org.apache.hadoop.hbase.zookeeper

Class TestZooKeeperACL

java.lang.Object

org.apache.hadoop.hbase.zookeeper.TestZooKeeperACL

public class TestZooKeeperACL
extends Object

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
private static class	TestZooKeeperACL.DummySecurityConfiguration

Field Summary

Fields

Modifier and Type	Field and Description
static HBaseClassTestRule	CLASS_RULE
private static org.slf4j.Logger	LOG
private static boolean	secureZKAvailable
private static HBaseTestingUtility	TEST_UTIL
private static org.apache.hadoop.hbase.zookeeper.ZKWatcher	zkw

Constructor Summary

Constructors

Constructor and Description
TestZooKeeperACL()

Method Summary

Modifier and Type	Method and Description
void	setUp()
static void	setUpBeforeClass()
static void	tearDownAfterClass()
void	testAdminDrainAllowedOnSecureZK()
void	testHBaseIDZNodeACL() When authentication is enabled on ZooKeeper, /hbase/hbaseid should be created with 2 ACLs: one specifies that the hbase user has full access to the node; the other, that it is world-readable.
void	testHBaseMasterServerZNodeACL() When authentication is enabled on ZooKeeper, /hbase/master should be created with 2 ACLs: one specifies that the hbase user has full access to the node; the other, that it is world-readable.
void	testHBaseRootRegionServerZNodeACL() When authentication is enabled on ZooKeeper, /hbase/root-region-server should be created with 2 ACLs: one specifies that the hbase user has full access to the node; the other, that it is world-readable.
void	testHBaseRootZNodeACL() Create a node and check its ACL.
void	testIsZooKeeperSecure() Check if ZooKeeper JaasConfiguration is valid.
void	testIsZooKeeperSecureWithProgrammaticConfig() Check if Programmatic way of setting zookeeper security settings is valid.
void	testOutsideHBaseNodeACL() Finally, we check the ACLs of a node outside of the /hbase hierarchy and verify that its ACL is simply 'hbase:Perms.ALL'.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

CLASS_RULE

public static final HBaseClassTestRule CLASS_RULE

LOG

private static final org.slf4j.Logger LOG

TEST_UTIL

private static final HBaseTestingUtility TEST_UTIL

zkw

private static org.apache.hadoop.hbase.zookeeper.ZKWatcher zkw

secureZKAvailable

private static boolean secureZKAvailable

Constructor Detail

TestZooKeeperACL

public TestZooKeeperACL()

Method Detail

setUpBeforeClass

public static void setUpBeforeClass()
                             throws Exception

Throws:

Exception

tearDownAfterClass

public static void tearDownAfterClass()
                               throws Exception

Throws:

Exception

setUp

public void setUp()
           throws Exception

Throws:

Exception

testHBaseRootZNodeACL

public void testHBaseRootZNodeACL()
                           throws Exception

Create a node and check its ACL. When authentication is enabled on ZooKeeper, all nodes (except /hbase/root-region-server, /hbase/master and /hbase/hbaseid) should be created so that only the hbase server user (master or region server user) that created them can access them, and this user should have all permissions on this node. For /hbase/root-region-server, /hbase/master, and /hbase/hbaseid the permissions should be as above, but should also be world-readable. First we check the general case of /hbase nodes in the following test, and then check the subset of world-readable nodes in the three tests after that.

Throws:

Exception

testHBaseRootRegionServerZNodeACL

public void testHBaseRootRegionServerZNodeACL()
                                       throws Exception

When authentication is enabled on ZooKeeper, /hbase/root-region-server should be created with 2 ACLs: one specifies that the hbase user has full access to the node; the other, that it is world-readable.

Throws:

Exception

testHBaseMasterServerZNodeACL

public void testHBaseMasterServerZNodeACL()
                                   throws Exception

When authentication is enabled on ZooKeeper, /hbase/master should be created with 2 ACLs: one specifies that the hbase user has full access to the node; the other, that it is world-readable.

Throws:

Exception

testHBaseIDZNodeACL

public void testHBaseIDZNodeACL()
                         throws Exception

When authentication is enabled on ZooKeeper, /hbase/hbaseid should be created with 2 ACLs: one specifies that the hbase user has full access to the node; the other, that it is world-readable.

Throws:

Exception

testOutsideHBaseNodeACL

public void testOutsideHBaseNodeACL()
                             throws Exception

Finally, we check the ACLs of a node outside of the /hbase hierarchy and verify that its ACL is simply 'hbase:Perms.ALL'.

Throws:

Exception

testIsZooKeeperSecure

public void testIsZooKeeperSecure()
                           throws Exception

Check if ZooKeeper JaasConfiguration is valid.

Throws:

Exception

testIsZooKeeperSecureWithProgrammaticConfig

public void testIsZooKeeperSecureWithProgrammaticConfig()
                                                 throws Exception

Check if Programmatic way of setting zookeeper security settings is valid.

Throws:

Exception

testAdminDrainAllowedOnSecureZK

public void testAdminDrainAllowedOnSecureZK()
                                     throws Exception

Throws:

Exception