Package org.apache.hadoop.ozone.om

Class OMMultiTenantManagerImpl

java.lang.Object

org.apache.hadoop.ozone.om.OMMultiTenantManagerImpl

All Implemented Interfaces:

OMMultiTenantManager

public class OMMultiTenantManagerImpl
extends Object
implements OMMultiTenantManager

Implements OMMultiTenantManager.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
class	OMMultiTenantManagerImpl.AuthorizerOp	Implements tenant authorizer operations.
class	OMMultiTenantManagerImpl.CacheOp	Implements tenant cache operations.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	OZONE_OM_TENANT_DEV_SKIP_RANGER

Fields inherited from interface org.apache.hadoop.ozone.om.OMMultiTenantManager

OZONE_TENANT_RANGER_POLICY_DESCRIPTION, OZONE_TENANT_RANGER_ROLE_DESCRIPTION

Constructor Summary

Constructors

Constructor	Description
OMMultiTenantManagerImpl(OzoneManager ozoneManager, org.apache.hadoop.hdds.conf.OzoneConfiguration conf)

Method Summary

Modifier and Type	Method	Description
void	checkAdmin()	Passes check only when caller is an Ozone (cluster) admin, throws OMException otherwise.
void	checkTenantAdmin(String tenantId, boolean delegated)	Check if caller is a tenant admin of the specified tenant.
void	checkTenantExistence(String tenantId)	Check if the tenantId exists in the table, throws TENANT_NOT_FOUND if not.
HashMap<String,HashSet<String>>	getAllRolesFromCache()	Generate and return a mapping from roles to a set of user principals from tenantCache.
AuthorizerLock	getAuthorizerLock()
TenantOp	getAuthorizerOp()
TenantOp	getCacheOp()
org.apache.hadoop.hdds.conf.OzoneConfiguration	getConf()
org.apache.hadoop.ozone.om.OMMetadataManager	getOmMetadataManager()	Returns the corresponding OzoneManager instance.
OMRangerBGSyncService	getOMRangerBGSyncService()	Returns the instance of OMRangerBGSyncService.
String	getTenantAdminRoleName(String tenantId)	Retrieve admin role name of the given tenant.
Map<String,CachedTenantState>	getTenantCache()
Optional<String>	getTenantForAccessID(String accessID)	Given an access ID return its corresponding tenant.
org.apache.hadoop.ozone.om.multitenant.Tenant	getTenantFromDBById(String tenantId)	Get Tenant object of given tenant name from OM DB.
String	getTenantUserRoleName(String tenantId)	Retrieve user role name of the given tenant.
String	getTenantVolumeName(String tenantId)	Retrieve volume name of the tenant.
String	getUserNameGivenAccessId(String accessId)	Given an accessId, return kerberos user name for the tenant user.
boolean	isTenantAdmin(org.apache.hadoop.security.UserGroupInformation callerUgi, String tenantId, boolean delegated)	Returns true if user is the tenant's admin or Ozone admin, false otherwise.
boolean	isTenantEmpty(String tenantId)	Returns true if the tenant doesn't have any accessIds assigned to it Returns false otherwise.
boolean	isUserAccessIdPrincipalOrTenantAdmin(String accessId, org.apache.hadoop.security.UserGroupInformation ugi)
org.apache.hadoop.ozone.om.helpers.TenantUserList	listUsersInTenant(String tenantID, String prefix)	List all the user and accessIDs of all users that belong to this Tenant.
void	start()	Start the Ranger policy and role sync thread.
void	stop()	Stop the Ranger policy and role sync thread.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

OZONE_OM_TENANT_DEV_SKIP_RANGER

public static final String OZONE_OM_TENANT_DEV_SKIP_RANGER

See Also:

• Constant Field Values

Constructor Details

OMMultiTenantManagerImpl

public OMMultiTenantManagerImpl(OzoneManager ozoneManager,
 org.apache.hadoop.hdds.conf.OzoneConfiguration conf)
                         throws IOException

Throws:

IOException

Method Details

getOMRangerBGSyncService

public OMRangerBGSyncService getOMRangerBGSyncService()

Description copied from interface: OMMultiTenantManager

Returns the instance of OMRangerBGSyncService.

Specified by:

getOMRangerBGSyncService in interface OMMultiTenantManager

start

public void start()
           throws IOException

Start the Ranger policy and role sync thread.

Specified by:

start in interface OMMultiTenantManager

Throws:

IOException

stop

public void stop()
          throws IOException

Stop the Ranger policy and role sync thread.

Specified by:

stop in interface OMMultiTenantManager

Throws:

IOException

getOmMetadataManager

public org.apache.hadoop.ozone.om.OMMetadataManager getOmMetadataManager()

Description copied from interface: OMMultiTenantManager

Returns the corresponding OzoneManager instance.

Specified by:

getOmMetadataManager in interface OMMultiTenantManager

Returns:

OMMetadataManager

getAuthorizerOp

public TenantOp getAuthorizerOp()

Specified by:

getAuthorizerOp in interface OMMultiTenantManager

getCacheOp

public TenantOp getCacheOp()

Specified by:

getCacheOp in interface OMMultiTenantManager

getUserNameGivenAccessId

public String getUserNameGivenAccessId(String accessId)

Description copied from interface: OMMultiTenantManager

Given an accessId, return kerberos user name for the tenant user.

Specified by:

getUserNameGivenAccessId in interface OMMultiTenantManager

isTenantAdmin

public boolean isTenantAdmin(org.apache.hadoop.security.UserGroupInformation callerUgi,
 String tenantId,
 boolean delegated)

Returns true if user is the tenant's admin or Ozone admin, false otherwise.

Specified by:

isTenantAdmin in interface OMMultiTenantManager

Parameters:

callerUgi - caller's UserGroupInformation

tenantId - tenant name

delegated - if set to true, checks if the user is a delegated tenant admin; if set to false, checks if the user is a tenant admin, delegated or not

listUsersInTenant

public org.apache.hadoop.ozone.om.helpers.TenantUserList listUsersInTenant(String tenantID,
 String prefix)
                                                                    throws IOException

Description copied from interface: OMMultiTenantManager

List all the user and accessIDs of all users that belong to this Tenant. Note this read is unprotected. See OzoneManager#listUserInTenant

Specified by:

listUsersInTenant in interface OMMultiTenantManager

Parameters:

tenantID -

Returns:

List of users

Throws:

IOException

getTenantForAccessID

public Optional<String> getTenantForAccessID(String accessID)
                                      throws IOException

Description copied from interface: OMMultiTenantManager

Given an access ID return its corresponding tenant.

Specified by:

getTenantForAccessID in interface OMMultiTenantManager

Parameters:

accessID -

Returns:

String tenant name

Throws:

IOException

getConf

public org.apache.hadoop.hdds.conf.OzoneConfiguration getConf()

checkAdmin

public void checkAdmin()
                throws org.apache.hadoop.ozone.om.exceptions.OMException

Description copied from interface: OMMultiTenantManager

Passes check only when caller is an Ozone (cluster) admin, throws OMException otherwise.

Specified by:

checkAdmin in interface OMMultiTenantManager

Throws:

org.apache.hadoop.ozone.om.exceptions.OMException - PERMISSION_DENIED

checkTenantAdmin

public void checkTenantAdmin(String tenantId,
 boolean delegated)
                      throws org.apache.hadoop.ozone.om.exceptions.OMException

Description copied from interface: OMMultiTenantManager

Check if caller is a tenant admin of the specified tenant. Ozone admins will always pass this check. Throws PERMISSION_DENIED if the check failed.

Specified by:

checkTenantAdmin in interface OMMultiTenantManager

Parameters:

tenantId - tenant name

delegated - if set to true, only delegated tenant admins can pass this check; if false, both delegated and non-delegated tenant admins will pass this check.

Throws:

org.apache.hadoop.ozone.om.exceptions.OMException - PERMISSION_DENIED

checkTenantExistence

public void checkTenantExistence(String tenantId)
                          throws org.apache.hadoop.ozone.om.exceptions.OMException

Description copied from interface: OMMultiTenantManager

Check if the tenantId exists in the table, throws TENANT_NOT_FOUND if not.

Specified by:

checkTenantExistence in interface OMMultiTenantManager

Throws:

org.apache.hadoop.ozone.om.exceptions.OMException

getTenantVolumeName

public String getTenantVolumeName(String tenantId)
                           throws IOException

Description copied from interface: OMMultiTenantManager

Retrieve volume name of the tenant. Throws OMException TENANT_NOT_FOUND if tenantId doesn't exist.

Specified by:

getTenantVolumeName in interface OMMultiTenantManager

Throws:

IOException

getTenantUserRoleName

public String getTenantUserRoleName(String tenantId)
                             throws IOException

Description copied from interface: OMMultiTenantManager

Retrieve user role name of the given tenant.

Specified by:

getTenantUserRoleName in interface OMMultiTenantManager

Parameters:

tenantId - tenant name

Returns:

tenant user role name

Throws:

IOException

getTenantAdminRoleName

public String getTenantAdminRoleName(String tenantId)
                              throws IOException

Description copied from interface: OMMultiTenantManager

Retrieve admin role name of the given tenant.

Specified by:

getTenantAdminRoleName in interface OMMultiTenantManager

Parameters:

tenantId - tenant name

Returns:

tenant user role name

Throws:

IOException

getTenantFromDBById

public org.apache.hadoop.ozone.om.multitenant.Tenant getTenantFromDBById(String tenantId)
                                                                  throws IOException

Description copied from interface: OMMultiTenantManager

Get Tenant object of given tenant name from OM DB.

Specified by:

getTenantFromDBById in interface OMMultiTenantManager

Parameters:

tenantId - tenant name

Returns:

Tenant

Throws:

IOException

isUserAccessIdPrincipalOrTenantAdmin

public boolean isUserAccessIdPrincipalOrTenantAdmin(String accessId,
 org.apache.hadoop.security.UserGroupInformation ugi)
                                             throws IOException

Specified by:

isUserAccessIdPrincipalOrTenantAdmin in interface OMMultiTenantManager

Throws:

IOException

isTenantEmpty

public boolean isTenantEmpty(String tenantId)
                      throws IOException

Description copied from interface: OMMultiTenantManager

Returns true if the tenant doesn't have any accessIds assigned to it Returns false otherwise.

Specified by:

isTenantEmpty in interface OMMultiTenantManager

Parameters:

tenantId -

Throws:

IOException

getTenantCache

public Map<String,CachedTenantState> getTenantCache()

getAllRolesFromCache

public HashMap<String,HashSet<String>> getAllRolesFromCache()

Generate and return a mapping from roles to a set of user principals from tenantCache.

getAuthorizerLock

public AuthorizerLock getAuthorizerLock()

Specified by:

getAuthorizerLock in interface OMMultiTenantManager