content: /*
   * The Alluxio Open Foundation licenses this work under the Apache License, version 2.0
   * (the "License"). You may not use this work except in compliance with the License, which is
   * available at www.apache.org/licenses/LICENSE-2.0
   *
   * This software is distributed on an "AS IS" basis, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
   * either express or implied, as more fully set forth in the License.
   *
   * See the NOTICE file distributed with this work for information regarding copyright ownership.
   */
  
  package alluxio.client.fs;
  
  import alluxio.AlluxioURI;
  import alluxio.Constants;
  import alluxio.client.file.FileSystem;
  import alluxio.client.file.FileSystemContext;
  import alluxio.client.file.URIStatus;
  import alluxio.conf.Configuration;
  import alluxio.conf.PropertyKey;
  import alluxio.exception.status.UnauthenticatedException;
  import alluxio.grpc.SetAttributePOptions;
  import alluxio.security.CurrentUser;
  import alluxio.security.authorization.Mode;
  import alluxio.security.group.GroupMappingService;
  import alluxio.testutils.BaseIntegrationTest;
  import alluxio.testutils.LocalAlluxioClusterResource;
  
  import com.google.common.collect.Lists;
  import org.junit.After;
  import org.junit.Assert;
  import org.junit.Before;
  import org.junit.BeforeClass;
  import org.junit.Rule;
  import org.junit.Test;
  
  import java.security.Principal;
  import java.util.ArrayList;
  import java.util.HashMap;
  import java.util.HashSet;
  import java.util.List;
  import java.util.Set;
  import javax.security.auth.Subject;
  
  /**
   * Integration tests for user impersonation.
   */
  public final class ImpersonationIntegrationTest extends BaseIntegrationTest {
    private static final String IMPERSONATION_USER = "impersonation_user";
    private static final String IMPERSONATION_GROUP1 = "impersonation_group1";
    private static final String IMPERSONATION_GROUP2 = "impersonation_group2";
  
    private static final String HDFS_USER = "hdfs_user";
    private static final String HDFS_GROUP1 = "hdfs_group1";
    private static final String HDFS_GROUP2 = "hdfs_group2";
  
    private static final String CONNECTION_USER = "alluxio_user";
    private static final String IMPERSONATION_GROUPS_CONFIG =
        "alluxio.master.security.impersonation.alluxio_user.groups";
    private static final String IMPERSONATION_USERS_CONFIG =
        "alluxio.master.security.impersonation.alluxio_user.users";
    private static final HashMap<String, String> GROUPS = new HashMap<>();
  
    @Rule
    public LocalAlluxioClusterResource mLocalAlluxioClusterResource =
        new LocalAlluxioClusterResource.Builder()
            .setProperty(PropertyKey.USER_METRICS_COLLECTION_ENABLED, false)
            .setProperty(PropertyKey.SECURITY_LOGIN_USERNAME, CONNECTION_USER)
            .setProperty(PropertyKey.SECURITY_GROUP_MAPPING_CACHE_TIMEOUT_MS, 0)
            .setProperty(PropertyKey.SECURITY_GROUP_MAPPING_CLASS,
                CustomGroupMapping.class.getName()).build();
  
    @After
    public void after() throws Exception {
      Configuration.reloadProperties();
    }
  
    @Before
    public void before() throws Exception {
      // Give the root dir 777, to write files as different users. This must be run as the user
      // that starts the master process
      FileSystem.Factory.create().setAttribute(new AlluxioURI("/"),
          SetAttributePOptions.newBuilder().setMode(new Mode((short) 0777).toProto()).build());
      // Enable client impersonation by default
      Configuration
          .set(PropertyKey.SECURITY_LOGIN_IMPERSONATION_USERNAME, Constants.IMPERSONATION_HDFS_USER);
    }
  
    @BeforeClass
    public static void beforeClass() {
      GROUPS.put(IMPERSONATION_USER, IMPERSONATION_GROUP1 + "," + IMPERSONATION_GROUP2);
      GROUPS.put(HDFS_USER, HDFS_GROUP1 + "," + HDFS_GROUP2);
    }
  
    @Test
    @LocalAlluxioClusterResource.Config(confParams = {IMPERSONATION_GROUPS_CONFIG, "*"})
    public void impersonationNotUsed() throws Exception {
      Configuration
          .set(PropertyKey.SECURITY_LOGIN_IMPERSONATION_USERNAME, Constants.IMPERSONATION_NONE);
      FileSystemContext context = FileSystemContext.create(createHdfsSubject(),
          Configuration.global());
      FileSystem fs = mLocalAlluxioClusterResource.get().getClient(context);
      fs.createFile(new AlluxioURI("/impersonation-test")).close();
      List<URIStatus> listing = fs.listStatus(new AlluxioURI("/"));
      Assert.assertEquals(1, listing.size());
      URIStatus status = listing.get(0);
      Assert.assertNotEquals(IMPERSONATION_USER, status.getOwner());
    }
  
    @Test
    @LocalAlluxioClusterResource.Config(confParams = {IMPERSONATION_GROUPS_CONFIG, "*"})
    public void impersonationArbitraryUserDisallowed() throws Exception {
      String arbitraryUser = "arbitrary_user";
      Configuration
          .set(PropertyKey.SECURITY_LOGIN_IMPERSONATION_USERNAME, arbitraryUser);
      FileSystemContext context = FileSystemContext.create(createHdfsSubject(),
          Configuration.global());
      FileSystem fs = mLocalAlluxioClusterResource.get().getClient(context);
      fs.createFile(new AlluxioURI("/impersonation-test")).close();
      List<URIStatus> listing = fs.listStatus(new AlluxioURI("/"));
      Assert.assertEquals(1, listing.size());
      URIStatus status = listing.get(0);
      Assert.assertNotEquals(arbitraryUser, status.getOwner());
    }
  
    @Test
    @LocalAlluxioClusterResource.Config(confParams = {IMPERSONATION_GROUPS_CONFIG, "*"})
    public void impersonationUsedHdfsUser() throws Exception {
      // test using the hdfs subject
      checkCreateFile(createHdfsSubject(), HDFS_USER);
    }
  
    @Test
    public void impersonationHdfsDisabled() throws Exception {
      try {
        checkCreateFile(createHdfsSubject(), HDFS_USER);
        Assert.fail("Connection succeeded, but impersonation should be denied.");
      } catch (UnauthenticatedException e) {
        // expected
      }
    }
  
    @Test
    @LocalAlluxioClusterResource.Config(
        confParams = {IMPERSONATION_USERS_CONFIG, HDFS_USER})
    public void impersonationHdfsUserAllowed() throws Exception {
      checkCreateFile(createHdfsSubject(), HDFS_USER);
    }
  
    @Test
    @LocalAlluxioClusterResource.Config(confParams = {IMPERSONATION_USERS_CONFIG,
        "wrong_user1,wrong_user2," + HDFS_USER})
    public void impersonationHdfsUsersAllowed() throws Exception {
      checkCreateFile(createHdfsSubject(), HDFS_USER);
    }
  
    @Test
    @LocalAlluxioClusterResource.Config(confParams = {IMPERSONATION_USERS_CONFIG, "wrong_user"})
    public void impersonationHdfsUserDenied() throws Exception {
      try {
        checkCreateFile(createHdfsSubject(), HDFS_USER);
        Assert.fail("Connection succeeded, but impersonation should be denied.");
      } catch (UnauthenticatedException e) {
        // expected
      }
    }
  
    @Test
    @LocalAlluxioClusterResource.Config(
        confParams = {
            IMPERSONATION_USERS_CONFIG, HDFS_USER,
            IMPERSONATION_GROUPS_CONFIG, HDFS_GROUP1})
    public void impersonationUsersAllowedGroupsAllowed() throws Exception {
      checkCreateFile(createHdfsSubject(), HDFS_USER);
    }
  
    @Test
    @LocalAlluxioClusterResource.Config(
        confParams = {
            IMPERSONATION_USERS_CONFIG, "wrong_user",
            IMPERSONATION_GROUPS_CONFIG, HDFS_GROUP1})
    public void impersonationUsersDeniedGroupsAllowed() throws Exception {
      checkCreateFile(createHdfsSubject(), HDFS_USER);
    }
  
    @Test
    @LocalAlluxioClusterResource.Config(
        confParams = {
            IMPERSONATION_USERS_CONFIG, HDFS_USER,
            IMPERSONATION_GROUPS_CONFIG, "wrong_group"})
    public void impersonationUsersAllowedGroupsDenied() throws Exception {
      checkCreateFile(createHdfsSubject(), HDFS_USER);
    }
  
    @Test
    @LocalAlluxioClusterResource.Config(
        confParams = {
            IMPERSONATION_USERS_CONFIG, "wrong_user",
            IMPERSONATION_GROUPS_CONFIG, "wrong_group"})
    public void impersonationUsersDeniedGroupsDenied() throws Exception {
      try {
        checkCreateFile(createHdfsSubject(), HDFS_USER);
        Assert.fail("Connection succeeded, but impersonation should be denied.");
      } catch (UnauthenticatedException e) {
        // expected
      }
    }
  
    @Test
    @LocalAlluxioClusterResource.Config(
        confParams = {IMPERSONATION_GROUPS_CONFIG, HDFS_GROUP2})
    public void impersonationHdfsGroupAllowed() throws Exception {
      checkCreateFile(createHdfsSubject(), HDFS_USER);
    }
  
    @Test
    @LocalAlluxioClusterResource.Config(confParams = {IMPERSONATION_GROUPS_CONFIG,
        IMPERSONATION_GROUP1 + "," + IMPERSONATION_GROUP2 + "," + HDFS_GROUP1})
    public void impersonationHdfsGroupsAllowed() throws Exception {
      checkCreateFile(createHdfsSubject(), HDFS_USER);
    }
  
    @Test
    @LocalAlluxioClusterResource.Config(confParams = {IMPERSONATION_GROUPS_CONFIG, "wrong_group"})
    public void impersonationHdfsGroupDenied() throws Exception {
      try {
        checkCreateFile(createHdfsSubject(), HDFS_USER);
        Assert.fail("Connection succeeded, but impersonation should be denied.");
      } catch (UnauthenticatedException e) {
        // expected
      }
    }
  
    private void checkCreateFile(Subject subject, String expectedUser) throws Exception {
      FileSystemContext context = FileSystemContext.create(subject, Configuration.global());
      FileSystem fs = mLocalAlluxioClusterResource.get().getClient(context);
      fs.createFile(new AlluxioURI("/impersonation-test")).close();
      List<URIStatus> listing = fs.listStatus(new AlluxioURI("/"));
      Assert.assertEquals(1, listing.size());
      URIStatus status = listing.get(0);
      Assert.assertEquals(expectedUser, status.getOwner());
    }
  
    private Subject createHdfsSubject() {
      // Create a subject for an hdfs user
      CurrentUser user = new CurrentUser(HDFS_USER);
      Set<Principal> principals = new HashSet<>();
      principals.add(user);
      return new Subject(false, principals, new HashSet<>(), new HashSet<>());
    }
  
    public static class CustomGroupMapping implements GroupMappingService {
      public CustomGroupMapping() {
      }
  
      @Override
      public List<String> getGroups(String user) {
        if (GROUPS.containsKey(user)) {
          return Lists.newArrayList(GROUPS.get(user).split(","));
        }
        return new ArrayList<>();
      }
    }
  }
  