| /* |
| * Licensed to the Apache Software Foundation (ASF) under one |
| * or more contributor license agreements. See the NOTICE file |
| * distributed with this work for additional information |
| * regarding copyright ownership. The ASF licenses this file |
| * to you under the Apache License, Version 2.0 (the |
| * "License"); you may not use this file except in compliance |
| * with the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, |
| * software distributed under the License is distributed on an |
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| * KIND, either express or implied. See the License for the |
| * specific language governing permissions and limitations |
| * under the License. |
| */ |
| package org.apache.accumulo.test; |
| |
| import static java.nio.charset.StandardCharsets.UTF_8; |
| import static org.junit.Assert.assertEquals; |
| import static org.junit.Assert.assertNotNull; |
| import static org.junit.Assert.assertTrue; |
| |
| import java.io.File; |
| import java.io.IOException; |
| import java.util.ArrayList; |
| import java.util.Arrays; |
| import java.util.Collections; |
| import java.util.Map; |
| import java.util.Set; |
| import java.util.regex.Pattern; |
| |
| import org.apache.accumulo.core.client.Accumulo; |
| import org.apache.accumulo.core.client.AccumuloClient; |
| import org.apache.accumulo.core.client.AccumuloException; |
| import org.apache.accumulo.core.client.AccumuloSecurityException; |
| import org.apache.accumulo.core.client.BatchScanner; |
| import org.apache.accumulo.core.client.BatchWriter; |
| import org.apache.accumulo.core.client.Scanner; |
| import org.apache.accumulo.core.client.TableExistsException; |
| import org.apache.accumulo.core.client.TableNotFoundException; |
| import org.apache.accumulo.core.client.admin.TableOperations; |
| import org.apache.accumulo.core.client.security.tokens.PasswordToken; |
| import org.apache.accumulo.core.data.Key; |
| import org.apache.accumulo.core.data.Mutation; |
| import org.apache.accumulo.core.data.Range; |
| import org.apache.accumulo.core.data.Value; |
| import org.apache.accumulo.core.security.Authorizations; |
| import org.apache.accumulo.core.security.SystemPermission; |
| import org.apache.accumulo.core.security.TablePermission; |
| import org.apache.accumulo.miniclusterImpl.MiniAccumuloConfigImpl; |
| import org.apache.accumulo.server.security.AuditedSecurityOperation; |
| import org.apache.accumulo.test.functional.ConfigurableMacBase; |
| import org.apache.commons.io.FileUtils; |
| import org.apache.hadoop.io.Text; |
| import org.junit.After; |
| import org.junit.Before; |
| import org.junit.Test; |
| |
| import edu.umd.cs.findbugs.annotations.SuppressFBWarnings; |
| |
| /** |
| * Tests that Accumulo is outputting audit messages as expected. Since this is using |
| * MiniAccumuloCluster, it could take a while if we test everything in isolation. We test blocks of |
| * related operations, run the whole test in one MiniAccumulo instance, trying to clean up objects |
| * between each test. The MiniAccumuloClusterTest sets up the log4j stuff differently to an |
| * installed instance, instead piping everything through stdout and writing to a set location so we |
| * have to find the logs and grep the bits we need out. |
| */ |
| public class AuditMessageIT extends ConfigurableMacBase { |
| |
| private static final String AUDIT_USER_1 = "AuditUser1"; |
| private static final String AUDIT_USER_2 = "AuditUser2"; |
| private static final String PASSWORD = "password"; |
| private static final String OLD_TEST_TABLE_NAME = "apples"; |
| private static final String NEW_TEST_TABLE_NAME = "oranges"; |
| private static final String THIRD_TEST_TABLE_NAME = "pears"; |
| private static final Authorizations auths = new Authorizations("private", "public"); |
| |
| @Override |
| public int defaultTimeoutSeconds() { |
| return 60; |
| } |
| |
| @Override |
| public void beforeClusterStart(MiniAccumuloConfigImpl cfg) { |
| cfg.setNumTservers(1); |
| } |
| |
| // Must be static to survive Junit re-initialising the class every time. |
| private static String lastAuditTimestamp; |
| private AccumuloClient auditAccumuloClient; |
| private AccumuloClient client; |
| |
| private static long findAuditMessage(ArrayList<String> input, String pattern) { |
| return input.stream().filter(s -> s.matches(".*" + pattern + ".*")).count(); |
| } |
| |
| /** |
| * Returns a List of Audit messages that have been grep'd out of the MiniAccumuloCluster output. |
| * |
| * @param stepName |
| * A unique name for the test being executed, to identify the System.out messages. |
| * @return A List of the Audit messages, sorted (so in chronological order). |
| */ |
| private ArrayList<String> getAuditMessages(String stepName) throws IOException { |
| // ACCUMULO-3144 Make sure we give the processes enough time to flush the write buffer |
| try { |
| Thread.sleep(2000); |
| } catch (InterruptedException e) { |
| Thread.currentThread().interrupt(); |
| throw new IOException("Interrupted waiting for data to be flushed to output streams"); |
| } |
| |
| // Grab the audit messages |
| System.out.println("Start of captured audit messages for step " + stepName); |
| |
| ArrayList<String> result = new ArrayList<>(); |
| File[] files = getCluster().getConfig().getLogDir().listFiles(); |
| assertNotNull(files); |
| for (File file : files) { |
| // We want to grab the files called .out |
| if (file.getName().contains(".out") && file.isFile() && file.canRead()) { |
| try (java.util.Scanner it = new java.util.Scanner(file, UTF_8)) { |
| while (it.hasNext()) { |
| String line = it.nextLine(); |
| // strip off prefix, because log4j.properties does |
| String pattern = ".* \\[" |
| + AuditedSecurityOperation.AUDITLOG.replace("org.apache.", "").replace(".", "[.]") |
| + "\\] .*"; |
| if (line.matches(pattern)) { |
| // Only include the message if startTimestamp is null. or the message occurred after |
| // the startTimestamp value |
| if ((lastAuditTimestamp == null) |
| || (line.substring(0, 23).compareTo(lastAuditTimestamp) > 0)) |
| result.add(line); |
| } |
| } |
| } |
| } |
| } |
| Collections.sort(result); |
| |
| for (String s : result) { |
| System.out.println(s); |
| } |
| System.out.println("End of captured audit messages for step " + stepName); |
| if (!result.isEmpty()) |
| lastAuditTimestamp = (result.get(result.size() - 1)).substring(0, 23); |
| |
| return result; |
| } |
| |
| private void grantEverySystemPriv(AccumuloClient client, String user) |
| throws AccumuloSecurityException, AccumuloException { |
| SystemPermission[] arrayOfP = {SystemPermission.SYSTEM, SystemPermission.ALTER_TABLE, |
| SystemPermission.ALTER_USER, SystemPermission.CREATE_TABLE, SystemPermission.CREATE_USER, |
| SystemPermission.DROP_TABLE, SystemPermission.DROP_USER}; |
| for (SystemPermission p : arrayOfP) { |
| client.securityOperations().grantSystemPermission(user, p); |
| } |
| } |
| |
| @Before |
| public void resetInstance() throws Exception { |
| client = Accumulo.newClient().from(getClientProperties()).build(); |
| |
| removeUsersAndTables(); |
| |
| // This will set the lastAuditTimestamp for the first test |
| getAuditMessages("setup"); |
| } |
| |
| @After |
| public void cleanUp() throws Exception { |
| removeUsersAndTables(); |
| client.close(); |
| } |
| |
| private void removeUsersAndTables() throws Exception { |
| for (String user : Arrays.asList(AUDIT_USER_1, AUDIT_USER_2)) { |
| if (client.securityOperations().listLocalUsers().contains(user)) { |
| client.securityOperations().dropLocalUser(user); |
| } |
| } |
| |
| TableOperations tops = client.tableOperations(); |
| for (String table : Arrays.asList(THIRD_TEST_TABLE_NAME, NEW_TEST_TABLE_NAME, |
| OLD_TEST_TABLE_NAME)) { |
| if (tops.exists(table)) { |
| tops.delete(table); |
| } |
| } |
| } |
| |
| @Test |
| public void testTableOperationsAudits() throws AccumuloException, AccumuloSecurityException, |
| TableExistsException, TableNotFoundException, IOException { |
| |
| client.securityOperations().createLocalUser(AUDIT_USER_1, new PasswordToken(PASSWORD)); |
| client.securityOperations().grantSystemPermission(AUDIT_USER_1, SystemPermission.SYSTEM); |
| client.securityOperations().grantSystemPermission(AUDIT_USER_1, SystemPermission.CREATE_TABLE); |
| |
| // Connect as Audit User and do a bunch of stuff. |
| // Testing activity begins here |
| auditAccumuloClient = |
| getCluster().createAccumuloClient(AUDIT_USER_1, new PasswordToken(PASSWORD)); |
| auditAccumuloClient.tableOperations().create(OLD_TEST_TABLE_NAME); |
| auditAccumuloClient.tableOperations().rename(OLD_TEST_TABLE_NAME, NEW_TEST_TABLE_NAME); |
| Map<String,String> emptyMap = Collections.emptyMap(); |
| Set<String> emptySet = Collections.emptySet(); |
| auditAccumuloClient.tableOperations().clone(NEW_TEST_TABLE_NAME, OLD_TEST_TABLE_NAME, true, |
| emptyMap, emptySet); |
| auditAccumuloClient.tableOperations().delete(OLD_TEST_TABLE_NAME); |
| auditAccumuloClient.tableOperations().offline(NEW_TEST_TABLE_NAME); |
| auditAccumuloClient.tableOperations().delete(NEW_TEST_TABLE_NAME); |
| // Testing activity ends here |
| |
| ArrayList<String> auditMessages = getAuditMessages("testTableOperationsAudits"); |
| |
| assertEquals(1, findAuditMessage(auditMessages, |
| "action: createTable; targetTable: " + OLD_TEST_TABLE_NAME)); |
| assertEquals(1, findAuditMessage(auditMessages, |
| "action: renameTable; targetTable: " + OLD_TEST_TABLE_NAME)); |
| assertEquals(1, |
| findAuditMessage(auditMessages, "action: cloneTable; targetTable: " + NEW_TEST_TABLE_NAME)); |
| assertEquals(1, findAuditMessage(auditMessages, |
| "action: deleteTable; targetTable: " + OLD_TEST_TABLE_NAME)); |
| assertEquals(1, findAuditMessage(auditMessages, |
| "action: offlineTable; targetTable: " + NEW_TEST_TABLE_NAME)); |
| assertEquals(1, findAuditMessage(auditMessages, |
| "action: deleteTable; targetTable: " + NEW_TEST_TABLE_NAME)); |
| |
| } |
| |
| @Test |
| public void testUserOperationsAudits() |
| throws AccumuloSecurityException, AccumuloException, TableExistsException, IOException { |
| |
| client.securityOperations().createLocalUser(AUDIT_USER_1, new PasswordToken(PASSWORD)); |
| client.securityOperations().grantSystemPermission(AUDIT_USER_1, SystemPermission.SYSTEM); |
| client.securityOperations().grantSystemPermission(AUDIT_USER_1, SystemPermission.CREATE_USER); |
| grantEverySystemPriv(client, AUDIT_USER_1); |
| |
| // Connect as Audit User and do a bunch of stuff. |
| // Start testing activities here |
| auditAccumuloClient = |
| getCluster().createAccumuloClient(AUDIT_USER_1, new PasswordToken(PASSWORD)); |
| auditAccumuloClient.securityOperations().createLocalUser(AUDIT_USER_2, |
| new PasswordToken(PASSWORD)); |
| |
| // It seems only root can grant stuff. |
| client.securityOperations().grantSystemPermission(AUDIT_USER_2, SystemPermission.ALTER_TABLE); |
| client.securityOperations().revokeSystemPermission(AUDIT_USER_2, SystemPermission.ALTER_TABLE); |
| auditAccumuloClient.tableOperations().create(NEW_TEST_TABLE_NAME); |
| client.securityOperations().grantTablePermission(AUDIT_USER_2, NEW_TEST_TABLE_NAME, |
| TablePermission.READ); |
| client.securityOperations().revokeTablePermission(AUDIT_USER_2, NEW_TEST_TABLE_NAME, |
| TablePermission.READ); |
| auditAccumuloClient.securityOperations().changeLocalUserPassword(AUDIT_USER_2, |
| new PasswordToken("anything")); |
| auditAccumuloClient.securityOperations().changeUserAuthorizations(AUDIT_USER_2, auths); |
| auditAccumuloClient.securityOperations().dropLocalUser(AUDIT_USER_2); |
| // Stop testing activities here |
| |
| ArrayList<String> auditMessages = getAuditMessages("testUserOperationsAudits"); |
| |
| // The user is allowed to create this user and it succeeded |
| assertEquals(2, |
| findAuditMessage(auditMessages, "action: createUser; targetUser: " + AUDIT_USER_2)); |
| assertEquals(1, findAuditMessage(auditMessages, "action: grantSystemPermission; permission: " |
| + SystemPermission.ALTER_TABLE + "; targetUser: " + AUDIT_USER_2)); |
| assertEquals(1, findAuditMessage(auditMessages, "action: revokeSystemPermission; permission: " |
| + SystemPermission.ALTER_TABLE + "; targetUser: " + AUDIT_USER_2)); |
| assertEquals(1, findAuditMessage(auditMessages, "action: grantTablePermission; permission: " |
| + TablePermission.READ + "; targetTable: " + NEW_TEST_TABLE_NAME)); |
| assertEquals(1, findAuditMessage(auditMessages, "action: revokeTablePermission; permission: " |
| + TablePermission.READ + "; targetTable: " + NEW_TEST_TABLE_NAME)); |
| // changePassword is allowed and succeeded |
| assertEquals(2, findAuditMessage(auditMessages, |
| "action: changePassword; targetUser: " + AUDIT_USER_2 + "")); |
| assertEquals(1, findAuditMessage(auditMessages, "action: changeAuthorizations; targetUser: " |
| + AUDIT_USER_2 + "; authorizations: " + auths)); |
| |
| // allowed to dropUser and succeeded |
| assertEquals(2, |
| findAuditMessage(auditMessages, "action: dropUser; targetUser: " + AUDIT_USER_2)); |
| } |
| |
| @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "paths provided by test") |
| @Test |
| public void testImportExportOperationsAudits() throws AccumuloSecurityException, |
| AccumuloException, TableExistsException, TableNotFoundException, IOException { |
| |
| client.securityOperations().createLocalUser(AUDIT_USER_1, new PasswordToken(PASSWORD)); |
| client.securityOperations().grantSystemPermission(AUDIT_USER_1, SystemPermission.SYSTEM); |
| client.securityOperations().changeUserAuthorizations(AUDIT_USER_1, auths); |
| grantEverySystemPriv(client, AUDIT_USER_1); |
| |
| // Connect as Audit User and do a bunch of stuff. |
| // Start testing activities here |
| auditAccumuloClient = |
| getCluster().createAccumuloClient(AUDIT_USER_1, new PasswordToken(PASSWORD)); |
| auditAccumuloClient.tableOperations().create(OLD_TEST_TABLE_NAME); |
| |
| // Insert some play data |
| try (BatchWriter bw = auditAccumuloClient.createBatchWriter(OLD_TEST_TABLE_NAME)) { |
| Mutation m = new Mutation("myRow"); |
| m.put("cf1", "cq1", "v1"); |
| m.put("cf1", "cq2", "v3"); |
| bw.addMutation(m); |
| } |
| |
| // Prepare to export the table |
| File exportDir = new File(getCluster().getConfig().getDir() + "/export"); |
| File exportDirBulk = new File(getCluster().getConfig().getDir() + "/export_bulk"); |
| assertTrue(exportDirBulk.mkdir() || exportDirBulk.isDirectory()); |
| |
| auditAccumuloClient.tableOperations().offline(OLD_TEST_TABLE_NAME, true); |
| auditAccumuloClient.tableOperations().exportTable(OLD_TEST_TABLE_NAME, exportDir.toString()); |
| |
| // We've exported the table metadata to the MiniAccumuloCluster root dir. Grab the .rf file path |
| // to re-import it |
| File distCpTxt = new File(exportDir + "/distcp.txt"); |
| File importFile = null; |
| |
| // Just grab the first rf file, it will do for now. |
| String filePrefix = "file:"; |
| |
| try (java.util.Scanner it = new java.util.Scanner(distCpTxt, UTF_8)) { |
| while (it.hasNext() && importFile == null) { |
| String line = it.nextLine(); |
| if (line.matches(".*\\.rf")) { |
| importFile = new File(line.replaceFirst(filePrefix, "")); |
| } |
| } |
| } |
| FileUtils.copyFileToDirectory(importFile, exportDir); |
| FileUtils.copyFileToDirectory(importFile, exportDirBulk); |
| auditAccumuloClient.tableOperations().importTable(NEW_TEST_TABLE_NAME, |
| Collections.singleton(exportDir.toString())); |
| |
| // Now do a Directory (bulk) import of the same data. |
| auditAccumuloClient.tableOperations().create(THIRD_TEST_TABLE_NAME); |
| auditAccumuloClient.tableOperations().importDirectory(exportDirBulk.toString()) |
| .to(THIRD_TEST_TABLE_NAME).load(); |
| auditAccumuloClient.tableOperations().online(OLD_TEST_TABLE_NAME); |
| |
| // Stop testing activities here |
| |
| ArrayList<String> auditMessages = getAuditMessages("testImportExportOperationsAudits"); |
| |
| assertEquals(1, findAuditMessage(auditMessages, String |
| .format(AuditedSecurityOperation.CAN_CREATE_TABLE_AUDIT_TEMPLATE, OLD_TEST_TABLE_NAME))); |
| assertEquals(1, |
| findAuditMessage(auditMessages, |
| String.format(AuditedSecurityOperation.CAN_ONLINE_OFFLINE_TABLE_AUDIT_TEMPLATE, |
| "offlineTable", OLD_TEST_TABLE_NAME))); |
| assertEquals(1, |
| findAuditMessage(auditMessages, |
| String.format(AuditedSecurityOperation.CAN_EXPORT_AUDIT_TEMPLATE, OLD_TEST_TABLE_NAME, |
| exportDir.toString()))); |
| assertEquals(1, |
| findAuditMessage(auditMessages, |
| String.format(AuditedSecurityOperation.CAN_IMPORT_AUDIT_TEMPLATE, NEW_TEST_TABLE_NAME, |
| Pattern.quote(Set.of(filePrefix + exportDir).toString())))); |
| assertEquals(1, findAuditMessage(auditMessages, String |
| .format(AuditedSecurityOperation.CAN_CREATE_TABLE_AUDIT_TEMPLATE, THIRD_TEST_TABLE_NAME))); |
| assertEquals(1, |
| findAuditMessage(auditMessages, |
| String.format(AuditedSecurityOperation.CAN_BULK_IMPORT_AUDIT_TEMPLATE, |
| THIRD_TEST_TABLE_NAME, filePrefix + exportDirBulk, null))); |
| assertEquals(1, |
| findAuditMessage(auditMessages, |
| String.format(AuditedSecurityOperation.CAN_ONLINE_OFFLINE_TABLE_AUDIT_TEMPLATE, |
| "onlineTable", OLD_TEST_TABLE_NAME))); |
| |
| } |
| |
| @Test |
| public void testDataOperationsAudits() throws AccumuloSecurityException, AccumuloException, |
| TableExistsException, TableNotFoundException, IOException { |
| |
| client.securityOperations().createLocalUser(AUDIT_USER_1, new PasswordToken(PASSWORD)); |
| client.securityOperations().grantSystemPermission(AUDIT_USER_1, SystemPermission.SYSTEM); |
| client.securityOperations().changeUserAuthorizations(AUDIT_USER_1, auths); |
| grantEverySystemPriv(client, AUDIT_USER_1); |
| |
| // Connect as Audit User and do a bunch of stuff. |
| // Start testing activities here |
| auditAccumuloClient = |
| getCluster().createAccumuloClient(AUDIT_USER_1, new PasswordToken(PASSWORD)); |
| auditAccumuloClient.tableOperations().create(OLD_TEST_TABLE_NAME); |
| |
| // Insert some play data |
| try (BatchWriter bw = auditAccumuloClient.createBatchWriter(OLD_TEST_TABLE_NAME)) { |
| Mutation m = new Mutation("myRow"); |
| m.put("cf1", "cq1", "v1"); |
| m.put("cf1", "cq2", "v3"); |
| bw.addMutation(m); |
| } |
| |
| // Start testing activities here |
| // A regular scan |
| try (Scanner scanner = auditAccumuloClient.createScanner(OLD_TEST_TABLE_NAME, auths)) { |
| for (Map.Entry<Key,Value> entry : scanner) { |
| System.out.println("Scanner row: " + entry.getKey() + " " + entry.getValue()); |
| } |
| } |
| |
| // A batch scan |
| try (BatchScanner bs = auditAccumuloClient.createBatchScanner(OLD_TEST_TABLE_NAME, auths, 1)) { |
| bs.fetchColumn(new Text("cf1"), new Text("cq1")); |
| bs.setRanges(Arrays.asList(new Range("myRow", "myRow~"))); |
| for (Map.Entry<Key,Value> entry : bs) { |
| System.out.println("BatchScanner row: " + entry.getKey() + " " + entry.getValue()); |
| } |
| } |
| |
| // Delete some data. |
| auditAccumuloClient.tableOperations().deleteRows(OLD_TEST_TABLE_NAME, new Text("myRow"), |
| new Text("myRow~")); |
| |
| // End of testing activities |
| |
| ArrayList<String> auditMessages = getAuditMessages("testDataOperationsAudits"); |
| assertTrue( |
| findAuditMessage(auditMessages, "action: scan; targetTable: " + OLD_TEST_TABLE_NAME) >= 1); |
| assertTrue( |
| findAuditMessage(auditMessages, "action: scan; targetTable: " + OLD_TEST_TABLE_NAME) >= 1); |
| assertEquals(1, |
| findAuditMessage(auditMessages, |
| String.format(AuditedSecurityOperation.CAN_DELETE_RANGE_AUDIT_TEMPLATE, |
| OLD_TEST_TABLE_NAME, "myRow", "myRow~"))); |
| |
| } |
| |
| @Test |
| public void testDeniedAudits() throws AccumuloSecurityException, AccumuloException, |
| TableExistsException, TableNotFoundException, IOException { |
| |
| // Create our user with no privs |
| client.securityOperations().createLocalUser(AUDIT_USER_1, new PasswordToken(PASSWORD)); |
| client.tableOperations().create(OLD_TEST_TABLE_NAME); |
| auditAccumuloClient = |
| getCluster().createAccumuloClient(AUDIT_USER_1, new PasswordToken(PASSWORD)); |
| |
| // Start testing activities |
| // We should get denied or / failed audit messages here. |
| // We don't want the thrown exceptions to stop our tests, and we are not testing that the |
| // Exceptions are thrown. |
| |
| try { |
| auditAccumuloClient.tableOperations().create(NEW_TEST_TABLE_NAME); |
| } catch (AccumuloSecurityException ex) {} |
| try { |
| auditAccumuloClient.tableOperations().rename(OLD_TEST_TABLE_NAME, NEW_TEST_TABLE_NAME); |
| } catch (AccumuloSecurityException ex) {} |
| try { |
| auditAccumuloClient.tableOperations().clone(OLD_TEST_TABLE_NAME, NEW_TEST_TABLE_NAME, false, |
| Collections.emptyMap(), Collections.emptySet()); |
| } catch (AccumuloSecurityException ex) {} |
| try { |
| auditAccumuloClient.tableOperations().delete(OLD_TEST_TABLE_NAME); |
| } catch (AccumuloSecurityException ex) {} |
| try { |
| auditAccumuloClient.tableOperations().offline(OLD_TEST_TABLE_NAME); |
| } catch (AccumuloSecurityException ex) {} |
| try (Scanner scanner = auditAccumuloClient.createScanner(OLD_TEST_TABLE_NAME, auths)) { |
| scanner.iterator().next().getKey(); |
| } catch (RuntimeException ex) {} |
| try { |
| auditAccumuloClient.tableOperations().deleteRows(OLD_TEST_TABLE_NAME, new Text("myRow"), |
| new Text("myRow~")); |
| } catch (AccumuloSecurityException ex) {} |
| try { |
| auditAccumuloClient.tableOperations().flush(OLD_TEST_TABLE_NAME, new Text("myRow"), |
| new Text("myRow~"), false); |
| } catch (AccumuloSecurityException ex) {} |
| |
| // ... that will do for now. |
| // End of testing activities |
| |
| ArrayList<String> auditMessages = getAuditMessages("testDeniedAudits"); |
| assertEquals(1, findAuditMessage(auditMessages, "operation: denied;.*" + String |
| .format(AuditedSecurityOperation.CAN_CREATE_TABLE_AUDIT_TEMPLATE, NEW_TEST_TABLE_NAME))); |
| assertEquals(1, |
| findAuditMessage(auditMessages, |
| "operation: denied;.*" |
| + String.format(AuditedSecurityOperation.CAN_RENAME_TABLE_AUDIT_TEMPLATE, |
| OLD_TEST_TABLE_NAME, NEW_TEST_TABLE_NAME))); |
| assertEquals(1, |
| findAuditMessage(auditMessages, |
| "operation: denied;.*" |
| + String.format(AuditedSecurityOperation.CAN_CLONE_TABLE_AUDIT_TEMPLATE, |
| OLD_TEST_TABLE_NAME, NEW_TEST_TABLE_NAME))); |
| assertEquals(1, findAuditMessage(auditMessages, "operation: denied;.*" + String |
| .format(AuditedSecurityOperation.CAN_DELETE_TABLE_AUDIT_TEMPLATE, OLD_TEST_TABLE_NAME))); |
| assertEquals(1, |
| findAuditMessage(auditMessages, |
| "operation: denied;.*" |
| + String.format(AuditedSecurityOperation.CAN_ONLINE_OFFLINE_TABLE_AUDIT_TEMPLATE, |
| "offlineTable", OLD_TEST_TABLE_NAME))); |
| assertEquals(1, findAuditMessage(auditMessages, |
| "operation: denied;.*" + "action: scan; targetTable: " + OLD_TEST_TABLE_NAME)); |
| assertEquals(1, |
| findAuditMessage(auditMessages, |
| "operation: denied;.*" |
| + String.format(AuditedSecurityOperation.CAN_DELETE_RANGE_AUDIT_TEMPLATE, |
| OLD_TEST_TABLE_NAME, "myRow", "myRow~"))); |
| assertEquals(1, findAuditMessage(auditMessages, "operation: denied;.*" + String |
| .format(AuditedSecurityOperation.CAN_FLUSH_TABLE_AUDIT_TEMPLATE, "1", "\\+default"))); |
| } |
| |
| @Test |
| public void testFailedAudits() throws AccumuloException, IOException { |
| |
| // Start testing activities |
| // Test that we get a few "failed" audit messages come through when we tell it to do dumb stuff |
| // We don't want the thrown exceptions to stop our tests, and we are not testing that the |
| // Exceptions are thrown. |
| try { |
| client.securityOperations().dropLocalUser(AUDIT_USER_2); |
| } catch (AccumuloSecurityException ex) {} |
| try { |
| client.securityOperations().revokeSystemPermission(AUDIT_USER_2, |
| SystemPermission.ALTER_TABLE); |
| } catch (AccumuloSecurityException ex) {} |
| try { |
| client.securityOperations().createLocalUser("root", new PasswordToken("super secret")); |
| } catch (AccumuloSecurityException ex) {} |
| ArrayList<String> auditMessages = getAuditMessages("testFailedAudits"); |
| // ... that will do for now. |
| // End of testing activities |
| |
| // We're permitted to drop this user, but it fails because the user doesn't actually exist. |
| assertEquals(2, findAuditMessage(auditMessages, |
| String.format(AuditedSecurityOperation.DROP_USER_AUDIT_TEMPLATE, AUDIT_USER_2))); |
| assertEquals(1, |
| findAuditMessage(auditMessages, |
| String.format(AuditedSecurityOperation.REVOKE_SYSTEM_PERMISSION_AUDIT_TEMPLATE, |
| SystemPermission.ALTER_TABLE, AUDIT_USER_2))); |
| assertEquals(1, findAuditMessage(auditMessages, |
| String.format(AuditedSecurityOperation.CREATE_USER_AUDIT_TEMPLATE, "root", ""))); |
| |
| } |
| |
| } |
