You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@falcon.apache.org by Sowmya Ramesh <sr...@hortonworks.com> on 2015/08/25 22:54:20 UTC
Review Request 37771: Falcon Proxy user support
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/
-----------------------------------------------------------
Review request for Falcon.
Bugs: FALCON-1027
https://issues.apache.org/jira/browse/FALCON-1027
Repository: falcon-git
Description
-------
Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
line).
Diffs
-----
client/src/main/java/org/apache/falcon/cli/FalconCLI.java 11dfe72
client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
common/src/main/resources/startup.properties c48188c
common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 9a3f365
common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java 6e77462
common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
docs/src/site/twiki/FalconCLI.twiki 9203699
docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 78964dd
prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java 5b415a2
prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
prism/src/main/webapp/WEB-INF/web.xml 551bf56
prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java cce8737
prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java 9e8c76a
prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
src/conf/startup.properties 9925373
unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
webapp/pom.xml 5a9e1da
webapp/src/conf/oozie/conf/oozie-site.xml ded4873
webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java f0cee61
webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
webapp/src/test/java/org/apache/falcon/resource/TestContext.java 4a25b88
webapp/src/test/resources/startup.properties PRE-CREATION
Diff: https://reviews.apache.org/r/37771/diff/
Testing
-------
Unit tests and IT tests.
Thanks,
Sowmya Ramesh
Re: Review Request 37771: Falcon Proxy user support
Posted by Balu Vellanki <bv...@hortonworks.com>.
> On Aug. 27, 2015, 9:04 p.m., Balu Vellanki wrote:
> >
>
> Balu Vellanki wrote:
> The rest of the patch looks good. Patch applied and built successfully using command "mvn clean verify assembly:assembly -Phadoop-2,test-patch"
It would helpful to update docs for restAPI twiki at docs/src/site/twiki/restapi/ as well.
- Balu
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/#review96728
-----------------------------------------------------------
On Aug. 27, 2015, 2:41 a.m., Sowmya Ramesh wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/37771/
> -----------------------------------------------------------
>
> (Updated Aug. 27, 2015, 2:41 a.m.)
>
>
> Review request for Falcon.
>
>
> Bugs: FALCON-1027
> https://issues.apache.org/jira/browse/FALCON-1027
>
>
> Repository: falcon-git
>
>
> Description
> -------
>
> Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
> line).
>
>
> Diffs
> -----
>
> client/src/main/java/org/apache/falcon/cli/FalconCLI.java 11dfe72
> client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
> client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
> client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
> common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
> common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
> common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
> common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
> common/src/main/resources/startup.properties c48188c
> common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 9a3f365
> common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java 6e77462
> common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
> common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
> docs/src/site/twiki/FalconCLI.twiki 9203699
> docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
> prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 78964dd
> prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java 5b415a2
> prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
> prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
> prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
> prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
> prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
> prism/src/main/webapp/WEB-INF/web.xml 551bf56
> prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java cce8737
> prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java 9e8c76a
> prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
> src/conf/startup.properties 9925373
> unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
> unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
> webapp/pom.xml 5a9e1da
> webapp/src/conf/oozie/conf/oozie-site.xml ded4873
> webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
> webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
> webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
> webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
> webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
> webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java f0cee61
> webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
> webapp/src/test/java/org/apache/falcon/resource/TestContext.java 4a25b88
> webapp/src/test/resources/startup.properties PRE-CREATION
>
> Diff: https://reviews.apache.org/r/37771/diff/
>
>
> Testing
> -------
>
> Unit tests and IT tests.
>
>
> Thanks,
>
> Sowmya Ramesh
>
>
Re: Review Request 37771: Falcon Proxy user support
Posted by Balu Vellanki <bv...@hortonworks.com>.
> On Aug. 27, 2015, 9:04 p.m., Balu Vellanki wrote:
> >
The rest of the patch looks good. Patch applied and built successfully using command "mvn clean verify assembly:assembly -Phadoop-2,test-patch"
- Balu
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/#review96728
-----------------------------------------------------------
On Aug. 27, 2015, 2:41 a.m., Sowmya Ramesh wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/37771/
> -----------------------------------------------------------
>
> (Updated Aug. 27, 2015, 2:41 a.m.)
>
>
> Review request for Falcon.
>
>
> Bugs: FALCON-1027
> https://issues.apache.org/jira/browse/FALCON-1027
>
>
> Repository: falcon-git
>
>
> Description
> -------
>
> Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
> line).
>
>
> Diffs
> -----
>
> client/src/main/java/org/apache/falcon/cli/FalconCLI.java 11dfe72
> client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
> client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
> client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
> common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
> common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
> common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
> common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
> common/src/main/resources/startup.properties c48188c
> common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 9a3f365
> common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java 6e77462
> common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
> common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
> docs/src/site/twiki/FalconCLI.twiki 9203699
> docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
> prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 78964dd
> prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java 5b415a2
> prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
> prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
> prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
> prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
> prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
> prism/src/main/webapp/WEB-INF/web.xml 551bf56
> prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java cce8737
> prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java 9e8c76a
> prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
> src/conf/startup.properties 9925373
> unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
> unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
> webapp/pom.xml 5a9e1da
> webapp/src/conf/oozie/conf/oozie-site.xml ded4873
> webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
> webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
> webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
> webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
> webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
> webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java f0cee61
> webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
> webapp/src/test/java/org/apache/falcon/resource/TestContext.java 4a25b88
> webapp/src/test/resources/startup.properties PRE-CREATION
>
> Diff: https://reviews.apache.org/r/37771/diff/
>
>
> Testing
> -------
>
> Unit tests and IT tests.
>
>
> Thanks,
>
> Sowmya Ramesh
>
>
Re: Review Request 37771: Falcon Proxy user support
Posted by Sowmya Ramesh <sr...@hortonworks.com>.
> On Aug. 27, 2015, 9:04 p.m., Balu Vellanki wrote:
> >
>
> Balu Vellanki wrote:
> The rest of the patch looks good. Patch applied and built successfully using command "mvn clean verify assembly:assembly -Phadoop-2,test-patch"
>
> Balu Vellanki wrote:
> It would helpful to update docs for restAPI twiki at docs/src/site/twiki/restapi/ as well.
Since there are many twiki for Rest API's plannign to do as part of diff jira so that I dont clutter this jira. This jira more focussed on code changes. I will create a new jira for Rest PAI documentation.
> On Aug. 27, 2015, 9:04 p.m., Balu Vellanki wrote:
> > client/src/main/java/org/apache/falcon/cli/FalconCLI.java, line 536
> > <https://reviews.apache.org/r/37771/diff/2/?file=1055670#file1055670line536>
> >
> > Why was the getColo(colo) removed for TOUCH_OPT?
I had to merge my code changes after FALCON-1174. Merge error, thanks for catching!
> On Aug. 27, 2015, 9:04 p.m., Balu Vellanki wrote:
> > common/src/main/java/org/apache/falcon/service/ProxyUserService.java, line 8
> > <https://reviews.apache.org/r/37771/diff/2/?file=1055677#file1055677line8>
> >
> > License is added twice. Please remove.
ok.
> On Aug. 27, 2015, 9:04 p.m., Balu Vellanki wrote:
> > common/src/main/java/org/apache/falcon/service/ProxyUserService.java, line 97
> > <https://reviews.apache.org/r/37771/diff/2/?file=1055677#file1055677line97>
> >
> > Looks like debug logs are still in the code, please remove.
Missed it, will remove.
> On Aug. 27, 2015, 9:04 p.m., Balu Vellanki wrote:
> > prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java, line 490
> > <https://reviews.apache.org/r/37771/diff/2/?file=1055688#file1055688line490>
> >
> > It is better if DefaultValue is not set and if code can handle null doAs user.
Done
- Sowmya
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/#review96728
-----------------------------------------------------------
On Aug. 27, 2015, 2:41 a.m., Sowmya Ramesh wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/37771/
> -----------------------------------------------------------
>
> (Updated Aug. 27, 2015, 2:41 a.m.)
>
>
> Review request for Falcon.
>
>
> Bugs: FALCON-1027
> https://issues.apache.org/jira/browse/FALCON-1027
>
>
> Repository: falcon-git
>
>
> Description
> -------
>
> Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
> line).
>
>
> Diffs
> -----
>
> client/src/main/java/org/apache/falcon/cli/FalconCLI.java 11dfe72
> client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
> client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
> client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
> common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
> common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
> common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
> common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
> common/src/main/resources/startup.properties c48188c
> common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 9a3f365
> common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java 6e77462
> common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
> common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
> docs/src/site/twiki/FalconCLI.twiki 9203699
> docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
> prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 78964dd
> prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java 5b415a2
> prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
> prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
> prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
> prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
> prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
> prism/src/main/webapp/WEB-INF/web.xml 551bf56
> prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java cce8737
> prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java 9e8c76a
> prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
> src/conf/startup.properties 9925373
> unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
> unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
> webapp/pom.xml 5a9e1da
> webapp/src/conf/oozie/conf/oozie-site.xml ded4873
> webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
> webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
> webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
> webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
> webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
> webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java f0cee61
> webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
> webapp/src/test/java/org/apache/falcon/resource/TestContext.java 4a25b88
> webapp/src/test/resources/startup.properties PRE-CREATION
>
> Diff: https://reviews.apache.org/r/37771/diff/
>
>
> Testing
> -------
>
> Unit tests and IT tests.
>
>
> Thanks,
>
> Sowmya Ramesh
>
>
Re: Review Request 37771: Falcon Proxy user support
Posted by Balu Vellanki <bv...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/#review96728
-----------------------------------------------------------
client/src/main/java/org/apache/falcon/cli/FalconCLI.java (line 536)
<https://reviews.apache.org/r/37771/#comment152389>
Why was the getColo(colo) removed for TOUCH_OPT?
common/src/main/java/org/apache/falcon/service/ProxyUserService.java (line 8)
<https://reviews.apache.org/r/37771/#comment152372>
License is added twice. Please remove.
common/src/main/java/org/apache/falcon/service/ProxyUserService.java (line 97)
<https://reviews.apache.org/r/37771/#comment152373>
Looks like debug logs are still in the code, please remove.
prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java (line 490)
<https://reviews.apache.org/r/37771/#comment152375>
It is better if DefaultValue is not set and if code can handle null doAs user.
- Balu Vellanki
On Aug. 27, 2015, 2:41 a.m., Sowmya Ramesh wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/37771/
> -----------------------------------------------------------
>
> (Updated Aug. 27, 2015, 2:41 a.m.)
>
>
> Review request for Falcon.
>
>
> Bugs: FALCON-1027
> https://issues.apache.org/jira/browse/FALCON-1027
>
>
> Repository: falcon-git
>
>
> Description
> -------
>
> Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
> line).
>
>
> Diffs
> -----
>
> client/src/main/java/org/apache/falcon/cli/FalconCLI.java 11dfe72
> client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
> client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
> client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
> common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
> common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
> common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
> common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
> common/src/main/resources/startup.properties c48188c
> common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 9a3f365
> common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java 6e77462
> common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
> common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
> docs/src/site/twiki/FalconCLI.twiki 9203699
> docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
> prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 78964dd
> prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java 5b415a2
> prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
> prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
> prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
> prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
> prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
> prism/src/main/webapp/WEB-INF/web.xml 551bf56
> prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java cce8737
> prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java 9e8c76a
> prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
> src/conf/startup.properties 9925373
> unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
> unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
> webapp/pom.xml 5a9e1da
> webapp/src/conf/oozie/conf/oozie-site.xml ded4873
> webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
> webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
> webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
> webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
> webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
> webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java f0cee61
> webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
> webapp/src/test/java/org/apache/falcon/resource/TestContext.java 4a25b88
> webapp/src/test/resources/startup.properties PRE-CREATION
>
> Diff: https://reviews.apache.org/r/37771/diff/
>
>
> Testing
> -------
>
> Unit tests and IT tests.
>
>
> Thanks,
>
> Sowmya Ramesh
>
>
Re: Review Request 37771: Falcon Proxy user support
Posted by Venkat Ranganathan <n....@live.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/#review97177
-----------------------------------------------------------
Ship it!
Good work Sowmya. Can you also update the test scenarios manually tested to the RB.
- Venkat Ranganathan
On Aug. 27, 2015, 2:50 p.m., Sowmya Ramesh wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/37771/
> -----------------------------------------------------------
>
> (Updated Aug. 27, 2015, 2:50 p.m.)
>
>
> Review request for Falcon.
>
>
> Bugs: FALCON-1027
> https://issues.apache.org/jira/browse/FALCON-1027
>
>
> Repository: falcon-git
>
>
> Description
> -------
>
> Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
> line).
>
>
> Diffs
> -----
>
> client/src/main/java/org/apache/falcon/cli/FalconCLI.java 11dfe72
> client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
> client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
> client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
> common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
> common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
> common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
> common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
> common/src/main/resources/startup.properties c48188c
> common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 9a3f365
> common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java 6e77462
> common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
> common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
> docs/src/site/twiki/FalconCLI.twiki 9203699
> docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
> prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 78964dd
> prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java 5b415a2
> prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
> prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
> prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
> prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
> prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
> prism/src/main/webapp/WEB-INF/web.xml 551bf56
> prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java cce8737
> prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java 9e8c76a
> prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
> src/conf/startup.properties 9925373
> unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
> unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
> webapp/pom.xml 5a9e1da
> webapp/src/conf/oozie/conf/oozie-site.xml ded4873
> webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
> webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
> webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
> webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
> webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
> webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java f0cee61
> webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
> webapp/src/test/java/org/apache/falcon/resource/TestContext.java 4a25b88
> webapp/src/test/resources/startup.properties PRE-CREATION
>
> Diff: https://reviews.apache.org/r/37771/diff/
>
>
> Testing
> -------
>
> Unit tests and IT tests.
>
>
> Thanks,
>
> Sowmya Ramesh
>
>
Re: Review Request 37771: Falcon Proxy user support
Posted by pavan kumar kolamuri <pa...@gmail.com>.
> On Sept. 10, 2015, 7:43 a.m., pavan kumar kolamuri wrote:
> > common/src/main/java/org/apache/falcon/service/ProxyUserService.java, line 149
> > <https://reviews.apache.org/r/37771/diff/3/?file=1056558#file1056558line149>
> >
> > falcon.service.ProxyUserService.proxyuser." + proxyUser + ".groups. Is it Ok if this property not present also ? But doc says both should be present if i am not wrong ?
>
> Sowmya Ramesh wrote:
> If you look at ProxyUserService.init it excepts both falcon.service.ProxyUserService.proxyuser." + proxyUser + ".groups and falcon.service.ProxyUserService.proxyuser." + proxyUser + ".hosts. If they are missing it throws "FalconException: property not set in startup properties. Please add it."
Ok got it. thanks!
> On Sept. 10, 2015, 7:43 a.m., pavan kumar kolamuri wrote:
> > prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java, line 490
> > <https://reviews.apache.org/r/37771/diff/3/?file=1056569#file1056569line490>
> >
> > Why doAs option is added only for entitySummary and entityList ? Why not for other entity operations. But in CLI we are taking doAs for all entity operations won't it cause exceptions ? Please correct me if i am missing something.
>
> Sowmya Ramesh wrote:
> doAs user is used in FalconAuthenticationFilter if passed - in the doFilter handling if doAs user is passed in the request then it is set as the proxy user. FalconAuthenticationFilter will be called for every REST API/CLI request. Reason behind doAs queryParam added only for entitySummary a nd entityList is because tryProxy expects the doAS user. In tryProxy if ACL is present in the entity and ACL Owner and doAsUser are different then exception is thrown.
>
> Only code paths in entitySummary and entityList call tryProxy and hence doAs quesy param is required to pass it down to tryProxy. For all other Rest API doAs user is set as proxy user in doFilter of FalconAuthenticationFilter. Hope I answered your query.
Thanks Soumya for nice clarification.
- pavan kumar
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/#review98356
-----------------------------------------------------------
On Aug. 31, 2015, 11:05 p.m., Sowmya Ramesh wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/37771/
> -----------------------------------------------------------
>
> (Updated Aug. 31, 2015, 11:05 p.m.)
>
>
> Review request for Falcon.
>
>
> Bugs: FALCON-1027
> https://issues.apache.org/jira/browse/FALCON-1027
>
>
> Repository: falcon-git
>
>
> Description
> -------
>
> Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
> line).
>
>
> Diffs
> -----
>
> client/src/main/java/org/apache/falcon/cli/FalconCLI.java 11dfe72
> client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
> client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
> client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
> common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
> common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
> common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
> common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
> common/src/main/resources/startup.properties c48188c
> common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 9a3f365
> common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java 6e77462
> common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
> common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
> docs/src/site/twiki/FalconCLI.twiki 9203699
> docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
> prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 78964dd
> prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java 5b415a2
> prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
> prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
> prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
> prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
> prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
> prism/src/main/webapp/WEB-INF/web.xml 551bf56
> prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java cce8737
> prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java 9e8c76a
> prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
> src/conf/startup.properties 9925373
> unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
> unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
> webapp/pom.xml 5a9e1da
> webapp/src/conf/oozie/conf/oozie-site.xml ded4873
> webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
> webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
> webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
> webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
> webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
> webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java f0cee61
> webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
> webapp/src/test/java/org/apache/falcon/resource/TestContext.java 4a25b88
> webapp/src/test/resources/startup.properties PRE-CREATION
>
> Diff: https://reviews.apache.org/r/37771/diff/
>
>
> Testing
> -------
>
> Unit tests and IT tests.
> Manual testing :
>
> * ProxyUSer service not added in startup properties, should throw "Service ProxyUserService not registered"
> * Super user not added in proxy user setting in startup.properties, shoudl throw "java.security.AccessControlException: User <superuser> not defined as proxyuser"
>
> CLI:
> * Add doAs option in CLI and verify command succeeds
> * Commands should succeed without doAs as is an optional arg
>
> REST API:
> * pass doAs query param and verify REST requests succeeds
> * REST requests should succeed without doAs query param as it is optional
>
>
> * Perform schedule using doAs user. For other requests if doAs user is not passed (say suspend, resume etc.) should get "User <superuser> not authorized for Coord job <bundleId>"
>
>
> Thanks,
>
> Sowmya Ramesh
>
>
Re: Review Request 37771: Falcon Proxy user support
Posted by Sowmya Ramesh <sr...@hortonworks.com>.
> On Sept. 10, 2015, 7:43 a.m., pavan kumar kolamuri wrote:
> > common/src/main/java/org/apache/falcon/service/ProxyUserService.java, line 149
> > <https://reviews.apache.org/r/37771/diff/3/?file=1056558#file1056558line149>
> >
> > falcon.service.ProxyUserService.proxyuser." + proxyUser + ".groups. Is it Ok if this property not present also ? But doc says both should be present if i am not wrong ?
If you look at ProxyUserService.init it excepts both falcon.service.ProxyUserService.proxyuser." + proxyUser + ".groups and falcon.service.ProxyUserService.proxyuser." + proxyUser + ".hosts. If they are missing it throws "FalconException: property not set in startup properties. Please add it."
> On Sept. 10, 2015, 7:43 a.m., pavan kumar kolamuri wrote:
> > prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java, line 490
> > <https://reviews.apache.org/r/37771/diff/3/?file=1056569#file1056569line490>
> >
> > Why doAs option is added only for entitySummary and entityList ? Why not for other entity operations. But in CLI we are taking doAs for all entity operations won't it cause exceptions ? Please correct me if i am missing something.
doAs user is used in FalconAuthenticationFilter if passed - in the doFilter handling if doAs user is passed in the request then it is set as the proxy user. FalconAuthenticationFilter will be called for every REST API/CLI request. Reason behind doAs queryParam added only for entitySummary a nd entityList is because tryProxy expects the doAS user. In tryProxy if ACL is present in the entity and ACL Owner and doAsUser are different then exception is thrown.
Only code paths in entitySummary and entityList call tryProxy and hence doAs quesy param is required to pass it down to tryProxy. For all other Rest API doAs user is set as proxy user in doFilter of FalconAuthenticationFilter. Hope I answered your query.
> On Sept. 10, 2015, 7:43 a.m., pavan kumar kolamuri wrote:
> > common/src/main/java/org/apache/falcon/service/ProxyUserService.java, line 147
> > <https://reviews.apache.org/r/37771/diff/3/?file=1056558#file1056558line147>
> >
> > This is not required since in validateRequestorHost , Comparision is done for both hostname and normalize hostname. If we do this won't it fail if some one gives only hostnames in properties ?
Good catch. Thanks!
- Sowmya
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/#review98356
-----------------------------------------------------------
On Aug. 31, 2015, 11:05 p.m., Sowmya Ramesh wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/37771/
> -----------------------------------------------------------
>
> (Updated Aug. 31, 2015, 11:05 p.m.)
>
>
> Review request for Falcon.
>
>
> Bugs: FALCON-1027
> https://issues.apache.org/jira/browse/FALCON-1027
>
>
> Repository: falcon-git
>
>
> Description
> -------
>
> Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
> line).
>
>
> Diffs
> -----
>
> client/src/main/java/org/apache/falcon/cli/FalconCLI.java 11dfe72
> client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
> client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
> client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
> common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
> common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
> common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
> common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
> common/src/main/resources/startup.properties c48188c
> common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 9a3f365
> common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java 6e77462
> common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
> common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
> docs/src/site/twiki/FalconCLI.twiki 9203699
> docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
> prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 78964dd
> prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java 5b415a2
> prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
> prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
> prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
> prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
> prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
> prism/src/main/webapp/WEB-INF/web.xml 551bf56
> prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java cce8737
> prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java 9e8c76a
> prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
> src/conf/startup.properties 9925373
> unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
> unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
> webapp/pom.xml 5a9e1da
> webapp/src/conf/oozie/conf/oozie-site.xml ded4873
> webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
> webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
> webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
> webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
> webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
> webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java f0cee61
> webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
> webapp/src/test/java/org/apache/falcon/resource/TestContext.java 4a25b88
> webapp/src/test/resources/startup.properties PRE-CREATION
>
> Diff: https://reviews.apache.org/r/37771/diff/
>
>
> Testing
> -------
>
> Unit tests and IT tests.
> Manual testing :
>
> * ProxyUSer service not added in startup properties, should throw "Service ProxyUserService not registered"
> * Super user not added in proxy user setting in startup.properties, shoudl throw "java.security.AccessControlException: User <superuser> not defined as proxyuser"
>
> CLI:
> * Add doAs option in CLI and verify command succeeds
> * Commands should succeed without doAs as is an optional arg
>
> REST API:
> * pass doAs query param and verify REST requests succeeds
> * REST requests should succeed without doAs query param as it is optional
>
>
> * Perform schedule using doAs user. For other requests if doAs user is not passed (say suspend, resume etc.) should get "User <superuser> not authorized for Coord job <bundleId>"
>
>
> Thanks,
>
> Sowmya Ramesh
>
>
Re: Review Request 37771: Falcon Proxy user support
Posted by pavan kumar kolamuri <pa...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/#review98356
-----------------------------------------------------------
common/src/main/java/org/apache/falcon/service/ProxyUserService.java (line 147)
<https://reviews.apache.org/r/37771/#comment154794>
This is not required since in validateRequestorHost , Comparision is done for both hostname and normalize hostname. If we do this won't it fail if some one gives only hostnames in properties ?
common/src/main/java/org/apache/falcon/service/ProxyUserService.java (line 149)
<https://reviews.apache.org/r/37771/#comment154810>
falcon.service.ProxyUserService.proxyuser." + proxyUser + ".groups. Is it Ok if this property not present also ? But doc says both should be present if i am not wrong ?
prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java (line 490)
<https://reviews.apache.org/r/37771/#comment154778>
Why doAs option is added only for entitySummary and entityList ? Why not for other entity operations. But in CLI we are taking doAs for all entity operations won't it cause exceptions ? Please correct me if i am missing something.
- pavan kumar kolamuri
On Aug. 31, 2015, 11:05 p.m., Sowmya Ramesh wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/37771/
> -----------------------------------------------------------
>
> (Updated Aug. 31, 2015, 11:05 p.m.)
>
>
> Review request for Falcon.
>
>
> Bugs: FALCON-1027
> https://issues.apache.org/jira/browse/FALCON-1027
>
>
> Repository: falcon-git
>
>
> Description
> -------
>
> Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
> line).
>
>
> Diffs
> -----
>
> client/src/main/java/org/apache/falcon/cli/FalconCLI.java 11dfe72
> client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
> client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
> client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
> common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
> common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
> common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
> common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
> common/src/main/resources/startup.properties c48188c
> common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 9a3f365
> common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java 6e77462
> common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
> common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
> docs/src/site/twiki/FalconCLI.twiki 9203699
> docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
> prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 78964dd
> prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java 5b415a2
> prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
> prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
> prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
> prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
> prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
> prism/src/main/webapp/WEB-INF/web.xml 551bf56
> prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java cce8737
> prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java 9e8c76a
> prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
> src/conf/startup.properties 9925373
> unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
> unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
> webapp/pom.xml 5a9e1da
> webapp/src/conf/oozie/conf/oozie-site.xml ded4873
> webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
> webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
> webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
> webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
> webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
> webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java f0cee61
> webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
> webapp/src/test/java/org/apache/falcon/resource/TestContext.java 4a25b88
> webapp/src/test/resources/startup.properties PRE-CREATION
>
> Diff: https://reviews.apache.org/r/37771/diff/
>
>
> Testing
> -------
>
> Unit tests and IT tests.
> Manual testing :
>
> * ProxyUSer service not added in startup properties, should throw "Service ProxyUserService not registered"
> * Super user not added in proxy user setting in startup.properties, shoudl throw "java.security.AccessControlException: User <superuser> not defined as proxyuser"
>
> CLI:
> * Add doAs option in CLI and verify command succeeds
> * Commands should succeed without doAs as is an optional arg
>
> REST API:
> * pass doAs query param and verify REST requests succeeds
> * REST requests should succeed without doAs query param as it is optional
>
>
> * Perform schedule using doAs user. For other requests if doAs user is not passed (say suspend, resume etc.) should get "User <superuser> not authorized for Coord job <bundleId>"
>
>
> Thanks,
>
> Sowmya Ramesh
>
>
Re: Review Request 37771: Falcon Proxy user support
Posted by Ajay Yadava <aj...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/#review98033
-----------------------------------------------------------
docs/src/site/twiki/FalconCLI.twiki (line 9)
<https://reviews.apache.org/r/37771/#comment154190>
Actually there is one more way to provide the falcon server url : setting FALCON_URL environment variable. It takes precedence over the client.properties and has less precedence than command line option.
- Ajay Yadava
On Aug. 31, 2015, 11:05 p.m., Sowmya Ramesh wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/37771/
> -----------------------------------------------------------
>
> (Updated Aug. 31, 2015, 11:05 p.m.)
>
>
> Review request for Falcon.
>
>
> Bugs: FALCON-1027
> https://issues.apache.org/jira/browse/FALCON-1027
>
>
> Repository: falcon-git
>
>
> Description
> -------
>
> Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
> line).
>
>
> Diffs
> -----
>
> client/src/main/java/org/apache/falcon/cli/FalconCLI.java 11dfe72
> client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
> client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
> client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
> common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
> common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
> common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
> common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
> common/src/main/resources/startup.properties c48188c
> common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 9a3f365
> common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java 6e77462
> common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
> common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
> docs/src/site/twiki/FalconCLI.twiki 9203699
> docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
> prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 78964dd
> prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java 5b415a2
> prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
> prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
> prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
> prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
> prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
> prism/src/main/webapp/WEB-INF/web.xml 551bf56
> prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java cce8737
> prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java 9e8c76a
> prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
> src/conf/startup.properties 9925373
> unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
> unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
> webapp/pom.xml 5a9e1da
> webapp/src/conf/oozie/conf/oozie-site.xml ded4873
> webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
> webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
> webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
> webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
> webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
> webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java f0cee61
> webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
> webapp/src/test/java/org/apache/falcon/resource/TestContext.java 4a25b88
> webapp/src/test/resources/startup.properties PRE-CREATION
>
> Diff: https://reviews.apache.org/r/37771/diff/
>
>
> Testing
> -------
>
> Unit tests and IT tests.
> Manual testing :
>
> * ProxyUSer service not added in startup properties, should throw "Service ProxyUserService not registered"
> * Super user not added in proxy user setting in startup.properties, shoudl throw "java.security.AccessControlException: User <superuser> not defined as proxyuser"
>
> CLI:
> * Add doAs option in CLI and verify command succeeds
> * Commands should succeed without doAs as is an optional arg
>
> REST API:
> * pass doAs query param and verify REST requests succeeds
> * REST requests should succeed without doAs query param as it is optional
>
>
> * Perform schedule using doAs user. For other requests if doAs user is not passed (say suspend, resume etc.) should get "User <superuser> not authorized for Coord job <bundleId>"
>
>
> Thanks,
>
> Sowmya Ramesh
>
>
Re: Review Request 37771: Falcon Proxy user support
Posted by Sowmya Ramesh <sr...@hortonworks.com>.
> On Sept. 8, 2015, 2:35 p.m., Ajay Yadava wrote:
> > common/src/main/java/org/apache/falcon/security/CurrentUser.java, line 84
> > <https://reviews.apache.org/r/37771/diff/3/?file=1056555#file1056555line84>
> >
> > unix user names are case sensitive, should we also keep the comparison as case sensitive?
>
> Venkat Ranganathan wrote:
> Since we also work on Windows (on prem and azure) we need to allow case-insensitive names.
Hadoop doAs is case insensitive; retaining the same behavior.
> On Sept. 8, 2015, 2:35 p.m., Ajay Yadava wrote:
> > common/src/main/java/org/apache/falcon/security/SecurityUtil.java, line 120
> > <https://reviews.apache.org/r/37771/diff/3/?file=1056556#file1056556line120>
> >
> > unix user names are case sensitive, should we also keep the comparison as case sensitive?
Hadoop doAs is case insensitive; retaining the same behavior.
> On Sept. 8, 2015, 2:35 p.m., Ajay Yadava wrote:
> > common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java, line 157
> > <https://reviews.apache.org/r/37771/diff/3/?file=1056561#file1056561line157>
> >
> > redundant?
Sorry, I don't understand. What is redundant here?!
- Sowmya
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/#review97913
-----------------------------------------------------------
On Aug. 31, 2015, 11:05 p.m., Sowmya Ramesh wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/37771/
> -----------------------------------------------------------
>
> (Updated Aug. 31, 2015, 11:05 p.m.)
>
>
> Review request for Falcon.
>
>
> Bugs: FALCON-1027
> https://issues.apache.org/jira/browse/FALCON-1027
>
>
> Repository: falcon-git
>
>
> Description
> -------
>
> Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
> line).
>
>
> Diffs
> -----
>
> client/src/main/java/org/apache/falcon/cli/FalconCLI.java 11dfe72
> client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
> client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
> client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
> common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
> common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
> common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
> common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
> common/src/main/resources/startup.properties c48188c
> common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 9a3f365
> common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java 6e77462
> common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
> common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
> docs/src/site/twiki/FalconCLI.twiki 9203699
> docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
> prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 78964dd
> prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java 5b415a2
> prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
> prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
> prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
> prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
> prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
> prism/src/main/webapp/WEB-INF/web.xml 551bf56
> prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java cce8737
> prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java 9e8c76a
> prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
> src/conf/startup.properties 9925373
> unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
> unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
> webapp/pom.xml 5a9e1da
> webapp/src/conf/oozie/conf/oozie-site.xml ded4873
> webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
> webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
> webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
> webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
> webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
> webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java f0cee61
> webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
> webapp/src/test/java/org/apache/falcon/resource/TestContext.java 4a25b88
> webapp/src/test/resources/startup.properties PRE-CREATION
>
> Diff: https://reviews.apache.org/r/37771/diff/
>
>
> Testing
> -------
>
> Unit tests and IT tests.
> Manual testing :
>
> * ProxyUSer service not added in startup properties, should throw "Service ProxyUserService not registered"
> * Super user not added in proxy user setting in startup.properties, shoudl throw "java.security.AccessControlException: User <superuser> not defined as proxyuser"
>
> CLI:
> * Add doAs option in CLI and verify command succeeds
> * Commands should succeed without doAs as is an optional arg
>
> REST API:
> * pass doAs query param and verify REST requests succeeds
> * REST requests should succeed without doAs query param as it is optional
>
>
> * Perform schedule using doAs user. For other requests if doAs user is not passed (say suspend, resume etc.) should get "User <superuser> not authorized for Coord job <bundleId>"
>
>
> Thanks,
>
> Sowmya Ramesh
>
>
Re: Review Request 37771: Falcon Proxy user support
Posted by Ajay Yadava <aj...@gmail.com>.
> On Sept. 8, 2015, 2:35 p.m., Ajay Yadava wrote:
> > common/src/main/java/org/apache/falcon/service/ProxyUserService.java, line 81
> > <https://reviews.apache.org/r/37771/diff/3/?file=1056558#file1056558line81>
> >
> > Will it make sense to move it to RuntimeProperties? Adding new proxy user won't be a very frequent operation I suppose, but adding groups might be.
>
> Venkat Ranganathan wrote:
> That is a good question. I wanted it to be in Startup Properties as this is a configuration that an administrator has to make (like one does in core-site with the explicit idea that the proxy user is fully trusted and the list of hosts/groups are configured at the time. If there are any changes in these, then we probably should configure LDap integration or some other form of authentication option.
I think there is some disconnect. Both startup.properties and runtime.properties are administrator privileges, only difference is that values in runtime.properties (RuntimeProperties class) are automatically updated without restart. I was thinking that like most access operations, administrators will continue to update these with time, hence it might be a good idea to put them in runtime.properties.
- Ajay
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/#review97913
-----------------------------------------------------------
On Aug. 31, 2015, 11:05 p.m., Sowmya Ramesh wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/37771/
> -----------------------------------------------------------
>
> (Updated Aug. 31, 2015, 11:05 p.m.)
>
>
> Review request for Falcon.
>
>
> Bugs: FALCON-1027
> https://issues.apache.org/jira/browse/FALCON-1027
>
>
> Repository: falcon-git
>
>
> Description
> -------
>
> Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
> line).
>
>
> Diffs
> -----
>
> client/src/main/java/org/apache/falcon/cli/FalconCLI.java 11dfe72
> client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
> client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
> client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
> common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
> common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
> common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
> common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
> common/src/main/resources/startup.properties c48188c
> common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 9a3f365
> common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java 6e77462
> common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
> common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
> docs/src/site/twiki/FalconCLI.twiki 9203699
> docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
> prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 78964dd
> prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java 5b415a2
> prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
> prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
> prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
> prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
> prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
> prism/src/main/webapp/WEB-INF/web.xml 551bf56
> prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java cce8737
> prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java 9e8c76a
> prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
> src/conf/startup.properties 9925373
> unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
> unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
> webapp/pom.xml 5a9e1da
> webapp/src/conf/oozie/conf/oozie-site.xml ded4873
> webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
> webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
> webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
> webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
> webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
> webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java f0cee61
> webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
> webapp/src/test/java/org/apache/falcon/resource/TestContext.java 4a25b88
> webapp/src/test/resources/startup.properties PRE-CREATION
>
> Diff: https://reviews.apache.org/r/37771/diff/
>
>
> Testing
> -------
>
> Unit tests and IT tests.
> Manual testing :
>
> * ProxyUSer service not added in startup properties, should throw "Service ProxyUserService not registered"
> * Super user not added in proxy user setting in startup.properties, shoudl throw "java.security.AccessControlException: User <superuser> not defined as proxyuser"
>
> CLI:
> * Add doAs option in CLI and verify command succeeds
> * Commands should succeed without doAs as is an optional arg
>
> REST API:
> * pass doAs query param and verify REST requests succeeds
> * REST requests should succeed without doAs query param as it is optional
>
>
> * Perform schedule using doAs user. For other requests if doAs user is not passed (say suspend, resume etc.) should get "User <superuser> not authorized for Coord job <bundleId>"
>
>
> Thanks,
>
> Sowmya Ramesh
>
>
Re: Review Request 37771: Falcon Proxy user support
Posted by Venkat Ranganathan <n....@live.com>.
> On Sept. 8, 2015, 7:35 a.m., Ajay Yadava wrote:
> > common/src/main/java/org/apache/falcon/service/ProxyUserService.java, line 81
> > <https://reviews.apache.org/r/37771/diff/3/?file=1056558#file1056558line81>
> >
> > Will it make sense to move it to RuntimeProperties? Adding new proxy user won't be a very frequent operation I suppose, but adding groups might be.
>
> Venkat Ranganathan wrote:
> That is a good question. I wanted it to be in Startup Properties as this is a configuration that an administrator has to make (like one does in core-site with the explicit idea that the proxy user is fully trusted and the list of hosts/groups are configured at the time. If there are any changes in these, then we probably should configure LDap integration or some other form of authentication option.
>
> Ajay Yadava wrote:
> I think there is some disconnect. Both startup.properties and runtime.properties are administrator privileges, only difference is that values in runtime.properties (RuntimeProperties class) are automatically updated without restart. I was thinking that like most access operations, administrators will continue to update these with time, hence it might be a good idea to put them in runtime.properties.
Good point. This was initially patterned after core-site which is more static for most services - but we have since added ability to refresh these settings also in Yarn, so moving these to runtime properties is OK
- Venkat
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/#review97913
-----------------------------------------------------------
On Aug. 31, 2015, 4:05 p.m., Sowmya Ramesh wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/37771/
> -----------------------------------------------------------
>
> (Updated Aug. 31, 2015, 4:05 p.m.)
>
>
> Review request for Falcon.
>
>
> Bugs: FALCON-1027
> https://issues.apache.org/jira/browse/FALCON-1027
>
>
> Repository: falcon-git
>
>
> Description
> -------
>
> Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
> line).
>
>
> Diffs
> -----
>
> client/src/main/java/org/apache/falcon/cli/FalconCLI.java 11dfe72
> client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
> client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
> client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
> common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
> common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
> common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
> common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
> common/src/main/resources/startup.properties c48188c
> common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 9a3f365
> common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java 6e77462
> common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
> common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
> docs/src/site/twiki/FalconCLI.twiki 9203699
> docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
> prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 78964dd
> prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java 5b415a2
> prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
> prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
> prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
> prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
> prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
> prism/src/main/webapp/WEB-INF/web.xml 551bf56
> prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java cce8737
> prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java 9e8c76a
> prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
> src/conf/startup.properties 9925373
> unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
> unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
> webapp/pom.xml 5a9e1da
> webapp/src/conf/oozie/conf/oozie-site.xml ded4873
> webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
> webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
> webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
> webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
> webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
> webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java f0cee61
> webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
> webapp/src/test/java/org/apache/falcon/resource/TestContext.java 4a25b88
> webapp/src/test/resources/startup.properties PRE-CREATION
>
> Diff: https://reviews.apache.org/r/37771/diff/
>
>
> Testing
> -------
>
> Unit tests and IT tests.
> Manual testing :
>
> * ProxyUSer service not added in startup properties, should throw "Service ProxyUserService not registered"
> * Super user not added in proxy user setting in startup.properties, shoudl throw "java.security.AccessControlException: User <superuser> not defined as proxyuser"
>
> CLI:
> * Add doAs option in CLI and verify command succeeds
> * Commands should succeed without doAs as is an optional arg
>
> REST API:
> * pass doAs query param and verify REST requests succeeds
> * REST requests should succeed without doAs query param as it is optional
>
>
> * Perform schedule using doAs user. For other requests if doAs user is not passed (say suspend, resume etc.) should get "User <superuser> not authorized for Coord job <bundleId>"
>
>
> Thanks,
>
> Sowmya Ramesh
>
>
Re: Review Request 37771: Falcon Proxy user support
Posted by Sowmya Ramesh <sr...@hortonworks.com>.
> On Sept. 8, 2015, 2:35 p.m., Ajay Yadava wrote:
> > common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java, line 157
> > <https://reviews.apache.org/r/37771/diff/3/?file=1056561#file1056561line157>
> >
> > redundant?
>
> Sowmya Ramesh wrote:
> Sorry, I don't understand. What is redundant here?!
This test validates exception is thrown when doAs user and ACl owner is different, hence not redundant test.
- Sowmya
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/#review97913
-----------------------------------------------------------
On Aug. 31, 2015, 11:05 p.m., Sowmya Ramesh wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/37771/
> -----------------------------------------------------------
>
> (Updated Aug. 31, 2015, 11:05 p.m.)
>
>
> Review request for Falcon.
>
>
> Bugs: FALCON-1027
> https://issues.apache.org/jira/browse/FALCON-1027
>
>
> Repository: falcon-git
>
>
> Description
> -------
>
> Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
> line).
>
>
> Diffs
> -----
>
> client/src/main/java/org/apache/falcon/cli/FalconCLI.java 11dfe72
> client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
> client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
> client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
> common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
> common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
> common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
> common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
> common/src/main/resources/startup.properties c48188c
> common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 9a3f365
> common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java 6e77462
> common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
> common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
> docs/src/site/twiki/FalconCLI.twiki 9203699
> docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
> prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 78964dd
> prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java 5b415a2
> prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
> prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
> prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
> prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
> prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
> prism/src/main/webapp/WEB-INF/web.xml 551bf56
> prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java cce8737
> prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java 9e8c76a
> prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
> src/conf/startup.properties 9925373
> unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
> unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
> webapp/pom.xml 5a9e1da
> webapp/src/conf/oozie/conf/oozie-site.xml ded4873
> webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
> webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
> webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
> webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
> webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
> webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java f0cee61
> webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
> webapp/src/test/java/org/apache/falcon/resource/TestContext.java 4a25b88
> webapp/src/test/resources/startup.properties PRE-CREATION
>
> Diff: https://reviews.apache.org/r/37771/diff/
>
>
> Testing
> -------
>
> Unit tests and IT tests.
> Manual testing :
>
> * ProxyUSer service not added in startup properties, should throw "Service ProxyUserService not registered"
> * Super user not added in proxy user setting in startup.properties, shoudl throw "java.security.AccessControlException: User <superuser> not defined as proxyuser"
>
> CLI:
> * Add doAs option in CLI and verify command succeeds
> * Commands should succeed without doAs as is an optional arg
>
> REST API:
> * pass doAs query param and verify REST requests succeeds
> * REST requests should succeed without doAs query param as it is optional
>
>
> * Perform schedule using doAs user. For other requests if doAs user is not passed (say suspend, resume etc.) should get "User <superuser> not authorized for Coord job <bundleId>"
>
>
> Thanks,
>
> Sowmya Ramesh
>
>
Re: Review Request 37771: Falcon Proxy user support
Posted by Venkat Ranganathan <n....@live.com>.
> On Sept. 8, 2015, 7:35 a.m., Ajay Yadava wrote:
> >
Thanks for a thorough review (as usual) Ajay. I have answered couple of items here. I think rest of the items, Sowmya will address and resolve.
> On Sept. 8, 2015, 7:35 a.m., Ajay Yadava wrote:
> > common/src/main/java/org/apache/falcon/service/ProxyUserService.java, line 81
> > <https://reviews.apache.org/r/37771/diff/3/?file=1056558#file1056558line81>
> >
> > Will it make sense to move it to RuntimeProperties? Adding new proxy user won't be a very frequent operation I suppose, but adding groups might be.
That is a good question. I wanted it to be in Startup Properties as this is a configuration that an administrator has to make (like one does in core-site with the explicit idea that the proxy user is fully trusted and the list of hosts/groups are configured at the time. If there are any changes in these, then we probably should configure LDap integration or some other form of authentication option.
> On Sept. 8, 2015, 7:35 a.m., Ajay Yadava wrote:
> > common/src/main/java/org/apache/falcon/security/CurrentUser.java, line 84
> > <https://reviews.apache.org/r/37771/diff/3/?file=1056555#file1056555line84>
> >
> > unix user names are case sensitive, should we also keep the comparison as case sensitive?
Since we also work on Windows (on prem and azure) we need to allow case-insensitive names.
> On Sept. 8, 2015, 7:35 a.m., Ajay Yadava wrote:
> > prism/src/main/java/org/apache/falcon/security/HostnameFilter.java, line 70
> > <https://reviews.apache.org/r/37771/diff/3/?file=1056572#file1056572line70>
> >
> > Is it different from just doing request.getRemoteHost()?
Most of these were from Oozie/Hadoop that was used here. To give the background, getRemoteHost() is actually
InetAddress.getByName(getRemoteAddr()).getCanonicalHostName();
with one difference in that when the resolution fails we can catch it and log whereas if the servlet engine cannot resolve it, the request will not make it to Falcon.
- Venkat
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/#review97913
-----------------------------------------------------------
On Aug. 31, 2015, 4:05 p.m., Sowmya Ramesh wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/37771/
> -----------------------------------------------------------
>
> (Updated Aug. 31, 2015, 4:05 p.m.)
>
>
> Review request for Falcon.
>
>
> Bugs: FALCON-1027
> https://issues.apache.org/jira/browse/FALCON-1027
>
>
> Repository: falcon-git
>
>
> Description
> -------
>
> Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
> line).
>
>
> Diffs
> -----
>
> client/src/main/java/org/apache/falcon/cli/FalconCLI.java 11dfe72
> client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
> client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
> client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
> common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
> common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
> common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
> common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
> common/src/main/resources/startup.properties c48188c
> common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 9a3f365
> common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java 6e77462
> common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
> common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
> docs/src/site/twiki/FalconCLI.twiki 9203699
> docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
> prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 78964dd
> prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java 5b415a2
> prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
> prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
> prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
> prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
> prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
> prism/src/main/webapp/WEB-INF/web.xml 551bf56
> prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java cce8737
> prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java 9e8c76a
> prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
> src/conf/startup.properties 9925373
> unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
> unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
> webapp/pom.xml 5a9e1da
> webapp/src/conf/oozie/conf/oozie-site.xml ded4873
> webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
> webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
> webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
> webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
> webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
> webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java f0cee61
> webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
> webapp/src/test/java/org/apache/falcon/resource/TestContext.java 4a25b88
> webapp/src/test/resources/startup.properties PRE-CREATION
>
> Diff: https://reviews.apache.org/r/37771/diff/
>
>
> Testing
> -------
>
> Unit tests and IT tests.
> Manual testing :
>
> * ProxyUSer service not added in startup properties, should throw "Service ProxyUserService not registered"
> * Super user not added in proxy user setting in startup.properties, shoudl throw "java.security.AccessControlException: User <superuser> not defined as proxyuser"
>
> CLI:
> * Add doAs option in CLI and verify command succeeds
> * Commands should succeed without doAs as is an optional arg
>
> REST API:
> * pass doAs query param and verify REST requests succeeds
> * REST requests should succeed without doAs query param as it is optional
>
>
> * Perform schedule using doAs user. For other requests if doAs user is not passed (say suspend, resume etc.) should get "User <superuser> not authorized for Coord job <bundleId>"
>
>
> Thanks,
>
> Sowmya Ramesh
>
>
Re: Review Request 37771: Falcon Proxy user support
Posted by Ajay Yadava <aj...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/#review97913
-----------------------------------------------------------
common/src/main/java/org/apache/falcon/security/CurrentUser.java (line 84)
<https://reviews.apache.org/r/37771/#comment154137>
unix user names are case sensitive, should we also keep the comparison as case sensitive?
common/src/main/java/org/apache/falcon/security/SecurityUtil.java (line 120)
<https://reviews.apache.org/r/37771/#comment154135>
unix user names are case sensitive, should we also keep the comparison as case sensitive?
common/src/main/java/org/apache/falcon/service/GroupsService.java (line 31)
<https://reviews.apache.org/r/37771/#comment154138>
nit: doesn't need to be a fully qualified name.
common/src/main/java/org/apache/falcon/service/ProxyUserService.java (line 58)
<https://reviews.apache.org/r/37771/#comment154140>
nit: can be private.
common/src/main/java/org/apache/falcon/service/ProxyUserService.java (line 81)
<https://reviews.apache.org/r/37771/#comment154141>
Will it make sense to move it to RuntimeProperties? Adding new proxy user won't be a very frequent operation I suppose, but adding groups might be.
common/src/main/java/org/apache/falcon/service/ProxyUserService.java (line 191)
<https://reviews.apache.org/r/37771/#comment154139>
nit: .isBlank() might be more appropriate.
common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java (line 157)
<https://reviews.apache.org/r/37771/#comment154151>
redundant?
prism/src/main/java/org/apache/falcon/security/HostnameFilter.java (line 70)
<https://reviews.apache.org/r/37771/#comment154043>
Is it different from just doing request.getRemoteHost()?
- Ajay Yadava
On Aug. 31, 2015, 11:05 p.m., Sowmya Ramesh wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/37771/
> -----------------------------------------------------------
>
> (Updated Aug. 31, 2015, 11:05 p.m.)
>
>
> Review request for Falcon.
>
>
> Bugs: FALCON-1027
> https://issues.apache.org/jira/browse/FALCON-1027
>
>
> Repository: falcon-git
>
>
> Description
> -------
>
> Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
> line).
>
>
> Diffs
> -----
>
> client/src/main/java/org/apache/falcon/cli/FalconCLI.java 11dfe72
> client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
> client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
> client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
> common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
> common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
> common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
> common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
> common/src/main/resources/startup.properties c48188c
> common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 9a3f365
> common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java 6e77462
> common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
> common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
> docs/src/site/twiki/FalconCLI.twiki 9203699
> docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
> prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 78964dd
> prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java 5b415a2
> prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
> prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
> prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
> prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
> prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
> prism/src/main/webapp/WEB-INF/web.xml 551bf56
> prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java cce8737
> prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java 9e8c76a
> prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
> src/conf/startup.properties 9925373
> unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
> unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
> webapp/pom.xml 5a9e1da
> webapp/src/conf/oozie/conf/oozie-site.xml ded4873
> webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
> webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
> webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
> webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
> webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
> webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java f0cee61
> webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
> webapp/src/test/java/org/apache/falcon/resource/TestContext.java 4a25b88
> webapp/src/test/resources/startup.properties PRE-CREATION
>
> Diff: https://reviews.apache.org/r/37771/diff/
>
>
> Testing
> -------
>
> Unit tests and IT tests.
> Manual testing :
>
> * ProxyUSer service not added in startup properties, should throw "Service ProxyUserService not registered"
> * Super user not added in proxy user setting in startup.properties, shoudl throw "java.security.AccessControlException: User <superuser> not defined as proxyuser"
>
> CLI:
> * Add doAs option in CLI and verify command succeeds
> * Commands should succeed without doAs as is an optional arg
>
> REST API:
> * pass doAs query param and verify REST requests succeeds
> * REST requests should succeed without doAs query param as it is optional
>
>
> * Perform schedule using doAs user. For other requests if doAs user is not passed (say suspend, resume etc.) should get "User <superuser> not authorized for Coord job <bundleId>"
>
>
> Thanks,
>
> Sowmya Ramesh
>
>
Re: Review Request 37771: Falcon Proxy user support
Posted by Ajay Yadava <aj...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/#review98541
-----------------------------------------------------------
common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java (line 157)
<https://reviews.apache.org/r/37771/#comment155057>
Sorry I forgot to publish my comment :) I didn't mean the test to be redundant but the last statement.
I think the exception will be thrown at previous line (SecurityUtil.tryProxy) and this will not be reached so last assert is not reachable. May be you needed both but in different order.
- Ajay Yadava
On Aug. 31, 2015, 11:05 p.m., Sowmya Ramesh wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/37771/
> -----------------------------------------------------------
>
> (Updated Aug. 31, 2015, 11:05 p.m.)
>
>
> Review request for Falcon.
>
>
> Bugs: FALCON-1027
> https://issues.apache.org/jira/browse/FALCON-1027
>
>
> Repository: falcon-git
>
>
> Description
> -------
>
> Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
> line).
>
>
> Diffs
> -----
>
> client/src/main/java/org/apache/falcon/cli/FalconCLI.java 11dfe72
> client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
> client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
> client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
> common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
> common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
> common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
> common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
> common/src/main/resources/startup.properties c48188c
> common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 9a3f365
> common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java 6e77462
> common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
> common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
> docs/src/site/twiki/FalconCLI.twiki 9203699
> docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
> prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 78964dd
> prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java 5b415a2
> prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
> prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
> prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
> prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
> prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
> prism/src/main/webapp/WEB-INF/web.xml 551bf56
> prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java cce8737
> prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java 9e8c76a
> prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
> src/conf/startup.properties 9925373
> unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
> unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
> webapp/pom.xml 5a9e1da
> webapp/src/conf/oozie/conf/oozie-site.xml ded4873
> webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
> webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
> webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
> webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
> webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
> webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java f0cee61
> webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
> webapp/src/test/java/org/apache/falcon/resource/TestContext.java 4a25b88
> webapp/src/test/resources/startup.properties PRE-CREATION
>
> Diff: https://reviews.apache.org/r/37771/diff/
>
>
> Testing
> -------
>
> Unit tests and IT tests.
> Manual testing :
>
> * ProxyUSer service not added in startup properties, should throw "Service ProxyUserService not registered"
> * Super user not added in proxy user setting in startup.properties, shoudl throw "java.security.AccessControlException: User <superuser> not defined as proxyuser"
>
> CLI:
> * Add doAs option in CLI and verify command succeeds
> * Commands should succeed without doAs as is an optional arg
>
> REST API:
> * pass doAs query param and verify REST requests succeeds
> * REST requests should succeed without doAs query param as it is optional
>
>
> * Perform schedule using doAs user. For other requests if doAs user is not passed (say suspend, resume etc.) should get "User <superuser> not authorized for Coord job <bundleId>"
>
>
> Thanks,
>
> Sowmya Ramesh
>
>
Re: Review Request 37771: Falcon Proxy user support
Posted by Venkat Ranganathan <n....@live.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/#review98726
-----------------------------------------------------------
Ship it!
Ship It!
- Venkat Ranganathan
On Sept. 11, 2015, 5:54 p.m., Sowmya Ramesh wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/37771/
> -----------------------------------------------------------
>
> (Updated Sept. 11, 2015, 5:54 p.m.)
>
>
> Review request for Falcon.
>
>
> Bugs: FALCON-1027
> https://issues.apache.org/jira/browse/FALCON-1027
>
>
> Repository: falcon-git
>
>
> Description
> -------
>
> Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
> line).
>
>
> Diffs
> -----
>
> client/src/main/java/org/apache/falcon/cli/FalconCLI.java d4da302
> client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
> client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
> client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
> common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
> common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
> common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
> common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
> common/src/main/resources/runtime.properties 23ecc16
> common/src/main/resources/startup.properties c48188c
> common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 5780c94
> common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java e40308e
> common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
> common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
> docs/src/site/twiki/FalconCLI.twiki 8bf3155
> docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
> prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 63c5d39
> prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java f9405dc
> prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
> prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
> prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
> prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
> prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
> prism/src/main/webapp/WEB-INF/web.xml 551bf56
> prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java ea2c40f
> prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java df85529
> prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
> src/conf/runtime.properties b31e6a3
> src/conf/startup.properties 9925373
> unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
> unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
> webapp/pom.xml ce37634
> webapp/src/conf/oozie/conf/oozie-site.xml ded4873
> webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
> webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
> webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
> webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
> webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
> webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java bcd3bd5
> webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
> webapp/src/test/java/org/apache/falcon/resource/TestContext.java 54671fb
> webapp/src/test/resources/runtime.properties PRE-CREATION
>
> Diff: https://reviews.apache.org/r/37771/diff/
>
>
> Testing
> -------
>
> Unit tests and IT tests.
> Manual testing :
>
> * ProxyUSer service not added in startup properties, should throw "Service ProxyUserService not registered"
> * Super user not added in proxy user setting in startup.properties, shoudl throw "java.security.AccessControlException: User <superuser> not defined as proxyuser"
>
> CLI:
> * Add doAs option in CLI and verify command succeeds
> * Commands should succeed without doAs as is an optional arg
>
> REST API:
> * pass doAs query param and verify REST requests succeeds
> * REST requests should succeed without doAs query param as it is optional
>
>
> * Perform schedule using doAs user. For other requests if doAs user is not passed (say suspend, resume etc.) should get "User <superuser> not authorized for Coord job <bundleId>"
>
>
> Thanks,
>
> Sowmya Ramesh
>
>
Re: Review Request 37771: Falcon Proxy user support
Posted by Sowmya Ramesh <sr...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/
-----------------------------------------------------------
(Updated Sept. 12, 2015, 12:54 a.m.)
Review request for Falcon.
Changes
-------
Applied feedback!
Bugs: FALCON-1027
https://issues.apache.org/jira/browse/FALCON-1027
Repository: falcon-git
Description
-------
Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
line).
Diffs (updated)
-----
client/src/main/java/org/apache/falcon/cli/FalconCLI.java d4da302
client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
common/src/main/resources/runtime.properties 23ecc16
common/src/main/resources/startup.properties c48188c
common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 5780c94
common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java e40308e
common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
docs/src/site/twiki/FalconCLI.twiki 8bf3155
docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 63c5d39
prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java f9405dc
prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
prism/src/main/webapp/WEB-INF/web.xml 551bf56
prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java ea2c40f
prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java df85529
prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
src/conf/runtime.properties b31e6a3
src/conf/startup.properties 9925373
unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
webapp/pom.xml ce37634
webapp/src/conf/oozie/conf/oozie-site.xml ded4873
webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java bcd3bd5
webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
webapp/src/test/java/org/apache/falcon/resource/TestContext.java 54671fb
webapp/src/test/resources/runtime.properties PRE-CREATION
Diff: https://reviews.apache.org/r/37771/diff/
Testing
-------
Unit tests and IT tests.
Manual testing :
* ProxyUSer service not added in startup properties, should throw "Service ProxyUserService not registered"
* Super user not added in proxy user setting in startup.properties, shoudl throw "java.security.AccessControlException: User <superuser> not defined as proxyuser"
CLI:
* Add doAs option in CLI and verify command succeeds
* Commands should succeed without doAs as is an optional arg
REST API:
* pass doAs query param and verify REST requests succeeds
* REST requests should succeed without doAs query param as it is optional
* Perform schedule using doAs user. For other requests if doAs user is not passed (say suspend, resume etc.) should get "User <superuser> not authorized for Coord job <bundleId>"
Thanks,
Sowmya Ramesh
Re: Review Request 37771: Falcon Proxy user support
Posted by Sowmya Ramesh <sr...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/
-----------------------------------------------------------
(Updated Aug. 31, 2015, 11:05 p.m.)
Review request for Falcon.
Bugs: FALCON-1027
https://issues.apache.org/jira/browse/FALCON-1027
Repository: falcon-git
Description
-------
Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
line).
Diffs
-----
client/src/main/java/org/apache/falcon/cli/FalconCLI.java 11dfe72
client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
common/src/main/resources/startup.properties c48188c
common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 9a3f365
common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java 6e77462
common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
docs/src/site/twiki/FalconCLI.twiki 9203699
docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 78964dd
prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java 5b415a2
prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
prism/src/main/webapp/WEB-INF/web.xml 551bf56
prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java cce8737
prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java 9e8c76a
prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
src/conf/startup.properties 9925373
unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
webapp/pom.xml 5a9e1da
webapp/src/conf/oozie/conf/oozie-site.xml ded4873
webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java f0cee61
webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
webapp/src/test/java/org/apache/falcon/resource/TestContext.java 4a25b88
webapp/src/test/resources/startup.properties PRE-CREATION
Diff: https://reviews.apache.org/r/37771/diff/
Testing (updated)
-------
Unit tests and IT tests.
Manual testing :
* ProxyUSer service not added in startup properties, should throw "Service ProxyUserService not registered"
* Super user not added in proxy user setting in startup.properties, shoudl throw "java.security.AccessControlException: User <superuser> not defined as proxyuser"
CLI:
* Add doAs option in CLI and verify command succeeds
* Commands should succeed without doAs as is an optional arg
REST API:
* pass doAs query param and verify REST requests succeeds
* REST requests should succeed without doAs query param as it is optional
* Perform schedule using doAs user. For other requests if doAs user is not passed (say suspend, resume etc.) should get "User <superuser> not authorized for Coord job <bundleId>"
Thanks,
Sowmya Ramesh
Re: Review Request 37771: Falcon Proxy user support
Posted by Venkat Ranganathan <n....@live.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/#review97175
-----------------------------------------------------------
Ship it!
Good work Sowmya. Can you also update the test scenarios manually tested to the RB.
- Venkat Ranganathan
On Aug. 27, 2015, 2:50 p.m., Sowmya Ramesh wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/37771/
> -----------------------------------------------------------
>
> (Updated Aug. 27, 2015, 2:50 p.m.)
>
>
> Review request for Falcon.
>
>
> Bugs: FALCON-1027
> https://issues.apache.org/jira/browse/FALCON-1027
>
>
> Repository: falcon-git
>
>
> Description
> -------
>
> Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
> line).
>
>
> Diffs
> -----
>
> client/src/main/java/org/apache/falcon/cli/FalconCLI.java 11dfe72
> client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
> client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
> client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
> common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
> common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
> common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
> common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
> common/src/main/resources/startup.properties c48188c
> common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 9a3f365
> common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java 6e77462
> common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
> common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
> docs/src/site/twiki/FalconCLI.twiki 9203699
> docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
> prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 78964dd
> prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java 5b415a2
> prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
> prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
> prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
> prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
> prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
> prism/src/main/webapp/WEB-INF/web.xml 551bf56
> prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java cce8737
> prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java 9e8c76a
> prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
> src/conf/startup.properties 9925373
> unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
> unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
> webapp/pom.xml 5a9e1da
> webapp/src/conf/oozie/conf/oozie-site.xml ded4873
> webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
> webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
> webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
> webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
> webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
> webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java f0cee61
> webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
> webapp/src/test/java/org/apache/falcon/resource/TestContext.java 4a25b88
> webapp/src/test/resources/startup.properties PRE-CREATION
>
> Diff: https://reviews.apache.org/r/37771/diff/
>
>
> Testing
> -------
>
> Unit tests and IT tests.
>
>
> Thanks,
>
> Sowmya Ramesh
>
>
Re: Review Request 37771: Falcon Proxy user support
Posted by Balu Vellanki <bv...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/#review97130
-----------------------------------------------------------
Ship it!
+1 Looks good to me.
- Balu Vellanki
On Aug. 27, 2015, 9:50 p.m., Sowmya Ramesh wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/37771/
> -----------------------------------------------------------
>
> (Updated Aug. 27, 2015, 9:50 p.m.)
>
>
> Review request for Falcon.
>
>
> Bugs: FALCON-1027
> https://issues.apache.org/jira/browse/FALCON-1027
>
>
> Repository: falcon-git
>
>
> Description
> -------
>
> Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
> line).
>
>
> Diffs
> -----
>
> client/src/main/java/org/apache/falcon/cli/FalconCLI.java 11dfe72
> client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
> client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
> client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
> common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
> common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
> common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
> common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
> common/src/main/resources/startup.properties c48188c
> common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 9a3f365
> common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java 6e77462
> common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
> common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
> docs/src/site/twiki/FalconCLI.twiki 9203699
> docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
> prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 78964dd
> prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java 5b415a2
> prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
> prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
> prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
> prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
> prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
> prism/src/main/webapp/WEB-INF/web.xml 551bf56
> prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java cce8737
> prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java 9e8c76a
> prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
> src/conf/startup.properties 9925373
> unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
> unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
> webapp/pom.xml 5a9e1da
> webapp/src/conf/oozie/conf/oozie-site.xml ded4873
> webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
> webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
> webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
> webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
> webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
> webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java f0cee61
> webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
> webapp/src/test/java/org/apache/falcon/resource/TestContext.java 4a25b88
> webapp/src/test/resources/startup.properties PRE-CREATION
>
> Diff: https://reviews.apache.org/r/37771/diff/
>
>
> Testing
> -------
>
> Unit tests and IT tests.
>
>
> Thanks,
>
> Sowmya Ramesh
>
>
Re: Review Request 37771: Falcon Proxy user support
Posted by Sowmya Ramesh <sr...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/
-----------------------------------------------------------
(Updated Aug. 27, 2015, 9:50 p.m.)
Review request for Falcon.
Changes
-------
Applied feedback!
Bugs: FALCON-1027
https://issues.apache.org/jira/browse/FALCON-1027
Repository: falcon-git
Description
-------
Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
line).
Diffs (updated)
-----
client/src/main/java/org/apache/falcon/cli/FalconCLI.java 11dfe72
client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
common/src/main/resources/startup.properties c48188c
common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 9a3f365
common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java 6e77462
common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
docs/src/site/twiki/FalconCLI.twiki 9203699
docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 78964dd
prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java 5b415a2
prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
prism/src/main/webapp/WEB-INF/web.xml 551bf56
prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java cce8737
prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java 9e8c76a
prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
src/conf/startup.properties 9925373
unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
webapp/pom.xml 5a9e1da
webapp/src/conf/oozie/conf/oozie-site.xml ded4873
webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java f0cee61
webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
webapp/src/test/java/org/apache/falcon/resource/TestContext.java 4a25b88
webapp/src/test/resources/startup.properties PRE-CREATION
Diff: https://reviews.apache.org/r/37771/diff/
Testing
-------
Unit tests and IT tests.
Thanks,
Sowmya Ramesh
Re: Review Request 37771: Falcon Proxy user support
Posted by Sowmya Ramesh <sr...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/
-----------------------------------------------------------
(Updated Aug. 27, 2015, 2:41 a.m.)
Review request for Falcon.
Changes
-------
Incorporated review comments.
Bugs: FALCON-1027
https://issues.apache.org/jira/browse/FALCON-1027
Repository: falcon-git
Description
-------
Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
line).
Diffs (updated)
-----
client/src/main/java/org/apache/falcon/cli/FalconCLI.java 11dfe72
client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
common/src/main/resources/startup.properties c48188c
common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 9a3f365
common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java 6e77462
common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
docs/src/site/twiki/FalconCLI.twiki 9203699
docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 78964dd
prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java 5b415a2
prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
prism/src/main/webapp/WEB-INF/web.xml 551bf56
prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java cce8737
prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java 9e8c76a
prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
src/conf/startup.properties 9925373
unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
webapp/pom.xml 5a9e1da
webapp/src/conf/oozie/conf/oozie-site.xml ded4873
webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java f0cee61
webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
webapp/src/test/java/org/apache/falcon/resource/TestContext.java 4a25b88
webapp/src/test/resources/startup.properties PRE-CREATION
Diff: https://reviews.apache.org/r/37771/diff/
Testing
-------
Unit tests and IT tests.
Thanks,
Sowmya Ramesh
Re: Review Request 37771: Falcon Proxy user support
Posted by Venkat Ranganathan <n....@live.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/37771/#review96489
-----------------------------------------------------------
Good work Sowmya. Was wondering if we could have reduced the number of changes required by using a singleton to maintain the doAs user as in FalconClient instead of adding doAs user as a parameter to every potential method but I understand the design choices you had and this is OK.
As we discussed earlier, we need to complete this feature with the improvement of ACL handling (and thereby also handling authorization for Falcon entities correctly instead of just Oozie related work)
common/src/main/java/org/apache/falcon/service/GroupsService.java (line 40)
<https://reviews.apache.org/r/37771/#comment151881>
Please remove the parameter (false). We need to use the current cluster config for Group resolution
- Venkat Ranganathan
On Aug. 25, 2015, 1:54 p.m., Sowmya Ramesh wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/37771/
> -----------------------------------------------------------
>
> (Updated Aug. 25, 2015, 1:54 p.m.)
>
>
> Review request for Falcon.
>
>
> Bugs: FALCON-1027
> https://issues.apache.org/jira/browse/FALCON-1027
>
>
> Repository: falcon-git
>
>
> Description
> -------
>
> Today, Falcon doesn’t have doAs capability i.e. it doesn’t support impersonation. Support for impersonation or proxyuser functionality (identical to Hadoop proxyuser capabilities and conceptually similar to Unix 'sudo') needs to be added to REST API’s and CLI(Command
> line).
>
>
> Diffs
> -----
>
> client/src/main/java/org/apache/falcon/cli/FalconCLI.java 11dfe72
> client/src/main/java/org/apache/falcon/cli/FalconMetadataCLI.java 2f57c7d
> client/src/main/java/org/apache/falcon/client/AbstractFalconClient.java 282b41b
> client/src/main/java/org/apache/falcon/client/FalconClient.java 44436d2
> common/src/main/java/org/apache/falcon/security/CurrentUser.java 4aed5d7
> common/src/main/java/org/apache/falcon/security/SecurityUtil.java 861f80f
> common/src/main/java/org/apache/falcon/service/GroupsService.java PRE-CREATION
> common/src/main/java/org/apache/falcon/service/ProxyUserService.java PRE-CREATION
> common/src/main/resources/startup.properties c48188c
> common/src/test/java/org/apache/falcon/security/CurrentUserTest.java 9a3f365
> common/src/test/java/org/apache/falcon/security/SecurityUtilTest.java 6e77462
> common/src/test/java/org/apache/falcon/service/GroupsServiceTest.java PRE-CREATION
> common/src/test/java/org/apache/falcon/service/ProxyUserServiceTest.java PRE-CREATION
> docs/src/site/twiki/FalconCLI.twiki 9203699
> docs/src/site/twiki/FalconDocumentation.twiki 29d93f7
> prism/src/main/java/org/apache/falcon/resource/AbstractEntityManager.java 78964dd
> prism/src/main/java/org/apache/falcon/resource/AbstractSchedulableEntityManager.java 5b415a2
> prism/src/main/java/org/apache/falcon/resource/channel/HTTPChannel.java 78f68ba
> prism/src/main/java/org/apache/falcon/resource/proxy/SchedulableEntityManagerProxy.java ceabb06
> prism/src/main/java/org/apache/falcon/security/FalconAuthenticationFilter.java df64b44
> prism/src/main/java/org/apache/falcon/security/FalconAuthorizationFilter.java 15e94cd
> prism/src/main/java/org/apache/falcon/security/HostnameFilter.java PRE-CREATION
> prism/src/main/webapp/WEB-INF/web.xml 551bf56
> prism/src/test/java/org/apache/falcon/resource/EntityManagerTest.java cce8737
> prism/src/test/java/org/apache/falcon/security/FalconAuthenticationFilterTest.java 9e8c76a
> prism/src/test/java/org/apache/falcon/security/HostnameFilterTest.java PRE-CREATION
> src/conf/startup.properties 9925373
> unit/src/main/java/org/apache/falcon/unit/FalconUnitClient.java eb65cb3
> unit/src/test/java/org/apache/falcon/unit/FalconUnitTestBase.java 997b301
> webapp/pom.xml 5a9e1da
> webapp/src/conf/oozie/conf/oozie-site.xml ded4873
> webapp/src/main/java/org/apache/falcon/resource/SchedulableEntityManager.java 1f8cc1b
> webapp/src/main/webapp/WEB-INF/distributed/web.xml 31d78a2
> webapp/src/main/webapp/WEB-INF/embedded/web.xml fa2db39
> webapp/src/main/webapp/WEB-INF/web.xml 2cfd7de
> webapp/src/test/java/org/apache/falcon/cli/FalconCLIIT.java 0062070
> webapp/src/test/java/org/apache/falcon/resource/EntityManagerJerseyIT.java f0cee61
> webapp/src/test/java/org/apache/falcon/resource/MetadataResourceJerseyIT.java eb1dda8
> webapp/src/test/java/org/apache/falcon/resource/TestContext.java 4a25b88
> webapp/src/test/resources/startup.properties PRE-CREATION
>
> Diff: https://reviews.apache.org/r/37771/diff/
>
>
> Testing
> -------
>
> Unit tests and IT tests.
>
>
> Thanks,
>
> Sowmya Ramesh
>
>