Package org.apache.hadoop.ozone.om.request.s3.tenant

Class OMTenantAssignUserAccessIdRequest

java.lang.Object
org.apache.hadoop.ozone.om.request.OMClientRequest
org.apache.hadoop.ozone.om.request.s3.tenant.OMTenantAssignUserAccessIdRequest
All Implemented Interfaces:
RequestAuditor
public class OMTenantAssignUserAccessIdRequest extends OMClientRequest
Handles OMAssignUserToTenantRequest. Execution flow (might be a bit outdated): - Client (AssignUserToTenantHandler) - Check admin privilege - Check username validity: ensure no invalid characters - Send request to server - OMAssignUserToTenantRequest - preExecute (perform checks and init) - Check username validity (again), check $ - If username is invalid, throw exception to client; else continue - Generate S3 secret for the new user - validateAndUpdateCache (update DB) - Permission check (checkACL need to check access key now) - Grab VOLUME_LOCK write lock - Check tenant existence - If tenant doesn't exist, throw exception to client; else continue - Check accessId existence - If accessId exists, throw exception to client; else continue - Grab S3_SECRET_LOCK write lock - S3SecretTable: Flush generated S3 secret - Key: TENANTNAME$USERNAME (equivalent to kerberosID) - Value: - Release S3_SECRET_LOCK write lock - New entry in tenantAccessIdTable: - Key: New accessId for the user in this tenant. Example of accessId: finance$bob@EXAMPLE.COM - Value: OmDBAccessIdInfo. Has tenantId, kerberosPrincipal, sharedSecret. - New entry or update existing entry in principalToAccessIdsTable: - Key: User principal. Usually the short name of the Kerberos principal. - Value: OmDBUserPrincipalInfo. Has accessIds. - Release VOLUME_LOCK write lock

  • Constructor Details

    • OMTenantAssignUserAccessIdRequest

      public OMTenantAssignUserAccessIdRequest(org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos.OMRequest omRequest)

  • Method Details

    • preExecute

      public org.apache.hadoop.ozone.protocol.proto.OzoneManagerProtocolProtos.OMRequest preExecute(OzoneManager ozoneManager) throws IOException
      Description copied from class: OMClientRequest
      Perform pre-execute steps on a OMRequest. Called from the RPC context, and generates a OMRequest object which has all the information that will be either persisted in RocksDB or returned to the caller once this operation is executed.
      Overrides:
      preExecute in class OMClientRequest
      Returns:
      OMRequest that will be serialized and handed off to Ratis for consensus.
      Throws:
      IOException

    • validateAndUpdateCache

      public OMClientResponse validateAndUpdateCache(OzoneManager ozoneManager, ExecutionContext context)
      Description copied from class: OMClientRequest
      Validate the OMRequest and update the cache. This step should verify that the request can be executed, perform any authorization steps and update the in-memory cache. This step does not persist the changes to the database. To coders and reviewers, CAUTION: Do NOT bring external dependencies into this method, doing so could potentially cause divergence in OM DB states in HA. If you have to, be extremely careful. e.g. Do NOT invoke ACL check inside validateAndUpdateCache, which can use Ranger plugin that relies on external DB.
      Specified by:
      validateAndUpdateCache in class OMClientRequest
      Returns:
      the response that will be returned to the client.