Package org.apache.hadoop.hbase.zookeeper

Class TestZooKeeperACL

java.lang.Object

org.apache.hadoop.hbase.zookeeper.TestZooKeeperACL

@Tag("org.apache.hadoop.hbase.testclassification.ZKTests") @Tag("org.apache.hadoop.hbase.testclassification.MediumTests")
public class TestZooKeeperACL
extends Object

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
private static class	TestZooKeeperACL.DummySecurityConfiguration

Field Summary

Fields

Modifier and Type	Field	Description
private static final org.slf4j.Logger	LOG
private static boolean	secureZKAvailable
private static final HBaseTestingUtil	TEST_UTIL
private static org.apache.hadoop.hbase.zookeeper.ZKWatcher	zkw

Constructor Summary

Constructors

Constructor	Description
TestZooKeeperACL()

Method Summary

Modifier and Type	Method	Description
void	setUp()
static void	setUpBeforeClass()
static void	tearDownAfterClass()
void	testAdminDrainAllowedOnSecureZK()
void	testHBaseIDZNodeACL()	When authentication is enabled on ZooKeeper, /hbase/hbaseid should be created with 2 ACLs: one specifies that the hbase user has full access to the node; the other, that it is world-readable.
void	testHBaseMasterServerZNodeACL()	When authentication is enabled on ZooKeeper, /hbase/master should be created with 2 ACLs: one specifies that the hbase user has full access to the node; the other, that it is world-readable.
void	testHBaseRootRegionServerZNodeACL()	When authentication is enabled on ZooKeeper, /hbase/root-region-server should be created with 2 ACLs: one specifies that the hbase user has full access to the node; the other, that it is world-readable.
void	testHBaseRootZNodeACL()	Create a node and check its ACL.
void	testIsZooKeeperSecure()	Check if ZooKeeper JaasConfiguration is valid.
void	testIsZooKeeperSecureWithProgrammaticConfig()	Check if Programmatic way of setting zookeeper security settings is valid.
void	testOutsideHBaseNodeACL()	Finally, we check the ACLs of a node outside of the /hbase hierarchy and verify that its ACL is simply 'hbase:Perms.ALL'.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

LOG

private static final org.slf4j.Logger LOG

TEST_UTIL

private static final HBaseTestingUtil TEST_UTIL

zkw

private static org.apache.hadoop.hbase.zookeeper.ZKWatcher zkw

secureZKAvailable

private static boolean secureZKAvailable

Constructor Details

TestZooKeeperACL

public TestZooKeeperACL()

Method Details

setUpBeforeClass

@BeforeAll
public static void setUpBeforeClass()
                             throws Exception

Throws:

Exception

tearDownAfterClass

@AfterAll
public static void tearDownAfterClass()
                               throws Exception

Throws:

Exception

setUp

@BeforeEach
public void setUp()
           throws Exception

Throws:

Exception

testHBaseRootZNodeACL

@Test
public void testHBaseRootZNodeACL()
                           throws Exception

Create a node and check its ACL. When authentication is enabled on ZooKeeper, all nodes (except /hbase/root-region-server, /hbase/master and /hbase/hbaseid) should be created so that only the hbase server user (master or region server user) that created them can access them, and this user should have all permissions on this node. For /hbase/root-region-server, /hbase/master, and /hbase/hbaseid the permissions should be as above, but should also be world-readable. First we check the general case of /hbase nodes in the following test, and then check the subset of world-readable nodes in the three tests after that.

Throws:

Exception

testHBaseRootRegionServerZNodeACL

@Test
public void testHBaseRootRegionServerZNodeACL()
                                       throws Exception

When authentication is enabled on ZooKeeper, /hbase/root-region-server should be created with 2 ACLs: one specifies that the hbase user has full access to the node; the other, that it is world-readable.

Throws:

Exception

testHBaseMasterServerZNodeACL

@Test
public void testHBaseMasterServerZNodeACL()
                                   throws Exception

When authentication is enabled on ZooKeeper, /hbase/master should be created with 2 ACLs: one specifies that the hbase user has full access to the node; the other, that it is world-readable.

Throws:

Exception

testHBaseIDZNodeACL

@Test
public void testHBaseIDZNodeACL()
                         throws Exception

When authentication is enabled on ZooKeeper, /hbase/hbaseid should be created with 2 ACLs: one specifies that the hbase user has full access to the node; the other, that it is world-readable.

Throws:

Exception

testOutsideHBaseNodeACL

@Test
public void testOutsideHBaseNodeACL()
                             throws Exception

Finally, we check the ACLs of a node outside of the /hbase hierarchy and verify that its ACL is simply 'hbase:Perms.ALL'.

Throws:

Exception

testIsZooKeeperSecure

@Test
public void testIsZooKeeperSecure()
                           throws Exception

Check if ZooKeeper JaasConfiguration is valid.

Throws:

Exception

testIsZooKeeperSecureWithProgrammaticConfig

@Test
public void testIsZooKeeperSecureWithProgrammaticConfig()
                                                 throws Exception

Check if Programmatic way of setting zookeeper security settings is valid.

Throws:

Exception

testAdminDrainAllowedOnSecureZK

@Test
public void testAdminDrainAllowedOnSecureZK()
                                     throws Exception

Throws:

Exception