You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-commits@hadoop.apache.org by tu...@apache.org on 2012/04/26 22:43:24 UTC
svn commit: r1331080 - in /hadoop/common/branches/branch-1: CHANGES.txt
src/core/org/apache/hadoop/http/HttpServer.java
src/test/org/apache/hadoop/http/TestHttpServer.java
Author: tucu
Date: Thu Apr 26 20:43:24 2012
New Revision: 1331080
URL: http://svn.apache.org/viewvc?rev=1331080&view=rev
Log:
HADOOP-8314. HttpServer#hasAdminAccess should return false if authorization is enabled but user is not authenticated. (tucu)
Modified:
hadoop/common/branches/branch-1/CHANGES.txt
hadoop/common/branches/branch-1/src/core/org/apache/hadoop/http/HttpServer.java
hadoop/common/branches/branch-1/src/test/org/apache/hadoop/http/TestHttpServer.java
Modified: hadoop/common/branches/branch-1/CHANGES.txt
URL: http://svn.apache.org/viewvc/hadoop/common/branches/branch-1/CHANGES.txt?rev=1331080&r1=1331079&r2=1331080&view=diff
==============================================================================
--- hadoop/common/branches/branch-1/CHANGES.txt (original)
+++ hadoop/common/branches/branch-1/CHANGES.txt Thu Apr 26 20:43:24 2012
@@ -235,6 +235,9 @@ Release 1.1.0 - unreleased
HDFS-3310. Make sure that we abort when no edit log directories are left.
(Colin Patrick McCabe via eli)
+ HADOOP-8314. HttpServer#hasAdminAccess should return false if authorization
+ is enabled but user is not authenticated. (tucu)
+
Release 1.0.3 - unreleased
NEW FEATURES
Modified: hadoop/common/branches/branch-1/src/core/org/apache/hadoop/http/HttpServer.java
URL: http://svn.apache.org/viewvc/hadoop/common/branches/branch-1/src/core/org/apache/hadoop/http/HttpServer.java?rev=1331080&r1=1331079&r2=1331080&view=diff
==============================================================================
--- hadoop/common/branches/branch-1/src/core/org/apache/hadoop/http/HttpServer.java (original)
+++ hadoop/common/branches/branch-1/src/core/org/apache/hadoop/http/HttpServer.java Thu Apr 26 20:43:24 2012
@@ -677,7 +677,10 @@ public class HttpServer implements Filte
String remoteUser = request.getRemoteUser();
if (remoteUser == null) {
- return true;
+ response.sendError(HttpServletResponse.SC_UNAUTHORIZED,
+ "Unauthenticated users are not " +
+ "authorized to access this page.");
+ return false;
}
AccessControlList adminsAcl = (AccessControlList) servletContext
.getAttribute(ADMINS_ACL);
@@ -686,9 +689,7 @@ public class HttpServer implements Filte
if (adminsAcl != null) {
if (!adminsAcl.isUserAllowed(remoteUserUGI)) {
response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "User "
- + remoteUser + " is unauthorized to access this page. "
- + "AccessControlList for accessing this page : "
- + adminsAcl.toString());
+ + remoteUser + " is unauthorized to access this page.");
return false;
}
}
Modified: hadoop/common/branches/branch-1/src/test/org/apache/hadoop/http/TestHttpServer.java
URL: http://svn.apache.org/viewvc/hadoop/common/branches/branch-1/src/test/org/apache/hadoop/http/TestHttpServer.java?rev=1331080&r1=1331079&r2=1331080&view=diff
==============================================================================
--- hadoop/common/branches/branch-1/src/test/org/apache/hadoop/http/TestHttpServer.java (original)
+++ hadoop/common/branches/branch-1/src/test/org/apache/hadoop/http/TestHttpServer.java Thu Apr 26 20:43:24 2012
@@ -36,6 +36,7 @@ import java.util.TreeSet;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
+import javax.servlet.ServletContext;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
@@ -51,12 +52,16 @@ import org.apache.hadoop.fs.CommonConfig
import org.apache.hadoop.http.resource.JerseyResource;
import org.apache.hadoop.security.Groups;
import org.apache.hadoop.security.ShellBasedUnixGroupsMapping;
+import org.apache.hadoop.security.UserGroupInformation;
import org.apache.hadoop.security.authorize.AccessControlList;
import org.junit.After;
+import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;
+import org.mockito.Mockito;
import org.mortbay.util.ajax.JSON;
+
public class TestHttpServer {
static final Log LOG = LogFactory.getLog(TestHttpServer.class);
@@ -324,4 +329,46 @@ public class TestHttpServer {
assertEquals("bar", m.get(JerseyResource.OP));
LOG.info("END testJersey()");
}
+
+ @Test
+ public void testHasAdministratorAccess() throws Exception {
+ Configuration conf = new Configuration();
+ conf.setBoolean(CommonConfigurationKeys.HADOOP_SECURITY_AUTHORIZATION, false);
+ ServletContext context = Mockito.mock(ServletContext.class);
+ Mockito.when(context.getAttribute(HttpServer.CONF_CONTEXT_ATTRIBUTE)).thenReturn(conf);
+ Mockito.when(context.getAttribute(HttpServer.ADMINS_ACL)).thenReturn(null);
+ HttpServletRequest request = Mockito.mock(HttpServletRequest.class);
+ Mockito.when(request.getRemoteUser()).thenReturn(null);
+ HttpServletResponse response = Mockito.mock(HttpServletResponse.class);
+
+ //authorization OFF
+ Assert.assertTrue(HttpServer.hasAdministratorAccess(context, request, response));
+
+ //authorization ON & user NULL
+ response = Mockito.mock(HttpServletResponse.class);
+ conf.setBoolean(CommonConfigurationKeys.HADOOP_SECURITY_AUTHORIZATION, true);
+ Assert.assertFalse(HttpServer.hasAdministratorAccess(context, request, response));
+ Mockito.verify(response).sendError(Mockito.eq(HttpServletResponse.SC_UNAUTHORIZED), Mockito.anyString());
+
+ //authorization ON & user NOT NULL & ACLs NULL
+ response = Mockito.mock(HttpServletResponse.class);
+ Mockito.when(request.getRemoteUser()).thenReturn("foo");
+ Assert.assertTrue(HttpServer.hasAdministratorAccess(context, request, response));
+
+ //authorization ON & user NOT NULL & ACLs NOT NULL & user not in ACLs
+ response = Mockito.mock(HttpServletResponse.class);
+ AccessControlList acls = Mockito.mock(AccessControlList.class);
+ Mockito.when(acls.isUserAllowed(Mockito.<UserGroupInformation>any())).thenReturn(false);
+ Mockito.when(context.getAttribute(HttpServer.ADMINS_ACL)).thenReturn(acls);
+ Assert.assertFalse(HttpServer.hasAdministratorAccess(context, request, response));
+ Mockito.verify(response).sendError(Mockito.eq(HttpServletResponse.SC_UNAUTHORIZED), Mockito.anyString());
+
+ //authorization ON & user NOT NULL & ACLs NOT NULL & user in in ACLs
+ response = Mockito.mock(HttpServletResponse.class);
+ Mockito.when(acls.isUserAllowed(Mockito.<UserGroupInformation>any())).thenReturn(true);
+ Mockito.when(context.getAttribute(HttpServer.ADMINS_ACL)).thenReturn(acls);
+ Assert.assertTrue(HttpServer.hasAdministratorAccess(context, request, response));
+
+ }
+
}