sentry-tests/sentry-tests-sqoop/src/test/java/org/apache/sentry/tests/e2e/sqoop/TestRoleOperation.java

/*
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.apache.sentry.tests.e2e.sqoop;

import org.apache.sentry.sqoop.SentrySqoopError;
import org.apache.sqoop.client.SqoopClient;
import org.apache.sqoop.model.MPrincipal;
import org.apache.sqoop.model.MRole;
import org.junit.Test;

import com.google.common.collect.Lists;

import static org.junit.Assert.assertTrue;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.fail;

public class TestRoleOperation extends AbstractSqoopSentryTestBase {

  @Test
  public void testAdminToCreateDeleteRole() throws Exception {
    SqoopClient client = sqoopServerRunner.getSqoopClient(ADMIN_USER);
    MRole role1 = new MRole("create_delete_role_1");
    MRole role2 = new MRole("create_delete_role_2");
    client.createRole(role1);
    client.createRole(role2);
    assertTrue( client.getRoles().size() > 0);
  }

  @Test
  public void testNotAdminToCreateDeleteRole() throws Exception {
    SqoopClient client = sqoopServerRunner.getSqoopClient(ADMIN_USER);
    MRole role1 = new MRole("not_admin_create_delete_role_1");
    MRole role2 = new MRole("not_admin_create_delete_role_2");
    client.createRole(role1);

    client = sqoopServerRunner.getSqoopClient(USER1);
    try {
      client.createRole(role2);
      fail("expected SentryAccessDeniedException happend");
    } catch (Exception e) {
      assertCausedMessage(e, "SentryAccessDeniedException");
    }
    try {
      client.dropRole(role1);
      fail("expected SentryAccessDeniedException happend");
    } catch (Exception e) {
      assertCausedMessage(e, "SentryAccessDeniedException");
    }
  }

  @Test
  public void testCreateExistedRole() throws Exception {
    SqoopClient client = sqoopServerRunner.getSqoopClient(ADMIN_USER);
    MRole role1 = new MRole("create_exist_role_1");
    client.createRole(role1);
    try {
      client.createRole(role1);
      fail("expected SentryAlreadyExistsException happend");
    } catch (Exception e) {
      assertCausedMessage(e, "SentryAlreadyExistsException");
    }
  }

  @Test
  public void testDropNotExistedRole() throws Exception {
    SqoopClient client = sqoopServerRunner.getSqoopClient(ADMIN_USER);
    try {
      client.dropRole(new MRole("drop_noexisted_role_1"));
      fail("expect SentryNoSuchObjectException to throw");
    } catch (Exception e) {
      assertCausedMessage(e, "SentryNoSuchObjectException");
    }
  }

  @Test
  public void testAdminShowAllRole() throws Exception {
    SqoopClient client = sqoopServerRunner.getSqoopClient(ADMIN_USER);
    client.createRole(new MRole("show_all_role"));
    assertTrue(client.getRoles().size() > 0);
  }

  @Test
  public void testNotAdminShowAllRole() throws Exception {
    SqoopClient client = sqoopServerRunner.getSqoopClient(USER1);
    try {
      client.getRoles();
      fail("expected SentryAccessDeniedException happend");
    } catch (Exception e) {
      assertCausedMessage(e, "SentryAccessDeniedException");
    }
  }

  @Test
  public void testNotSupportAddRoleToUser() throws Exception {
    SqoopClient client = sqoopServerRunner.getSqoopClient(ADMIN_USER);
    MRole role1 = new MRole("add_to_user_role");
    MPrincipal user1 = new MPrincipal("add_to_user", MPrincipal.TYPE.USER);
    try {
      client.grantRole(Lists.newArrayList(role1), Lists.newArrayList(user1));
      fail("expected not support exception happend");
    } catch (Exception e) {
      assertCausedMessage(e, SentrySqoopError.GRANT_REVOKE_ROLE_NOT_SUPPORT_FOR_PRINCIPAL);
    }
  }

  @Test
  public void testShowRoleOnGroup() throws Exception {
    SqoopClient client = sqoopServerRunner.getSqoopClient(ADMIN_USER);
    // admin user grant role1 to group1
    MRole role1 = new MRole(ROLE1);
    client.createRole(role1);
    MPrincipal group1 = new MPrincipal(GROUP1, MPrincipal.TYPE.GROUP);
    client.grantRole(Lists.newArrayList(role1), Lists.newArrayList(group1));
    // admin user grant role2 to group2
    MRole role2 = new MRole(ROLE2);
    client.createRole(role2);
    MPrincipal group2 = new MPrincipal(GROUP2, MPrincipal.TYPE.GROUP);
    client.grantRole(Lists.newArrayList(role2), Lists.newArrayList(group2));

    // use1 can show role on group1
    client = sqoopServerRunner.getSqoopClient(USER1);
    assertEquals(role1.getName(), client.getRolesByPrincipal(group1).get(0).getName());

    // use1 can't show role on group2
    try {
      client.getRolesByPrincipal(group2);
      fail("expected SentryAccessDeniedException happend");
    } catch (Exception e) {
      assertCausedMessage(e, "SentryAccessDeniedException");
    }

    // user2 can show role on group2
    client = sqoopServerRunner.getSqoopClient(USER2);
    assertEquals(role2.getName(), client.getRolesByPrincipal(group2).get(0).getName());

    // use2 can't show role on group1
    try {
      client.getRolesByPrincipal(group1);
      fail("expected SentryAccessDeniedException happend");
    } catch (Exception e) {
      assertCausedMessage(e, "SentryAccessDeniedException");
    }
  }

  @Test
  public void testAddDeleteRoleOnGroup() throws Exception {
    SqoopClient client = sqoopServerRunner.getSqoopClient(ADMIN_USER);
    // admin user grant role3 to group3
    MRole role3 = new MRole(ROLE3);
    client.createRole(role3);
    MPrincipal group3 = new MPrincipal(GROUP3, MPrincipal.TYPE.GROUP);
    client.grantRole(Lists.newArrayList(role3), Lists.newArrayList(group3));
    // admin user grant role4 to group4
    MRole role4 = new MRole(ROLE4);
    client.createRole(role4);
    MPrincipal group4 = new MPrincipal(GROUP4, MPrincipal.TYPE.GROUP);
    client.grantRole(Lists.newArrayList(role4), Lists.newArrayList(group4));

    // use3 can show role on group3
    client = sqoopServerRunner.getSqoopClient(USER3);
    assertEquals(role3.getName(), client.getRolesByPrincipal(group3).get(0).getName());

    // user4 can show role on group4
    client = sqoopServerRunner.getSqoopClient(USER4);
    assertEquals(role4.getName(), client.getRolesByPrincipal(group4).get(0).getName());

    /**
     * admin delete role3 from group3
     * admin delete role4 from group4
     */
    client = sqoopServerRunner.getSqoopClient(ADMIN_USER);
    client.revokeRole(Lists.newArrayList(role3), Lists.newArrayList(group3));
    client.revokeRole(Lists.newArrayList(role4), Lists.newArrayList(group4));

    // use3 show role on group3, empty role list return
    client = sqoopServerRunner.getSqoopClient(USER3);
    assertTrue(client.getRolesByPrincipal(group3).isEmpty());

    // use4 show role on group4, empty role list return
    client = sqoopServerRunner.getSqoopClient(USER4);
    assertTrue(client.getRolesByPrincipal(group4).isEmpty());
  }

  @Test
  public void testNotSupportShowRoleonUser() throws Exception {
    SqoopClient client = sqoopServerRunner.getSqoopClient(ADMIN_USER);
    MPrincipal user1 = new MPrincipal("showRoleOnUser", MPrincipal.TYPE.USER);
    try {
      client.getRolesByPrincipal(user1);
      fail("expected not support exception happend");
    } catch (Exception e) {
      assertCausedMessage(e, SentrySqoopError.SHOW_GRANT_NOT_SUPPORTED_FOR_PRINCIPAL);
    }
  }
}