@Test
public void testGrantALLPrivilegeWithOtherPrivilegesExist() throws Exception {
/**
* user4 belongs to group group4 admin user grant role role4 to group group4 admin user grant
* read privilege on connector all to role role4
*/
SqoopClient client = sqoopServerRunner.getSqoopClient(ADMIN_USER);
MRole role4 = new MRole(ROLE4);
MPrincipal group4Princ = new MPrincipal(GROUP4, MPrincipal.TYPE.GROUP);
MPrincipal role4Princ = new MPrincipal(ROLE4, MPrincipal.TYPE.ROLE);
MResource allConnector = new MResource(SqoopActionConstant.ALL, MResource.TYPE.CONNECTOR);
MPrivilege readPrivilege = new MPrivilege(allConnector, SqoopActionConstant.READ, false);
client.createRole(role4);
client.grantRole(Lists.newArrayList(role4), Lists.newArrayList(group4Princ));
client.grantPrivilege(Lists.newArrayList(role4Princ), Lists.newArrayList(readPrivilege));
// check user4 has one privilege on role1
client = sqoopServerRunner.getSqoopClient(USER4);
assertTrue(client.getPrivilegesByPrincipal(role4Princ, allConnector).size() == 1);
// user4 has the read action on collector all
MPrivilege user4Privilege = client.getPrivilegesByPrincipal(role4Princ, allConnector).get(0);
assertEquals(user4Privilege.getAction().toLowerCase(), SqoopActionConstant.READ);
/** admin user grant write privilege on connector all to role role4 */
client = sqoopServerRunner.getSqoopClient(ADMIN_USER);
MPrivilege writePrivilege = new MPrivilege(allConnector, SqoopActionConstant.WRITE, false);
client.grantPrivilege(Lists.newArrayList(role4Princ), Lists.newArrayList(writePrivilege));
// check user4 has two privileges on role1
client = sqoopServerRunner.getSqoopClient(USER4);
assertTrue(client.getPrivilegesByPrincipal(role4Princ, allConnector).size() == 2);
// user4 has the read and write action on collector all
List<String> actions = Lists.newArrayList();
for (MPrivilege privilege : client.getPrivilegesByPrincipal(role4Princ, allConnector)) {
actions.add(privilege.getAction().toLowerCase());
}
assertEquals(Lists.newArrayList(SqoopActionConstant.READ, SqoopActionConstant.WRITE), actions);
/**
* admin user grant all privilege on connector all to role role4 because the all privilege
* includes the read and write privileges, these privileges will be removed
*/
client = sqoopServerRunner.getSqoopClient(ADMIN_USER);
MPrivilege allPrivilege = new MPrivilege(allConnector, SqoopActionConstant.ALL_NAME, false);
client.grantPrivilege(Lists.newArrayList(role4Princ), Lists.newArrayList(allPrivilege));
// check user4 has only privilege on role1
client = sqoopServerRunner.getSqoopClient(USER4);
assertTrue(client.getPrivilegesByPrincipal(role4Princ, allConnector).size() == 1);
// user4 has the all action on role3
user4Privilege = client.getPrivilegesByPrincipal(role4Princ, allConnector).get(0);
assertEquals(user4Privilege.getAction(), SqoopActionConstant.ALL_NAME);
}
@Test
public void testGrantPrivilegeWithAllPrivilegeExist() throws Exception {
/**
* user3 belongs to group group3 admin user grant role role3 to group group3 admin user grant
* all privilege on connector all to role role3
*/
SqoopClient client = sqoopServerRunner.getSqoopClient(ADMIN_USER);
MRole role3 = new MRole(ROLE3);
MPrincipal group3Princ = new MPrincipal(GROUP3, MPrincipal.TYPE.GROUP);
MPrincipal role3Princ = new MPrincipal(ROLE3, MPrincipal.TYPE.ROLE);
MResource allConnector = new MResource(SqoopActionConstant.ALL, MResource.TYPE.CONNECTOR);
MPrivilege allPrivilege = new MPrivilege(allConnector, SqoopActionConstant.ALL_NAME, false);
client.createRole(role3);
client.grantRole(Lists.newArrayList(role3), Lists.newArrayList(group3Princ));
client.grantPrivilege(Lists.newArrayList(role3Princ), Lists.newArrayList(allPrivilege));
// check user3 has one privilege on role3
client = sqoopServerRunner.getSqoopClient(USER3);
assertTrue(client.getPrivilegesByPrincipal(role3Princ, allConnector).size() == 1);
// user3 has the all action on role3
MPrivilege user3Privilege = client.getPrivilegesByPrincipal(role3Princ, allConnector).get(0);
assertEquals(user3Privilege.getAction(), SqoopActionConstant.ALL_NAME);
/**
* admin user grant read privilege on connector all to role role3 because the role3 has already
* the all privilege, the read privilege granting has no impact on the role3
*/
client = sqoopServerRunner.getSqoopClient(ADMIN_USER);
MPrivilege readPrivilege = new MPrivilege(allConnector, SqoopActionConstant.READ, false);
client.grantPrivilege(Lists.newArrayList(role3Princ), Lists.newArrayList(readPrivilege));
// check user3 has only one privilege on role3
client = sqoopServerRunner.getSqoopClient(USER3);
assertTrue(client.getPrivilegesByPrincipal(role3Princ, allConnector).size() == 1);
// user3 has the all action on role3
user3Privilege = client.getPrivilegesByPrincipal(role3Princ, allConnector).get(0);
assertEquals(user3Privilege.getAction(), SqoopActionConstant.ALL_NAME);
}
