate()
void	testTableDelete()
void	testTableDeletion()
void	testTableDescriptorsEnumeration()
void	testTableDisable()
void	testTableEnable()
void	testTableModify()
void	testTableNameEnumeration()
void	testTableTruncate()
void	testTruncatePerms()
void	testUnassign()
void	testUnauthorizedShutdown()
void	testUnauthorizedStopMaster()
void	testUpdateReplicationPeerConfig()
void	testWrite()
private void	validateGlobalUserACLForGetUserPermissions(org.apache.hadoop.hbase.client.Connection conn, org.apache.hadoop.hbase.security.User nSUser1, org.apache.hadoop.hbase.security.User globalGroupUser1, org.apache.hadoop.hbase.security.User globalGroupUser2, Collection<String> superUsers, int superUserCount)
private void	validateNamespaceUserACLForGetUserPermissions(org.apache.hadoop.hbase.client.Connection conn, org.apache.hadoop.hbase.security.User nSUser1, org.apache.hadoop.hbase.security.User nSUser3, org.apache.hadoop.hbase.security.User nsGroupUser1, org.apache.hadoop.hbase.security.User nsGroupUser2, String nsPrefix, String namespace1, String namespace2)
private void	validateTableACLForGetUserPermissions(org.apache.hadoop.hbase.client.Connection conn, org.apache.hadoop.hbase.security.User nSUser1, org.apache.hadoop.hbase.security.User tableGroupUser1, org.apache.hadoop.hbase.security.User tableGroupUser2, String nsPrefix, org.apache.hadoop.hbase.TableName table1, org.apache.hadoop.hbase.TableName table2, byte[] TEST_QUALIFIER2, Collection<String> superUsers)
private void	verifyAnyCreate(SecureTestUtil.AccessTestAction action)
private void	verifyGetUserPermissionResult(List<org.apache.hadoop.hbase.security.access.UserPermission> userPermissions, int resultCount, byte[] cf, byte[] cq, String userName, Collection<String> superUsers)
private void	verifyGlobal(SecureTestUtil.AccessTestAction action) global operations
private void	verifyRead(SecureTestUtil.AccessTestAction action)
private void	verifyReadWrite(SecureTestUtil.AccessTestAction action)
private void	verifyWrite(SecureTestUtil.AccessTestAction action)

Methods inherited from class org.apache.hadoop.hbase.security.access.SecureTestUtil

checkGlobalPerms, checkTablePerms, checkTablePerms, configureSuperuser, convertToNamespace, createNamespace, createTable, createTable, createTable, createTable, createTable, deleteNamespace, deleteTable, deleteTable, enableSecurity, grantGlobal, grantGlobal, grantGlobalUsingAccessControlClient, grantOnNamespace, grantOnNamespace, grantOnNamespaceUsingAccessControlClient, grantOnTable, grantOnTable, grantOnTableUsingAccessControlClient, revokeFromNamespace, revokeFromNamespace, revokeFromNamespaceUsingAccessControlClient, revokeFromTable, revokeFromTable, revokeFromTableUsingAccessControlClient, revokeGlobal, revokeGlobal, revokeGlobalUsingAccessControlClient, verifyAllowed, verifyAllowed, verifyAllowed, verifyConfiguration, verifyDenied, verifyDenied, verifyIfEmptyList, verifyIfNull

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

CLASS_RULE

public static final HBaseClassTestRule CLASS_RULE

FS_PERMISSION_ALL

private static final org.apache.hadoop.fs.permission.FsPermission FS_PERMISSION_ALL

LOG

private static final org.slf4j.Logger LOG

TEST_TABLE

private static org.apache.hadoop.hbase.TableName TEST_TABLE

TEST_UTIL

private static final HBaseTestingUtility TEST_UTIL

conf

private static org.apache.hadoop.conf.Configuration conf

systemUserConnection

private static org.apache.hadoop.hbase.client.Connection systemUserConnection

The systemUserConnection created here is tied to the system user. In case, you are planning to create AccessTestAction, DON'T use this systemUserConnection as the 'doAs' user gets eclipsed by the system user.

SUPERUSER

private static org.apache.hadoop.hbase.security.User SUPERUSER

USER_ADMIN

private static org.apache.hadoop.hbase.security.User USER_ADMIN

USER_RW

private static org.apache.hadoop.hbase.security.User USER_RW

USER_RO

private static org.apache.hadoop.hbase.security.User USER_RO

USER_OWNER

private static org.apache.hadoop.hbase.security.User USER_OWNER

USER_CREATE

private static org.apache.hadoop.hbase.security.User USER_CREATE

USER_NONE

private static org.apache.hadoop.hbase.security.User USER_NONE

USER_ADMIN_CF

private static org.apache.hadoop.hbase.security.User USER_ADMIN_CF

GROUP_ADMIN

private static final String GROUP_ADMIN

See Also:

Constant Field Values

GROUP_CREATE

private static final String GROUP_CREATE

See Also:

Constant Field Values

GROUP_READ

private static final String GROUP_READ

See Also:

Constant Field Values

GROUP_WRITE

private static final String GROUP_WRITE

See Also:

Constant Field Values

USER_GROUP_ADMIN

private static org.apache.hadoop.hbase.security.User USER_GROUP_ADMIN

USER_GROUP_CREATE

private static org.apache.hadoop.hbase.security.User USER_GROUP_CREATE

USER_GROUP_READ

private static org.apache.hadoop.hbase.security.User USER_GROUP_READ

USER_GROUP_WRITE

private static org.apache.hadoop.hbase.security.User USER_GROUP_WRITE

TEST_TABLE2

private static org.apache.hadoop.hbase.TableName TEST_TABLE2

TEST_FAMILY

private static byte[] TEST_FAMILY

TEST_QUALIFIER

private static byte[] TEST_QUALIFIER

TEST_ROW

private static byte[] TEST_ROW

CP_ENV

private static org.apache.hadoop.hbase.coprocessor.MasterCoprocessorEnvironment CP_ENV

ACCESS_CONTROLLER

private static org.apache.hadoop.hbase.security.access.AccessController ACCESS_CONTROLLER

RSCP_ENV

private static org.apache.hadoop.hbase.coprocessor.RegionServerCoprocessorEnvironment RSCP_ENV

RCP_ENV

private static org.apache.hadoop.hbase.coprocessor.RegionCoprocessorEnvironment RCP_ENV

name

public org.junit.rules.TestName name

Constructor Detail

TestAccessController

public TestAccessController()

Method Detail

setupBeforeClass

public static void setupBeforeClass()
                             throws Exception

Throws:

Exception

tearDownAfterClass

public static void tearDownAfterClass()
                               throws Exception

Throws:

Exception

setUpTableAndUserPermissions

private static void setUpTableAndUserPermissions()
                                          throws Exception

Throws:

Exception

cleanUp

private static void cleanUp()
                     throws Exception

Throws:

Exception

testUnauthorizedShutdown

public void testUnauthorizedShutdown()
                              throws Exception

Throws:

Exception

testUnauthorizedStopMaster

public void testUnauthorizedStopMaster()
                                throws Exception

Throws:

Exception

testSecurityCapabilities

public void testSecurityCapabilities()
                              throws Exception

Throws:

Exception

testTableCreate

public void testTableCreate()
                     throws Exception

Throws:

Exception

testTableModify

public void testTableModify()
                     throws Exception

Throws:

Exception

testTableDelete

public void testTableDelete()
                     throws Exception

Throws:

Exception

testTableTruncate

public void testTableTruncate()
                       throws Exception

Throws:

Exception

testTableDisable

public void testTableDisable()
                      throws Exception

Throws:

Exception

testTableEnable

public void testTableEnable()
                     throws Exception

Throws:

Exception

testAbortProcedure

public void testAbortProcedure()
                        throws Exception

Throws:

Exception

testGetProcedures

public void testGetProcedures()
                       throws Exception

Throws:

Exception

testGetLocks

public void testGetLocks()
                  throws Exception

Throws:

Exception

testMove

public void testMove()
              throws Exception

Throws:

Exception

testAssign

public void testAssign()
                throws Exception

Throws:

Exception

testUnassign

public void testUnassign()
                  throws Exception

Throws:

Exception

testRegionOffline

public void testRegionOffline()
                       throws Exception

Throws:

Exception

testSetSplitOrMergeEnabled

public void testSetSplitOrMergeEnabled()
                                throws Exception

Throws:

Exception

testBalance

public void testBalance()
                 throws Exception

Throws:

Exception

testBalanceSwitch

public void testBalanceSwitch()
                       throws Exception

Throws:

Exception

testShutdown

public void testShutdown()
                  throws Exception

Throws:

Exception

testStopMaster

public void testStopMaster()
                    throws Exception

Throws:

Exception

verifyWrite

private void verifyWrite(SecureTestUtil.AccessTestAction action)
                  throws Exception

Throws:

Exception

testSplitWithSplitRow

public void testSplitWithSplitRow()
                           throws Exception

Throws:

Exception

testFlush

public void testFlush()
               throws Exception

Throws:

Exception

testCompact

public void testCompact()
                 throws Exception

Throws:

Exception

verifyRead

private void verifyRead(SecureTestUtil.AccessTestAction action)
                 throws Exception

Throws:

Exception

verifyReadWrite

private void verifyReadWrite(SecureTestUtil.AccessTestAction action)
                      throws Exception

Throws:

Exception

testRead

public void testRead()
              throws Exception

Throws:

Exception

testWrite

public void testWrite()
               throws Exception

Throws:

Exception

testReadWrite

public void testReadWrite()
                   throws Exception

Throws:

Exception

testBulkLoad

public void testBulkLoad()
                  throws Exception

Throws:

Exception

testBulkLoadWithoutWritePermission

public void testBulkLoadWithoutWritePermission()
                                        throws Exception

Throws:

Exception

testAppend

public void testAppend()
                throws Exception

Throws:

Exception

testGrantRevoke

public void testGrantRevoke()
                     throws Exception

Throws:

Exception

testPostGrantRevoke

public void testPostGrantRevoke()
                         throws Exception

Throws:

Exception

hasFoundUserPermission

private boolean hasFoundUserPermission(List<org.apache.hadoop.hbase.security.access.UserPermission> userPermissions,
                                       List<org.apache.hadoop.hbase.security.access.UserPermission> perms)

hasFoundUserPermission

private boolean hasFoundUserPermission(org.apache.hadoop.hbase.security.access.UserPermission userPermission,
                                       List<org.apache.hadoop.hbase.security.access.UserPermission> perms)

testPostGrantRevokeAtQualifierLevel

public void testPostGrantRevokeAtQualifierLevel()
                                         throws Exception

Throws:

Exception

testPermissionList

public void testPermissionList()
                        throws Exception

Throws:

Exception

testGlobalPermissionList

public void testGlobalPermissionList()
                              throws Exception

Throws:

Exception

verifyGlobal

private void verifyGlobal(SecureTestUtil.AccessTestAction action)
                   throws Exception

global operations

Throws:

Exception

testCheckPermissions

public void testCheckPermissions()
                          throws Exception

Throws:

Exception

testStopRegionServer

public void testStopRegionServer()
                          throws Exception

Throws:

Exception

testRollWALWriterRequest

public void testRollWALWriterRequest()
                              throws Exception

Throws:

Exception

testOpenRegion

public void testOpenRegion()
                    throws Exception

Throws:

Exception

testCloseRegion

public void testCloseRegion()
                     throws Exception

Throws:

Exception

testSnapshot

public void testSnapshot()
                  throws Exception

Throws:

Exception

testSnapshotWithOwner

public void testSnapshotWithOwner()
                           throws Exception

Throws:

Exception

testGlobalAuthorizationForNewRegisteredRS

public void testGlobalAuthorizationForNewRegisteredRS()
                                               throws Exception

Throws:

Exception

testTableDescriptorsEnumeration

public void testTableDescriptorsEnumeration()
                                     throws Exception

Throws:

Exception

testTableNameEnumeration

public void testTableNameEnumeration()
                              throws Exception

Throws:

Exception

testTableDeletion

public void testTableDeletion()
                       throws Exception

Throws:

Exception

createTestTable

private void createTestTable(org.apache.hadoop.hbase.TableName tname)
                      throws Exception

Throws:

Exception

createTestTable

private void createTestTable(org.apache.hadoop.hbase.TableName tname,
                             byte[] cf)
                      throws Exception

Throws:

Exception

testNamespaceUserGrant

public void testNamespaceUserGrant()
                            throws Exception

Throws:

Exception

testAccessControlClientGrantRevoke

public void testAccessControlClientGrantRevoke()
                                        throws Exception

Throws:

Exception

testAccessControlClientGlobalGrantRevoke

public void testAccessControlClientGlobalGrantRevoke()
                                              throws Exception

Throws:

Exception

testAccessControlClientMultiGrantRevoke

public void testAccessControlClientMultiGrantRevoke()
                                             throws Exception

Throws:

Exception

testAccessControlClientGrantRevokeOnNamespace

public void testAccessControlClientGrantRevokeOnNamespace()
                                                   throws Exception

Throws:

Exception

testCoprocessorExec

public void testCoprocessorExec()
                         throws Exception

Throws:

Exception

testSetQuota

public void testSetQuota()
                  throws Exception

Throws:

Exception

testGetNamespacePermission

public void testGetNamespacePermission()
                                throws Exception

Throws:

Exception

getNamespacePermissionsAndVerify

private void getNamespacePermissionsAndVerify(String namespaceRegexWithoutPrefix,
                                              int expectedAmount,
                                              String expectedNamespace)
                                       throws org.apache.hadoop.hbase.exceptions.HBaseException

List all user permissions match the given regular expression for namespace and verify each of them.

Parameters:

namespaceRegexWithoutPrefix - the regualar expression for namespace, without NAMESPACE_PREFIX

expectedAmount - the expected amount of user permissions returned

expectedNamespace - the expected namespace of each user permission returned

Throws:

org.apache.hadoop.hbase.exceptions.HBaseException - in the case of any HBase exception when accessing hbase:acl table

testTruncatePerms

public void testTruncatePerms()
                       throws Exception

Throws:

Exception

getPrivilegedAction

private PrivilegedAction<List<org.apache.hadoop.hbase.security.access.UserPermission>> getPrivilegedAction(String regex)

testAccessControlClientUserPerms

public void testAccessControlClientUserPerms()
                                      throws Exception

Throws:

Exception

testAccessControllerUserPermsRegexHandling

public void testAccessControllerUserPermsRegexHandling()
                                                throws Exception

Throws:

Exception

verifyAnyCreate

private void verifyAnyCreate(SecureTestUtil.AccessTestAction action)
                      throws Exception

Throws:

Exception

testPrepareAndCleanBulkLoad

public void testPrepareAndCleanBulkLoad()
                                 throws Exception

Throws:

Exception

testReplicateLogEntries

public void testReplicateLogEntries()
                             throws Exception

Throws:

Exception

testAddReplicationPeer

public void testAddReplicationPeer()
                            throws Exception

Throws:

Exception

testRemoveReplicationPeer

public void testRemoveReplicationPeer()
                               throws Exception

Throws:

Exception

testEnableReplicationPeer

public void testEnableReplicationPeer()
                               throws Exception

Throws:

Exception

testDisableReplicationPeer

public void testDisableReplicationPeer()
                                throws Exception

Throws:

Exception

testGetReplicationPeerConfig

public void testGetReplicationPeerConfig()
                                  throws Exception

Throws:

Exception

testUpdateReplicationPeerConfig

public void testUpdateReplicationPeerConfig()
                                     throws Exception

Throws:

Exception

testListReplicationPeers

public void testListReplicationPeers()
                              throws Exception

Throws:

Exception

testRemoteLocks

public void testRemoteLocks()
                     throws Exception

Throws:

Exception

testAccessControlRevokeOnlyFewPermission

public void testAccessControlRevokeOnlyFewPermission()
                                              throws Throwable

Throws:

Throwable

testGetClusterStatus

public void testGetClusterStatus()
                          throws Exception

Throws:

Exception

testExecuteProcedures

public void testExecuteProcedures()
                           throws Exception

Throws:

Exception

testGetUserPermissions

public void testGetUserPermissions()
                            throws Throwable

Throws:

Throwable

testHasPermission

public void testHasPermission()
                       throws Throwable

Throws:

Throwable

testSwitchRpcThrottle

public void testSwitchRpcThrottle()
                           throws Exception

Throws:

Exception

testIsRpcThrottleEnabled

public void testIsRpcThrottleEnabled()
                              throws Exception

Throws:

Exception

testSwitchExceedThrottleQuota

public void testSwitchExceedThrottleQuota()
                                   throws Exception

Throws:

Exception

validateGlobalUserACLForGetUserPermissions

private void validateGlobalUserACLForGetUserPermissions(org.apache.hadoop.hbase.client.Connection conn,
                                                        org.apache.hadoop.hbase.security.User nSUser1,
                                                        org.apache.hadoop.hbase.security.User globalGroupUser1,
                                                        org.apache.hadoop.hbase.security.User globalGroupUser2,
                                                        Collection<String> superUsers,
                                                        int superUserCount)
                                                 throws Throwable

Throws:

Throwable

validateNamespaceUserACLForGetUserPermissions

private void validateNamespaceUserACLForGetUserPermissions(org.apache.hadoop.hbase.client.Connection conn,
                                                           org.apache.hadoop.hbase.security.User nSUser1,
                                                           org.apache.hadoop.hbase.security.User nSUser3,
                                                           org.apache.hadoop.hbase.security.User nsGroupUser1,
                                                           org.apache.hadoop.hbase.security.User nsGroupUser2,
                                                           String nsPrefix,
                                                           String namespace1,
                                                           String namespace2)
                                                    throws Throwable

Throws:

Throwable

validateTableACLForGetUserPermissions

private void validateTableACLForGetUserPermissions(org.apache.hadoop.hbase.client.Connection conn,
                                                   org.apache.hadoop.hbase.security.User nSUser1,
                                                   org.apache.hadoop.hbase.security.User tableGroupUser1,
                                                   org.apache.hadoop.hbase.security.User tableGroupUser2,
                                                   String nsPrefix,
                                                   org.apache.hadoop.hbase.TableName table1,
                                                   org.apache.hadoop.hbase.TableName table2,
                                                   byte[] TEST_QUALIFIER2,
                                                   Collection<String> superUsers)
                                            throws Throwable

Throws:

Throwable

verifyGetUserPermissionResult

private void verifyGetUserPermissionResult(List<org.apache.hadoop.hbase.security.access.UserPermission> userPermissions,
                                           int resultCount,
                                           byte[] cf,
                                           byte[] cq,
                                           String userName,
                                           Collection<String> superUsers)