Package org.apache.hadoop.ozone.om

Class OMMultiTenantManagerImpl.AuthorizerOp

java.lang.Object
org.apache.hadoop.ozone.om.OMMultiTenantManagerImpl.AuthorizerOp
All Implemented Interfaces:
TenantOp
Enclosing class:
OMMultiTenantManagerImpl
public class OMMultiTenantManagerImpl.AuthorizerOp extends Object implements TenantOp
Implements tenant authorizer operations.

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    assignTenantAdmin(String accessId, boolean delegated)
    Given an accessId, grant that user admin privilege in the tenant.
    void
    assignUserToTenant(String userPrincipal, String tenantId, String accessId)
    Algorithm Authorizer-plugin(Ranger) State : - create User in Ranger DB - For every user created Add them to # GroupTenantAllUsers In case of failure : - Undo all Ranger State - remove updates to the Map Locking : - Create/Manage Tenant/User operations are control path operations.
    void
    createTenant(String tenantId, String userRoleName, String adminRoleName)
    Algorithm OM State : - Validation (Part of Ratis Request) - create volume {Part of RATIS request} - Persistence to OM DB {Part of RATIS request} Authorizer-plugin(Ranger) State : - For every tenant create two user groups # GroupTenantAllUsers # GroupTenantAllAdmins - For every tenant create two default policies - Note: plugin states are made idempotent.
    void
    deleteTenant(org.apache.hadoop.ozone.om.multitenant.Tenant tenant)
    Given a Tenant object, remove all policies and roles from Ranger that are added during tenant creation.
    void
    revokeTenantAdmin(String accessId)
    Given an accessId, revoke that user's admin privilege in that tenant.
    void
    revokeUserAccessId(String accessId, String tenantId)
    Revoke user accessId in a tenant.

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Method Details

    • createTenant

      public void createTenant(String tenantId, String userRoleName, String adminRoleName) throws IOException
      Algorithm OM State : - Validation (Part of Ratis Request) - create volume {Part of RATIS request} - Persistence to OM DB {Part of RATIS request} Authorizer-plugin(Ranger) State : - For every tenant create two user groups # GroupTenantAllUsers # GroupTenantAllAdmins - For every tenant create two default policies - Note: plugin states are made idempotent. Onus of returning EEXIST is part of validation in Ratis-Request. if the groups/policies exist with the same name (Due to an earlier failed/success request), in plugin, we just update in-memory-map here and return success. - The job of cleanup of any half-done authorizer-plugin state is done by a background thread. Finally : - Update all Maps maintained by Multi-Tenant-Manager In case of failure : - Undo all Ranger State - remove updates to the Map Locking : - Create/Manage Tenant/User operations are control path operations. We can do all of this as part of holding a coarse lock and synchronize these control path operations.
      Specified by:
      createTenant in interface TenantOp
      Parameters:
      tenantId - tenant name
      userRoleName - user role name
      adminRoleName - admin role name
      Throws:
      IOException

    • deleteTenant

      public void deleteTenant(org.apache.hadoop.ozone.om.multitenant.Tenant tenant) throws IOException
      Description copied from interface: TenantOp
      Given a Tenant object, remove all policies and roles from Ranger that are added during tenant creation. Note this differs from deactivateTenant() above.
      Specified by:
      deleteTenant in interface TenantOp
      Parameters:
      tenant - tenant object
      Throws:
      IOException

    • assignUserToTenant

      public void assignUserToTenant(String userPrincipal, String tenantId, String accessId) throws IOException
      Algorithm Authorizer-plugin(Ranger) State : - create User in Ranger DB - For every user created Add them to # GroupTenantAllUsers In case of failure : - Undo all Ranger State - remove updates to the Map Locking : - Create/Manage Tenant/User operations are control path operations. We can do all of this as part of holding a coarse lock and synchronize these control path operations.
      Specified by:
      assignUserToTenant in interface TenantOp
      Parameters:
      userPrincipal -
      tenantId -
      accessId -
      Throws:
      IOException

    • revokeUserAccessId

      public void revokeUserAccessId(String accessId, String tenantId) throws IOException
      Description copied from interface: TenantOp
      Revoke user accessId in a tenant.
      Specified by:
      revokeUserAccessId in interface TenantOp
      Parameters:
      accessId - access ID
      tenantId - tenant name
      Throws:
      IOException

    • assignTenantAdmin

      public void assignTenantAdmin(String accessId, boolean delegated) throws IOException
      Description copied from interface: TenantOp
      Given an accessId, grant that user admin privilege in the tenant.
      Specified by:
      assignTenantAdmin in interface TenantOp
      Parameters:
      accessId - access ID
      delegated - true if intending to assign as the user as the tenant's delegated admin (who can assign and revoke other tenant admins in this tenant)
      Throws:
      IOException

    • revokeTenantAdmin

      public void revokeTenantAdmin(String accessId) throws IOException
      Description copied from interface: TenantOp
      Given an accessId, revoke that user's admin privilege in that tenant.
      Specified by:
      revokeTenantAdmin in interface TenantOp
      Parameters:
      accessId - access ID
      Throws:
      IOException