Pārlūkot izejas kodu

[security] List Sentry roles according to accessible groups

Romain Rigaux 11 gadi atpakaļ
vecāks
revīzija
2f47794

+ 7 - 2
apps/security/src/security/api/hive.py

@@ -22,15 +22,20 @@ from django.http import HttpResponse
 from django.utils.translation import ugettext as _
 
 from libsentry.api import get_api
+from libsentry.sentry_site import get_sentry_server_admin_groups
 
 
 def list_sentry_roles_by_group(request):
   result = {'status': -1, 'message': 'Error'}
 
   try:
-    groupName = request.POST['groupName'] if request.POST['groupName'] else None
+    if request.POST['groupName']:
+      groupName = request.POST['groupName']
+    else:
+      # Admins can see everything, other only the groups they belong too
+      groupName = None if request.user.groups.filter(name__in=get_sentry_server_admin_groups()).exists() else '*'
     roles = get_api(request.user).list_sentry_roles_by_group(groupName)
-    result['roles'] = sorted(roles, key= lambda role: role['name'])
+    result['roles'] = sorted(roles, key=lambda role: role['name'])
     result['message'] = ''
     result['status'] = 0
   except Exception, e:

+ 71 - 0
apps/security/src/security/api/test_hive.py

@@ -0,0 +1,71 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# Licensed to Cloudera, Inc. under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  Cloudera, Inc. licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import json
+
+from nose.tools import assert_true, assert_equal, assert_false
+
+from desktop.lib.django_test_util import make_logged_in_client
+from desktop.lib.test_utils import grant_access, add_to_group
+
+from django.core.urlresolvers import reverse
+
+
+from libsentry import api
+
+
+class MockHiveApi(object):
+
+  def __init__(self, user):
+    self.user = user
+
+  def list_sentry_roles_by_group(self, groupName): # return GroupName only
+    return [{'name': groupName}]
+
+
+class TestMockedApi():
+
+  def setUp(self):
+    if not hasattr(api, 'OriginalSentryApi'):
+      api.OriginalSentryApi = api.get_api
+      api.get_api = MockHiveApi
+
+    self.client = make_logged_in_client(username='sentry_test', groupname='test', is_superuser=False)
+    self.client_admin = make_logged_in_client(username='sentry_hue', groupname='hue', is_superuser=False)
+    grant_access("sentry_test", "test", "security")
+    grant_access("sentry_hue", "hue", "security")
+    add_to_group("sentry_test")
+    add_to_group("sentry_hue")
+
+  def tearDown(self):
+    api.OozieApi = api.OriginalSentryApi
+
+
+  def test_list_sentry_roles_by_group(self):
+    response = self.client.post(reverse("security:list_sentry_roles_by_group"), {'groupName': ''})
+    assert_equal('*', json.loads(response.content)['roles'][0]['name'], response.content)
+
+    response = self.client.post(reverse("security:list_sentry_roles_by_group"), {'groupName': 'test'})
+    assert_equal('test', json.loads(response.content)['roles'][0]['name'], response.content)
+
+
+    response = self.client_admin.post(reverse("security:list_sentry_roles_by_group"), {'groupName': ''})
+    assert_equal(None, json.loads(response.content)['roles'][0]['name'], response.content)
+
+    response = self.client_admin.post(reverse("security:list_sentry_roles_by_group"), {'groupName': 'test'})
+    assert_equal('test', json.loads(response.content)['roles'][0]['name'], response.content)

+ 1 - 1
apps/security/src/security/tests.py

@@ -46,4 +46,4 @@ class TestSecurity():
     perm, created = HuePermission.objects.get_or_create(app='security', action='impersonate')
     GroupPermission.objects.get_or_create(group=group, hue_permission=perm)
 
-    check(client, assert_true)
+    check(client, assert_true)

+ 4 - 3
desktop/libs/libsentry/src/libsentry/sentry_site.py

@@ -50,7 +50,7 @@ def get_conf(name='sentry'):
 
 
 def get_hive_sentry_provider():
-  return get_conf(name='hive').get(_CONF_HIVE_PROVIDER, 'default')
+  return get_conf(name='hive').get(_CONF_HIVE_PROVIDER, 'server1')
 
 
 def get_sentry_server_principal():
@@ -65,6 +65,9 @@ def get_sentry_server_principal():
 def get_sentry_server_authentication():
   return get_conf().get(_CONF_SENTRY_SERVER_SECURITY_MODE, 'NOSASL').upper()
 
+def get_sentry_server_admin_groups():
+  return get_conf().get(_CONF_SENTRY_SERVER_ADMIN_GROUP, '').split(',')
+
 
 def _parse_sites():
   global _SITE_DICT
@@ -81,9 +84,7 @@ def _parse_sites():
     LOG.error('Cannot read Hive sentry site: %s' % e)
 
   for name, path in paths:
-    print path
     _SITE_DICT[name] = _parse_site(path)
-    print _SITE_DICT[name]
 
 def _parse_site(site_path):
   try:

+ 8 - 1
desktop/libs/libsentry/src/libsentry/test_client.py

@@ -23,7 +23,8 @@ from nose.tools import assert_true, assert_equal, assert_false, assert_not_equal
 
 from libsentry import sentry_site
 from libsentry.conf import SENTRY_CONF_DIR
-from libsentry.sentry_site import get_sentry_server_principal
+from libsentry.sentry_site import get_sentry_server_principal,\
+  get_sentry_server_admin_groups
 from libsentry.client import SentryClient
 
 
@@ -37,6 +38,7 @@ def test_security_plain():
     sentry_site.reset()
 
     assert_equal('test/test.com@TEST.COM', get_sentry_server_principal())
+    assert_equal(['hive', 'impala', 'hue'], get_sentry_server_admin_groups())
 
     security = SentryClient('test.com', 11111, 'test')._get_security()
 
@@ -91,6 +93,11 @@ def sentry_site_xml(
         <value>%(authentication)s</value>
       </property>
 
+      <property>
+        <name>sentry.service.admin.group</name>
+        <value>hive,impala,hue</value>
+      </property>
+
     </configuration>
   """ % {
     'provider': provider,