This is an automated email from the ASF dual-hosted git repository.
rzo1 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/storm.git
The following commit(s) were added to refs/heads/master by this push:
new 1b3dcc12d Authorize createStateInZookeeper requests like the other
blob operations
1b3dcc12d is described below
commit 1b3dcc12d90b9ed104b5c5ca5c175e3d282e1a6e
Author: Richard Zowalla <[email protected]>
AuthorDate: Sat Aug 22 20:03:13 2026 +0200
Authorize createStateInZookeeper requests like the other blob operations
---
.../auth/authorizer/SimpleACLAuthorizer.java | 1 +
.../auth/authorizer/SimpleACLAuthorizerTest.java | 5 +++++
.../org/apache/storm/daemon/nimbus/Nimbus.java | 1 +
.../org/apache/storm/daemon/nimbus/NimbusTest.java | 22 ++++++++++++++++++++++
4 files changed, 29 insertions(+)
diff --git
a/storm-client/src/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizer.java
b/storm-client/src/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizer.java
index 399a9b049..d95965eaa 100644
---
a/storm-client/src/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizer.java
+++
b/storm-client/src/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizer.java
@@ -39,6 +39,7 @@ public class SimpleACLAuthorizer implements IAuthorizer {
protected Set<String> userCommands = new HashSet<>(Arrays.asList(
"submitTopology",
"fileUpload",
+ "createStateInZookeeper",
"getNimbusConf",
"listBlobs",
"getClusterInfo",
diff --git
a/storm-client/test/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizerTest.java
b/storm-client/test/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizerTest.java
index 63eaf7922..b2c05c385 100644
---
a/storm-client/test/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizerTest.java
+++
b/storm-client/test/jvm/org/apache/storm/security/auth/authorizer/SimpleACLAuthorizerTest.java
@@ -63,6 +63,11 @@ public class SimpleACLAuthorizerTest {
assertTrue(authorizer.permit(new ReqContext(userA), "fileUpload", new
HashMap<>()));
assertTrue(authorizer.permit(new ReqContext(userB), "fileUpload", new
HashMap<>()));
+ assertTrue(authorizer.permit(new ReqContext(adminUser),
"createStateInZookeeper", new HashMap<>()));
+ assertFalse(authorizer.permit(new ReqContext(supervisorUser),
"createStateInZookeeper", new HashMap<>()));
+ assertTrue(authorizer.permit(new ReqContext(userA),
"createStateInZookeeper", new HashMap<>()));
+ assertTrue(authorizer.permit(new ReqContext(userB),
"createStateInZookeeper", new HashMap<>()));
+
assertTrue(authorizer.permit(new ReqContext(adminUser),
"getNimbusConf", new HashMap<>()));
assertFalse(authorizer.permit(new ReqContext(supervisorUser),
"getNimbusConf", new HashMap<>()));
assertTrue(authorizer.permit(new ReqContext(userA), "getNimbusConf",
new HashMap<>()));
diff --git
a/storm-server/src/main/java/org/apache/storm/daemon/nimbus/Nimbus.java
b/storm-server/src/main/java/org/apache/storm/daemon/nimbus/Nimbus.java
index ab0614424..3064c6ebe 100644
--- a/storm-server/src/main/java/org/apache/storm/daemon/nimbus/Nimbus.java
+++ b/storm-server/src/main/java/org/apache/storm/daemon/nimbus/Nimbus.java
@@ -4149,6 +4149,7 @@ public class Nimbus implements Iface, Shutdownable,
DaemonCommon {
@Override
public void createStateInZookeeper(String key) throws TException {
try {
+ checkAuthorization(null, null, "createStateInZookeeper");
IStormClusterState state = stormClusterState;
BlobStore store = blobStore;
NimbusInfo ni = nimbusHostPortInfo;
diff --git
a/storm-server/src/test/java/org/apache/storm/daemon/nimbus/NimbusTest.java
b/storm-server/src/test/java/org/apache/storm/daemon/nimbus/NimbusTest.java
index 2326a94eb..a6c0771f1 100644
--- a/storm-server/src/test/java/org/apache/storm/daemon/nimbus/NimbusTest.java
+++ b/storm-server/src/test/java/org/apache/storm/daemon/nimbus/NimbusTest.java
@@ -51,6 +51,7 @@ import
org.apache.storm.scheduler.resource.strategies.priority.DefaultScheduling
import
org.apache.storm.scheduler.resource.strategies.scheduling.DefaultResourceAwareStrategy;
import
org.apache.storm.scheduler.resource.strategies.scheduling.GenericResourceAwareStrategyOld;
import
org.apache.storm.scheduler.resource.strategies.scheduling.RoundRobinResourceAwareStrategy;
+import org.apache.storm.security.auth.IAuthorizer;
import org.apache.storm.security.auth.IGroupMappingServiceProvider;
import org.apache.storm.security.auth.ReqContext;
import org.apache.storm.security.auth.SingleUserPrincipal;
@@ -188,6 +189,27 @@ class NimbusTest {
verify(stormClusterState).setupBlob(eq(BLOB_FILE_KEY), eq(nimbusInfo),
any());
}
+ @Test
+ void testCreateStateInZookeeperIsNotAllowedWhenTheAuthorizerDeniesIt()
throws Exception {
+ IAuthorizer authorizer = mock(IAuthorizer.class);
+ when(authorizer.permit(any(), eq("createStateInZookeeper"),
any())).thenReturn(false);
+ nimbus.setAuthorizationHandler(authorizer);
+
+ assertThrows(AuthorizationException.class, () ->
nimbus.createStateInZookeeper(BLOB_FILE_KEY));
+ verify(stormClusterState, never()).setupBlob(eq(BLOB_FILE_KEY),
eq(nimbusInfo), any());
+ }
+
+ @Test
+ void testCreateStateInZookeeperIsAllowedWhenTheAuthorizerPermitsIt()
throws Exception {
+ IAuthorizer authorizer = mock(IAuthorizer.class);
+ when(authorizer.permit(any(), eq("createStateInZookeeper"),
any())).thenReturn(true);
+ nimbus.setAuthorizationHandler(authorizer);
+
+ nimbus.createStateInZookeeper(BLOB_FILE_KEY);
+
+ verify(stormClusterState).setupBlob(eq(BLOB_FILE_KEY), eq(nimbusInfo),
any());
+ }
+
@Test
void
testCreateStateInZookeeperWithoutLocalFsBlobStoreInstanceShouldNotCreate()
throws Exception {
BlobStore blobStore = mock(BlobStore.class);
