/**
* Check the ACLs for a user doing the passed operation.
*
* <ul>
* <li>If ACLs are disabled, allow all users.
* <li>Otherwise, if the operation is not a job operation(for eg. submit-job-to-queue), then
* allow only (a) clusterOwner(who started the cluster), (b) cluster administrators and (c)
* members of queue-submit-job-acl for the queue.
* <li>If the operation is a job operation, then allow only (a) jobOwner, (b) clusterOwner(who
* started the cluster), (c) cluster administrators, (d) members of queue admins acl for the
* queue and (e) members of job acl for the job operation
* </ul>
*
* @param job the job on which operation is requested
* @param callerUGI the user who is requesting the operation
* @param operation the operation for which authorization is needed
* @throws AccessControlException
*/
void checkAccess(JobInProgress job, UserGroupInformation callerUGI, Operation operation)
throws AccessControlException {
String queue = job.getProfile().getQueueName();
String jobId = job.getJobID().toString();
JobStatus jobStatus = job.getStatus();
String jobOwner = jobStatus.getUsername();
AccessControlList jobAcl = jobStatus.getJobACLs().get(operation.jobACLNeeded);
checkAccess(jobId, callerUGI, queue, operation, jobOwner, jobAcl);
}
/**
* Check the ACLs for a user doing the passed job operation.
*
* <ul>
* <li>If ACLs are disabled, allow all users.
* <li>Otherwise, allow only (a) jobOwner, (b) clusterOwner(who started the cluster), (c)
* cluster administrators, (d) members of job acl for the jobOperation
* </ul>
*
* @param jobStatus the status of the job
* @param callerUGI the user who is trying to perform the operation
* @param queue the job queue name
* @param operation the operation for which authorization is needed
*/
void checkAccess(
JobStatus jobStatus, UserGroupInformation callerUGI, String queue, Operation operation)
throws AccessControlException {
String jobId = jobStatus.getJobID().toString();
String jobOwner = jobStatus.getUsername();
AccessControlList jobAcl = jobStatus.getJobACLs().get(operation.jobACLNeeded);
// If acls are enabled, check if callerUGI is jobOwner, queue admin,
// cluster admin or part of job ACL
checkAccess(jobId, callerUGI, queue, operation, jobOwner, jobAcl);
}
